mirrors
/
weston
mirror of https://gitlab.freedesktop.org/wayland/weston.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ivi-shell: Move out weston_desktop_shell at the end 

To avoid the following UAF:

Invalid read of size 8
   at 0x4AE5EFF: weston_desktop_get_display (libweston-desktop.c:110)
   by 0x4AEB2C9: weston_desktop_xdg_surface_schedule_configure (xdg-shell.c:1160)
   by 0x4AEA77A: weston_desktop_xdg_toplevel_set_size (xdg-shell.c:711)
   by 0x4AE839D: weston_desktop_surface_set_size (surface.c:504)
   by 0x63F7D43: ivi_layout_surface_set_size (ivi-layout.c:1599)
   by 0x63F949F: transition_move_resize_view_destroy (ivi-layout-transition.c:311)
   by 0x63F9397: layout_transition_destroy (ivi-layout-transition.c:259)
   by 0x63F8E0B: ivi_layout_remove_all_surface_transitions (ivi-layout-transition.c:121)
   by 0x63F4BC1: ivi_layout_surface_destroy (ivi-layout.c:258)
   by 0x63F38AF: layout_surface_cleanup (ivi-shell.c:162)
   by 0x63F3D2D: shell_destroy (ivi-shell.c:359)
   by 0x4AF059A: weston_signal_emit_mutable (signal.c:62)
 Address 0x174202d0 is 0 bytes inside a block of size 152 free'd
   at 0x484617B: free (vg_replace_malloc.c:872)
   by 0x4AE5EDC: weston_desktop_destroy (libweston-desktop.c:97)
   by 0x63F3CF2: shell_destroy (ivi-shell.c:355)
   by 0x4AF059A: weston_signal_emit_mutable (signal.c:62)
   by 0x4ACBC2C: weston_compositor_destroy (compositor.c:8629)
   by 0x4864A4B: wet_main (main.c:3908)
   by 0x10915D: main (executable.c:33)

Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
This commit is contained in:
Marius Vlad 2022-11-04 13:26:40 +02:00
parent cfbf2b0ab2
commit eb755cd81a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ivi-shell/ivi-shell.c
View File

@ -352,7 +352,6 @@ shell_destroy(struct wl_listener *listener, void *data)
wl_list_remove(&shell->destroy_listener.link);
wl_list_remove(&shell->wake_listener.link);
weston_desktop_destroy(shell->desktop);
wl_list_for_each_safe(ivisurf, next, &shell->ivi_surface_list, link) {
if (ivisurf->layout_surface != NULL)
@ -363,6 +362,7 @@ shell_destroy(struct wl_listener *listener, void *data)
ivi_layout_fini();
weston_desktop_destroy(shell->desktop);
free(shell);
}