nordic-dev.net/wlroots
2
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2024-11-21 22:52:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix possible crash in server-decoration when surface destroyed

Browse Source 
If the underlying surface is destroyed, but the client has not yet
destroyed the server decoration object, and then tries to call
request_mode() on it, the compositor will crash, because the
wlr_server_decoration struct has been freed, and the wl_resource's
user_data member has been NULLed out.

Yes, this is certainly an error for the client to do that, but I
shouldn't be able to write a buggy (or malicious) Wayland app that can
take down the entire compositor.
This commit is contained in:
Brian J. Tarricone 2023-09-27 23:54:51 -07:00
parent 1a731596c5
commit eacb4cf6d2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
types/wlr_server_decoration.c
View File

@ -24,7 +24,7 @@ static void server_decoration_handle_request_mode(struct wl_client *client,
struct wl_resource *resource, uint32_t mode) {
struct wlr_server_decoration *decoration =
decoration_from_resource(resource);
if (decoration->mode == mode) {
if (decoration == NULL || decoration->mode == mode) {
return;
}
decoration->mode = mode;