Fix use after free in transactions

In set_instructions_ready, calling set_instruction_ready may cause any
number of transactions to get applied, which removes them from the list
being iterated.  The iteration variables need to be adjusted
accordingly.

1 files changed, 6 insertions, 0 deletions

diff --git a/sway/desktop/transaction.c b/sway/desktop/transaction.c
index ee7a0704..0a24c4fc 100644
--- a/sway/desktop/transaction.c
+++ b/sway/desktop/transaction.c
@@ -364,7 +364,13 @@ static void set_instructions_ready(struct sway_view *view, int index) {
                 struct sway_transaction_instruction *instruction =
                         view->swayc->instructions->items[i];
                 if (!instruction->ready) {
+                        // set_instruction_ready can remove instructions from the list we're
+                        // iterating
+                        size_t length = view->swayc->instructions->length;
                         set_instruction_ready(instruction);
+                        size_t num_removed = length - view->swayc->instructions->length;
+                        i -= num_removed;
+                        index -= num_removed;
                 }
         }
 }