mainnika/weston
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

compositor/text-backend: Avoid a potential UAF

Browse Source 
The text_input_manager might be destroyed upon a compositor shutdown, so
verify if it's still set-up before attemping to use it to avoid a UAF.

Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
This commit is contained in:
Marius Vlad
2022-07-15 11:23:26 +03:00
parent 5ffa1962a5
commit 8a610ffe41
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compositor/text-backend.c
+8
View File
@@ -141,6 +141,12 @@ deactivate_input_method(struct input_method *input_method)
input_method->input = NULL; input_method->input = NULL;
input_method->context = NULL; input_method->context = NULL;
/* text_input_manager::destroy_listener by compositor shutdown */
if (!text_input->manager) {
zwp_text_input_v1_send_leave(text_input->resource);
return;
}
if (wl_list_empty(&text_input->input_methods) && if (wl_list_empty(&text_input->input_methods) &&
text_input->input_panel_visible && text_input->input_panel_visible &&
text_input->manager->current_text_input == text_input) { text_input->manager->current_text_input == text_input) {
@@ -456,6 +462,8 @@ text_input_manager_notifier_destroy(struct wl_listener *listener, void *data)
wl_list_remove(&text_input_manager->destroy_listener.link); wl_list_remove(&text_input_manager->destroy_listener.link);
wl_global_destroy(text_input_manager->text_input_manager_global); wl_global_destroy(text_input_manager->text_input_manager_global);
if (text_input_manager->current_text_input)
text_input_manager->current_text_input->manager = NULL;
free(text_input_manager); free(text_input_manager);
} }