aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLibravatar Andri Yngvason <andri@yngvason.is>2020-12-28 02:53:43 +0000
committerLibravatar Simon Ser <contact@emersion.fr>2021-01-01 19:02:56 +0100
commite11bc058ac7b70921600e113d3621d224f663e17 (patch)
treebd59536823387a570f34ceb2ad0105015f1c9345
parentinput: Clean up input_method_relay in seat_destoy() (diff)
downloadsway-e11bc058ac7b70921600e113d3621d224f663e17.tar.gz
sway-e11bc058ac7b70921600e113d3621d224f663e17.tar.zst
sway-e11bc058ac7b70921600e113d3621d224f663e17.zip
input/seat: Clean up focus_stack in seat_destroy()
This fixes use-after-free when seat_destroy() has been called.
-rw-r--r--sway/input/seat.c17
1 files changed, 11 insertions, 6 deletions
diff --git a/sway/input/seat.c b/sway/input/seat.c
index de1a1881..dbb69ba0 100644
--- a/sway/input/seat.c
+++ b/sway/input/seat.c
@@ -46,11 +46,22 @@ static void seat_device_destroy(struct sway_seat_device *seat_device) {
46 free(seat_device); 46 free(seat_device);
47} 47}
48 48
49static void seat_node_destroy(struct sway_seat_node *seat_node) {
50 wl_list_remove(&seat_node->destroy.link);
51 wl_list_remove(&seat_node->link);
52 free(seat_node);
53}
54
49void seat_destroy(struct sway_seat *seat) { 55void seat_destroy(struct sway_seat *seat) {
50 struct sway_seat_device *seat_device, *next; 56 struct sway_seat_device *seat_device, *next;
51 wl_list_for_each_safe(seat_device, next, &seat->devices, link) { 57 wl_list_for_each_safe(seat_device, next, &seat->devices, link) {
52 seat_device_destroy(seat_device); 58 seat_device_destroy(seat_device);
53 } 59 }
60 struct sway_seat_node *seat_node, *next_seat_node;
61 wl_list_for_each_safe(seat_node, next_seat_node, &seat->focus_stack,
62 link) {
63 seat_node_destroy(seat_node);
64 }
54 sway_input_method_relay_finish(&seat->im_relay); 65 sway_input_method_relay_finish(&seat->im_relay);
55 sway_cursor_destroy(seat->cursor); 66 sway_cursor_destroy(seat->cursor);
56 wl_list_remove(&seat->new_node.link); 67 wl_list_remove(&seat->new_node.link);
@@ -68,12 +79,6 @@ void seat_destroy(struct sway_seat *seat) {
68 free(seat); 79 free(seat);
69} 80}
70 81
71static void seat_node_destroy(struct sway_seat_node *seat_node) {
72 wl_list_remove(&seat_node->destroy.link);
73 wl_list_remove(&seat_node->link);
74 free(seat_node);
75}
76
77void seat_idle_notify_activity(struct sway_seat *seat, 82void seat_idle_notify_activity(struct sway_seat *seat,
78 enum sway_input_idle_source source) { 83 enum sway_input_idle_source source) {
79 uint32_t mask = seat->idle_inhibit_sources; 84 uint32_t mask = seat->idle_inhibit_sources;