diff options
author | Andri Yngvason <andri@yngvason.is> | 2020-12-28 21:36:12 +0000 |
---|---|---|
committer | Simon Ser <contact@emersion.fr> | 2021-01-01 19:02:56 +0100 |
commit | 9ef5cc03f1e452d2328fb126eb7a25d4f01be1dd (patch) | |
tree | 392e7d3d11761e62bd82bd66da898e56160f345f /sway | |
parent | input/seat: Clean up focus_stack in seat_destroy() (diff) | |
download | sway-9ef5cc03f1e452d2328fb126eb7a25d4f01be1dd.tar.gz sway-9ef5cc03f1e452d2328fb126eb7a25d4f01be1dd.tar.zst sway-9ef5cc03f1e452d2328fb126eb7a25d4f01be1dd.zip |
input/seat: Reset command handler context in seat_destroy()
This fixes a dangling reference which causes a use-after-free.
Diffstat (limited to 'sway')
-rw-r--r-- | sway/input/seat.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sway/input/seat.c b/sway/input/seat.c index dbb69ba0..1f5865ee 100644 --- a/sway/input/seat.c +++ b/sway/input/seat.c | |||
@@ -15,6 +15,7 @@ | |||
15 | #include "config.h" | 15 | #include "config.h" |
16 | #include "list.h" | 16 | #include "list.h" |
17 | #include "log.h" | 17 | #include "log.h" |
18 | #include "sway/config.h" | ||
18 | #include "sway/desktop.h" | 19 | #include "sway/desktop.h" |
19 | #include "sway/input/cursor.h" | 20 | #include "sway/input/cursor.h" |
20 | #include "sway/input/input-manager.h" | 21 | #include "sway/input/input-manager.h" |
@@ -53,6 +54,9 @@ static void seat_node_destroy(struct sway_seat_node *seat_node) { | |||
53 | } | 54 | } |
54 | 55 | ||
55 | void seat_destroy(struct sway_seat *seat) { | 56 | void seat_destroy(struct sway_seat *seat) { |
57 | if (seat == config->handler_context.seat) { | ||
58 | config->handler_context.seat = input_manager_get_default_seat(); | ||
59 | } | ||
56 | struct sway_seat_device *seat_device, *next; | 60 | struct sway_seat_device *seat_device, *next; |
57 | wl_list_for_each_safe(seat_device, next, &seat->devices, link) { | 61 | wl_list_for_each_safe(seat_device, next, &seat->devices, link) { |
58 | seat_device_destroy(seat_device); | 62 | seat_device_destroy(seat_device); |