git.lucas.co / cce-compositor
Wayland compositor (wlroots)
git clone https://git.lucas.co/cce-compositor.git

commit3774468247c457e9e91549e6dc7588d43eb1f786
parentdf2e95ac41
authorIsaac Freund <[email protected]>
date2021-08-09 16:40
Xwayland: fix possible use-after-free on unmap

The view.unmap() call may synchronously destroy the view, which makes
the the code removing listeners which is currently run after
view.unmap() access free'd memory.

To fix this, simply change the order of the calls to match that of
XdgToplevel.handleUnmap().

 river/XwaylandView.zig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/river/XwaylandView.zig b/river/XwaylandView.zig
index 089aafc..b25e689 100644
--- a/river/XwaylandView.zig
+++ b/river/XwaylandView.zig
@@ -214,12 +214,12 @@ fn handleMap(listener: *wl.Listener(*wlr.XwaylandSurface), xwayland_surface: *wl
 fn handleUnmap(listener: *wl.Listener(*wlr.XwaylandSurface), xwayland_surface: *wlr.XwaylandSurface) void {
     const self = @fieldParentPtr(Self, "unmap", listener);
 
-    self.view.unmap();
-
     // Remove listeners that are only active while mapped
     self.commit.link.remove();
     self.set_title.link.remove();
     self.set_class.link.remove();
+
+    self.view.unmap();
 }
 
 fn handleRequestConfigure(