From 935b6d871e8e384c52c1c0077def06bd767d4361 Mon Sep 17 00:00:00 2001
From: Markus Ongyerth <ongy@ongy.net>
Date: Fri, 8 Sep 2017 16:02:26 +0200
Subject: [PATCH] fixes use after free caused by signal lists

A structs throughout the code use implementation specific free
functions.
When those functions are not used, they simply call free() on their
data, but this leaves around wl_signals linked into listeners.
When those listeners try to remove themself from the list, they write
into the now free memory.

This commit adds calls to remove the signals from those lists, so the
listeners can safely call wl_list_remove
---
 types/wlr_input_device.c | 3 ++-
 types/wlr_keyboard.c     | 1 +
 types/wlr_pointer.c      | 4 ++++
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/types/wlr_input_device.c b/types/wlr_input_device.c
index 002c2b54d..7015dcba8 100644
--- a/types/wlr_input_device.c
+++ b/types/wlr_input_device.c
@@ -30,7 +30,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) {
 	}
 
 	wl_signal_emit(&dev->events.destroy, dev);
-	
+
 	if (dev->_device) {
 		switch (dev->type) {
 		case WLR_INPUT_DEVICE_KEYBOARD:
@@ -58,6 +58,7 @@ void wlr_input_device_destroy(struct wlr_input_device *dev) {
 	if (dev->impl && dev->impl->destroy) {
 		dev->impl->destroy(dev);
 	} else {
+		wl_list_remove(&dev->events.destroy.listener_list);
 		free(dev);
 	}
 }
diff --git a/types/wlr_keyboard.c b/types/wlr_keyboard.c
index 02b3842da..f20d2a737 100644
--- a/types/wlr_keyboard.c
+++ b/types/wlr_keyboard.c
@@ -14,6 +14,7 @@ void wlr_keyboard_destroy(struct wlr_keyboard *kb) {
 	if (kb && kb->impl && kb->impl->destroy) {
 		kb->impl->destroy(kb);
 	} else {
+		wl_list_remove(&kb->events.key.listener_list);
 		free(kb);
 	}
 }
diff --git a/types/wlr_pointer.c b/types/wlr_pointer.c
index 74856762f..04100e560 100644
--- a/types/wlr_pointer.c
+++ b/types/wlr_pointer.c
@@ -17,6 +17,10 @@ void wlr_pointer_destroy(struct wlr_pointer *pointer) {
 	if (pointer && pointer->impl && pointer->impl->destroy) {
 		pointer->impl->destroy(pointer);
 	} else {
+		wl_list_remove(&pointer->events.motion.listener_list);
+		wl_list_remove(&pointer->events.motion_absolute.listener_list);
+		wl_list_remove(&pointer->events.button.listener_list);
+		wl_list_remove(&pointer->events.axis.listener_list);
 		free(pointer);
 	}
 }