From 8a610ffe414e815dc6453b47d6f46e0195462d00 Mon Sep 17 00:00:00 2001 From: Marius Vlad Date: Fri, 15 Jul 2022 11:23:26 +0300 Subject: [PATCH] compositor/text-backend: Avoid a potential UAF The text_input_manager might be destroyed upon a compositor shutdown, so verify if it's still set-up before attemping to use it to avoid a UAF. Signed-off-by: Marius Vlad --- compositor/text-backend.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/compositor/text-backend.c b/compositor/text-backend.c index 94955bff..9e787650 100644 --- a/compositor/text-backend.c +++ b/compositor/text-backend.c @@ -141,6 +141,12 @@ deactivate_input_method(struct input_method *input_method) input_method->input = NULL; input_method->context = NULL; + /* text_input_manager::destroy_listener by compositor shutdown */ + if (!text_input->manager) { + zwp_text_input_v1_send_leave(text_input->resource); + return; + } + if (wl_list_empty(&text_input->input_methods) && text_input->input_panel_visible && text_input->manager->current_text_input == text_input) { @@ -456,6 +462,8 @@ text_input_manager_notifier_destroy(struct wl_listener *listener, void *data) wl_list_remove(&text_input_manager->destroy_listener.link); wl_global_destroy(text_input_manager->text_input_manager_global); + if (text_input_manager->current_text_input) + text_input_manager->current_text_input->manager = NULL; free(text_input_manager); }