mainnika/weston
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Partially revert "xwayland: Always free reply from xcb_get_property_reply()"

Browse Source 
This reverts commit d3553c721c.

weston_wm_write_property() takes the ownership of the reply it gets as
a parameter, and will eventually free it later in writable_callback.

This change introduced a double-free when Xwayland programs triggered a
copy to the clipboard, leading to a Weston crash.

Reviewed-By: Derek Foreman <derekf@osg.samsung.com>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
This commit is contained in:
Emmanuel Gil Peyrot
2015-07-15 22:19:04 +02:00
committed by Bryce Harrington
parent a820b4d635
commit 8c7287f5ba
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xwayland/selection.c
+6 -4
View File
@@ -117,13 +117,14 @@ weston_wm_get_incr_chunk(struct weston_wm *wm)
dump_property(wm, wm->atom.wl_selection, reply); dump_property(wm, wm->atom.wl_selection, reply);
if (xcb_get_property_value_length(reply) > 0) { if (xcb_get_property_value_length(reply) > 0) {
/* reply's ownership is transfered to wm, which is responsible
* for freeing it */
weston_wm_write_property(wm, reply); weston_wm_write_property(wm, reply);
} else { } else {
weston_log("transfer complete\n"); weston_log("transfer complete\n");
close(wm->data_source_fd); close(wm->data_source_fd);
free(reply);
} }
free(reply);
} }
struct x11_data_source { struct x11_data_source {
@@ -247,12 +248,13 @@ weston_wm_get_selection_data(struct weston_wm *wm)
return; return;
} else if (reply->type == wm->atom.incr) { } else if (reply->type == wm->atom.incr) {
wm->incr = 1; wm->incr = 1;
free(reply);
} else { } else {
wm->incr = 0; wm->incr = 0;
/* reply's ownership is transfered to wm, which is responsible
* for freeing it */
weston_wm_write_property(wm, reply); weston_wm_write_property(wm, reply);
} }
free(reply);
} }
static void static void