fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-26 15:50:05 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

xwayland: Remove pending stream reference when freeing

Browse source 
The EGLStream backend keeps a queue of pending streams for each Xwayland
window.

However, when this pending queue is freed, the corresponding private
data may not be cleared (typically if the pixmap for this window has
changed before the compositor finished attaching the consumer for the
window's pixmap's original eglstream), leading to a use-after-free and a
crash when trying to use that data as the window pixmap.

Make sure to clear the private data when the pending stream is freed.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1055
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Tested-by: Karol Szuster <karolsz9898@gmail.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit a5f439dcd2)
This commit is contained in:
Olivier Fourdan 2020-09-14 15:39:10 +02:00 • committed by Olivier Fourdan
parent 1ac389dda8
commit 1930ed233f
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
hw/xwayland/xwayland-glamor-eglstream.c
View file

@ -431,8 +431,8 @@ xwl_eglstream_consumer_ready_callback(void *data,
DebugF("eglstream: win %d completes eglstream for pixmap %p, congrats!\n",
pending->window->drawable.id, pending->pixmap);
xwl_eglstream_window_set_pending(pending->window, NULL);
out:
xwl_eglstream_window_set_pending(pending->window, NULL);
xorg_list_del(&pending->link);
free(pending);
}