From 844b166c1bed117ef654de3f9ad68eebad67f6be Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Wed, 1 Nov 2017 20:59:28 +0100 Subject: [PATCH 1/2] multi_backend_destroy: fix trivial use-after-free --- backend/multi/backend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/multi/backend.c b/backend/multi/backend.c index a7ee648c..c35303e0 100644 --- a/backend/multi/backend.c +++ b/backend/multi/backend.c @@ -30,8 +30,8 @@ static bool multi_backend_start(struct wlr_backend *_backend) { static void multi_backend_destroy(struct wlr_backend *_backend) { struct wlr_multi_backend *backend = (struct wlr_multi_backend *)_backend; - struct subbackend_state *sub; - wl_list_for_each(sub, &backend->backends, link) { + struct subbackend_state *sub, *next; + wl_list_for_each_safe(sub, next, &backend->backends, link) { wlr_backend_destroy(sub->backend); free(sub); } From b53db8c39e33c340214827097e26ccacbbcb5c08 Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Wed, 1 Nov 2017 21:08:59 +0100 Subject: [PATCH 2/2] libinput backend destroy: fix small leak --- backend/libinput/backend.c | 1 + 1 file changed, 1 insertion(+) diff --git a/backend/libinput/backend.c b/backend/libinput/backend.c index 07c6da13..45b4e368 100644 --- a/backend/libinput/backend.c +++ b/backend/libinput/backend.c @@ -105,6 +105,7 @@ static void wlr_libinput_backend_destroy(struct wlr_backend *_backend) { wl_signal_emit(&backend->backend.events.input_remove, wlr_dev); wlr_input_device_destroy(wlr_dev); } + free(wlr_devices); } wlr_list_free(backend->wlr_device_lists); wl_event_source_remove(backend->input_event);