From b4e239f29fb17f298c78a7d99b47ef6919edd326 Mon Sep 17 00:00:00 2001 From: Sergi Granell Date: Wed, 27 Sep 2017 16:06:37 +0200 Subject: [PATCH] compositor-wayland: destroy the appropriate output instead of exiting when receiving an xdg_toplevel::close event v2: Fix use after free spotted by Daniel Stone Signed-off-by: Sergi Granell Reviewed-by: Pekka Paalanen --- libweston/compositor-wayland.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libweston/compositor-wayland.c b/libweston/compositor-wayland.c index 00cc4d47..e2f416a3 100644 --- a/libweston/compositor-wayland.c +++ b/libweston/compositor-wayland.c @@ -1098,8 +1098,12 @@ static void handle_xdg_toplevel_close(void *data, struct zxdg_toplevel_v6 *xdg_toplevel) { struct wayland_output *output = data; + struct weston_compositor *compositor = output->base.compositor; - weston_compositor_exit(output->base.compositor); + wayland_output_destroy(&output->base); + + if (wl_list_empty(&compositor->output_list)) + weston_compositor_exit(compositor); } static const struct zxdg_toplevel_v6_listener xdg_toplevel_listener = {