diff options
author | Andri Yngvason <andri@yngvason.is> | 2020-12-28 02:53:43 +0000 |
---|---|---|
committer | Simon Ser <contact@emersion.fr> | 2021-01-01 19:02:56 +0100 |
commit | e11bc058ac7b70921600e113d3621d224f663e17 (patch) | |
tree | bd59536823387a570f34ceb2ad0105015f1c9345 /sway | |
parent | input: Clean up input_method_relay in seat_destoy() (diff) | |
download | sway-e11bc058ac7b70921600e113d3621d224f663e17.tar.gz sway-e11bc058ac7b70921600e113d3621d224f663e17.tar.zst sway-e11bc058ac7b70921600e113d3621d224f663e17.zip |
input/seat: Clean up focus_stack in seat_destroy()
This fixes use-after-free when seat_destroy() has been called.
Diffstat (limited to 'sway')
-rw-r--r-- | sway/input/seat.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/sway/input/seat.c b/sway/input/seat.c index de1a1881..dbb69ba0 100644 --- a/sway/input/seat.c +++ b/sway/input/seat.c | |||
@@ -46,11 +46,22 @@ static void seat_device_destroy(struct sway_seat_device *seat_device) { | |||
46 | free(seat_device); | 46 | free(seat_device); |
47 | } | 47 | } |
48 | 48 | ||
49 | static void seat_node_destroy(struct sway_seat_node *seat_node) { | ||
50 | wl_list_remove(&seat_node->destroy.link); | ||
51 | wl_list_remove(&seat_node->link); | ||
52 | free(seat_node); | ||
53 | } | ||
54 | |||
49 | void seat_destroy(struct sway_seat *seat) { | 55 | void seat_destroy(struct sway_seat *seat) { |
50 | struct sway_seat_device *seat_device, *next; | 56 | struct sway_seat_device *seat_device, *next; |
51 | wl_list_for_each_safe(seat_device, next, &seat->devices, link) { | 57 | wl_list_for_each_safe(seat_device, next, &seat->devices, link) { |
52 | seat_device_destroy(seat_device); | 58 | seat_device_destroy(seat_device); |
53 | } | 59 | } |
60 | struct sway_seat_node *seat_node, *next_seat_node; | ||
61 | wl_list_for_each_safe(seat_node, next_seat_node, &seat->focus_stack, | ||
62 | link) { | ||
63 | seat_node_destroy(seat_node); | ||
64 | } | ||
54 | sway_input_method_relay_finish(&seat->im_relay); | 65 | sway_input_method_relay_finish(&seat->im_relay); |
55 | sway_cursor_destroy(seat->cursor); | 66 | sway_cursor_destroy(seat->cursor); |
56 | wl_list_remove(&seat->new_node.link); | 67 | wl_list_remove(&seat->new_node.link); |
@@ -68,12 +79,6 @@ void seat_destroy(struct sway_seat *seat) { | |||
68 | free(seat); | 79 | free(seat); |
69 | } | 80 | } |
70 | 81 | ||
71 | static void seat_node_destroy(struct sway_seat_node *seat_node) { | ||
72 | wl_list_remove(&seat_node->destroy.link); | ||
73 | wl_list_remove(&seat_node->link); | ||
74 | free(seat_node); | ||
75 | } | ||
76 | |||
77 | void seat_idle_notify_activity(struct sway_seat *seat, | 82 | void seat_idle_notify_activity(struct sway_seat *seat, |
78 | enum sway_input_idle_source source) { | 83 | enum sway_input_idle_source source) { |
79 | uint32_t mask = seat->idle_inhibit_sources; | 84 | uint32_t mask = seat->idle_inhibit_sources; |