Wayland compositor (wlroots)
git clone https://git.lucas.co/cce-compositor.git
Xwayland: fix possible use-after-free on unmap
The view.unmap() call may synchronously destroy the view, which makes
the the code removing listeners which is currently run after
view.unmap() access free'd memory.
To fix this, simply change the order of the calls to match that of
XdgToplevel.handleUnmap().
river/XwaylandView.zig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/river/XwaylandView.zig b/river/XwaylandView.zig
index 089aafc..b25e689 100644
--- a/river/XwaylandView.zig
+++ b/river/XwaylandView.zig
@@ -214,12 +214,12 @@ fn handleMap(listener: *wl.Listener(*wlr.XwaylandSurface), xwayland_surface: *wl
fn handleUnmap(listener: *wl.Listener(*wlr.XwaylandSurface), xwayland_surface: *wlr.XwaylandSurface) void {
const self = @fieldParentPtr(Self, "unmap", listener);
- self.view.unmap();
-
// Remove listeners that are only active while mapped
self.commit.link.remove();
self.set_title.link.remove();
self.set_class.link.remove();
+
+ self.view.unmap();
}
fn handleRequestConfigure(