From 0cba1ce7478035fb90ca2043868f4be78ff165a1 Mon Sep 17 00:00:00 2001 From: Isaac Freund Date: Tue, 5 Jan 2021 12:51:31 +0100 Subject: [PATCH] gtk primary selection: destroy devices before manager Since device_destroy() calls wl_list_remove() on the device's link, the manager must still be valid. However if the manager is destroyed before the seat as the wl_display destroy handlers are called, devices listening for the seat to be destroyed will access free'd memory in wl_list_remove(). --- types/wlr_gtk_primary_selection.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/types/wlr_gtk_primary_selection.c b/types/wlr_gtk_primary_selection.c index 0bf4c70f..6ee877e4 100644 --- a/types/wlr_gtk_primary_selection.c +++ b/types/wlr_gtk_primary_selection.c @@ -452,6 +452,12 @@ static void primary_selection_device_manager_bind(struct wl_client *client, static void handle_display_destroy(struct wl_listener *listener, void *data) { struct wlr_gtk_primary_selection_device_manager *manager = wl_container_of(listener, manager, display_destroy); + + struct wlr_gtk_primary_selection_device *device, *tmp; + wl_list_for_each_safe(device, tmp, &manager->devices, link) { + device_destroy(device); + } + wlr_signal_emit_safe(&manager->events.destroy, manager); wl_list_remove(&manager->display_destroy.link); wl_global_destroy(manager->global);