diff options
| author | Marius Vlad <marius.vlad@collabora.com> | 2022-11-04 13:26:40 +0200 |
|---|---|---|
| committer | Marius Vlad <marius.vlad@collabora.com> | 2022-11-21 13:55:20 +0200 |
| commit | ac059500986c021520f92ee1026ea556bce611f3 (patch) | |
| tree | 13fbd9c70f44379d2b881a4578e9ed0e84f1eca2 | |
| parent | 097ed472920e01e2a4776e13c1e755265d8ec1f7 (diff) | |
| download | weston-ac059500986c021520f92ee1026ea556bce611f3.tar.gz | |
ivi-shell: Move out weston_desktop_shell at the end
To avoid the following UAF:
Invalid read of size 8
at 0x4AE5EFF: weston_desktop_get_display (libweston-desktop.c:110)
by 0x4AEB2C9: weston_desktop_xdg_surface_schedule_configure (xdg-shell.c:1160)
by 0x4AEA77A: weston_desktop_xdg_toplevel_set_size (xdg-shell.c:711)
by 0x4AE839D: weston_desktop_surface_set_size (surface.c:504)
by 0x63F7D43: ivi_layout_surface_set_size (ivi-layout.c:1599)
by 0x63F949F: transition_move_resize_view_destroy (ivi-layout-transition.c:311)
by 0x63F9397: layout_transition_destroy (ivi-layout-transition.c:259)
by 0x63F8E0B: ivi_layout_remove_all_surface_transitions (ivi-layout-transition.c:121)
by 0x63F4BC1: ivi_layout_surface_destroy (ivi-layout.c:258)
by 0x63F38AF: layout_surface_cleanup (ivi-shell.c:162)
by 0x63F3D2D: shell_destroy (ivi-shell.c:359)
by 0x4AF059A: weston_signal_emit_mutable (signal.c:62)
Address 0x174202d0 is 0 bytes inside a block of size 152 free'd
at 0x484617B: free (vg_replace_malloc.c:872)
by 0x4AE5EDC: weston_desktop_destroy (libweston-desktop.c:97)
by 0x63F3CF2: shell_destroy (ivi-shell.c:355)
by 0x4AF059A: weston_signal_emit_mutable (signal.c:62)
by 0x4ACBC2C: weston_compositor_destroy (compositor.c:8629)
by 0x4864A4B: wet_main (main.c:3908)
by 0x10915D: main (executable.c:33)
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
(cherry picked from commit eb755cd81aad6f958629475a0429272aef3147b0)
| -rw-r--r-- | ivi-shell/ivi-shell.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ivi-shell/ivi-shell.c b/ivi-shell/ivi-shell.c index 0c80c006..79ff2191 100644 --- a/ivi-shell/ivi-shell.c +++ b/ivi-shell/ivi-shell.c @@ -346,7 +346,6 @@ shell_destroy(struct wl_listener *listener, void *data) wl_list_remove(&shell->destroy_listener.link); wl_list_remove(&shell->wake_listener.link); - weston_desktop_destroy(shell->desktop); wl_list_for_each_safe(ivisurf, next, &shell->ivi_surface_list, link) { if (ivisurf->layout_surface != NULL) @@ -357,6 +356,7 @@ shell_destroy(struct wl_listener *listener, void *data) ivi_layout_fini(); + weston_desktop_destroy(shell->desktop); free(shell); } |