Merge pull request #1106 from martinetd/seat-destroy-uaf

wlr_seat destroy: fix use-after-free after primary selection source cancel
7 years ago · 55dba13c6e
parent 07209d062c 9ddc2f39d0
commit 55dba13c6e
1 changed files with 1 additions and 1 deletions
--- a/types/seat/wlr_seat.c
+++ b/types/seat/wlr_seat.c
@ -168,9 +168,9 @@ void wlr_seat_destroy(struct wlr_seat *seat) {
 		seat->selection_source = NULL;
 	}
 	if (seat->primary_selection_source) {
+		wl_list_remove(&seat->primary_selection_source_destroy.link);
 		seat->primary_selection_source->cancel(seat->primary_selection_source);
 		seat->primary_selection_source = NULL;
-		wl_list_remove(&seat->primary_selection_source_destroy.link);
 	}

 	struct wlr_seat_client *client, *tmp;