diff options
author | Ryan Dwyer <ryandwyer1@gmail.com> | 2018-07-04 22:58:17 +1000 |
---|---|---|
committer | Ryan Dwyer <ryandwyer1@gmail.com> | 2018-07-04 22:58:17 +1000 |
commit | 50b401677be27103e7c4a67ca455d286f562ff7c (patch) | |
tree | 75dd1aba08ea3351523d3db33b74eba85cc9419e | |
parent | Merge pull request #2200 from mucamaca/fix_transparency (diff) | |
download | sway-50b401677be27103e7c4a67ca455d286f562ff7c.tar.gz sway-50b401677be27103e7c4a67ca455d286f562ff7c.tar.zst sway-50b401677be27103e7c4a67ca455d286f562ff7c.zip |
Fix use after free in transaction code
If we set an instruction as ready twice, it decreases the transaction's
num_waiting a second time and applies the transaction earlier than it
should. This no doubt has undesired effects, probably resulting in a use
after free.
Hopefully fixes the first part of #2207.
-rw-r--r-- | sway/desktop/transaction.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sway/desktop/transaction.c b/sway/desktop/transaction.c index 7b670aec..b4d796cb 100644 --- a/sway/desktop/transaction.c +++ b/sway/desktop/transaction.c | |||
@@ -377,7 +377,9 @@ static void set_instructions_ready(struct sway_view *view, int index) { | |||
377 | for (int i = 0; i <= index; ++i) { | 377 | for (int i = 0; i <= index; ++i) { |
378 | struct sway_transaction_instruction *instruction = | 378 | struct sway_transaction_instruction *instruction = |
379 | view->swayc->instructions->items[i]; | 379 | view->swayc->instructions->items[i]; |
380 | set_instruction_ready(instruction); | 380 | if (!instruction->ready) { |
381 | set_instruction_ready(instruction); | ||
382 | } | ||
381 | } | 383 | } |
382 | } | 384 | } |
383 | 385 | ||