desktop-shell: drop shell_client from the head of the surface list on destroy

This prevents a use after free when the surfaces are automatically cleaned
up later, as shell_client's freed node was still in the surface list.

Signed-off-by: Derek Foreman <derekf@osg.samsung.com>
Acked-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
dev
Derek Foreman 10 years ago committed by Daniel Stone
parent f965db5fc1
commit e42d754843
  1. 7
      desktop-shell/shell.c

@ -5841,6 +5841,13 @@ handle_shell_client_destroy(struct wl_listener *listener, void *data)
if (sc->ping_timer)
wl_event_source_remove(sc->ping_timer);
/* Since we're about to free shell_client, we remove it from the
* head of the surface list so we don't use that freed list node
* during surface clean up later on.
*/
wl_list_remove(&sc->surface_list);
free(sc);
}

Loading…
Cancel
Save