mainnika/weston
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

compositor: fix two crashs on surface_attach() with null buffer

Browse Source 
The condition to return from surface_attach with a null buffer involves
es->output being non-null. However if a surface was just created this
field would be null and an attach of a null buffer would cause the
compositor to crash.

The other crash happened if surface_attach was called twice with a
null buffer after a valid buffer was attached to the surface. Since
es->buffer was not being set to NULL, surface_attach() would call
wl_list_remove(&es->buffer_destroy_listener.link) twice for the same
surface.

Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
This commit is contained in:
Ander Conselvan de Oliveira
2012-02-15 17:02:53 +02:00
committed by Kristian Høgsberg
parent f856fd2f93
commit b63e3e0201
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/compositor.c
+4
View File
@@ -1151,6 +1151,9 @@ surface_attach(struct wl_client *client,
struct weston_shell *shell = es->compositor->shell; struct weston_shell *shell = es->compositor->shell;
struct wl_buffer *buffer; struct wl_buffer *buffer;
if (!buffer_resource && !es->output)
return;
weston_surface_damage_below(es); weston_surface_damage_below(es);
if (es->buffer) { if (es->buffer) {
@@ -1162,6 +1165,7 @@ surface_attach(struct wl_client *client,
wl_list_remove(&es->link); wl_list_remove(&es->link);
es->visual = WESTON_NONE_VISUAL; es->visual = WESTON_NONE_VISUAL;
es->output = NULL; es->output = NULL;
es->buffer = NULL;
return; return;
} }