From 99ef23b62c49572d2654a6ff7d913530bd97579e Mon Sep 17 00:00:00 2001
From: Tadeo Kondrak <me@tadeo.ca>
Date: Sun, 7 Feb 2021 21:42:52 -0700
Subject: [PATCH] xdg-foreign: Make imported object inert when exported is
 destroyed

Fixes a double-free experienced with Firefox and
xdg-desktop-portal-gtk.
---
 types/wlr_xdg_foreign_v1.c | 3 ++-
 types/wlr_xdg_foreign_v2.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/types/wlr_xdg_foreign_v1.c b/types/wlr_xdg_foreign_v1.c
index 2ed125af..cd07b6f5 100644
--- a/types/wlr_xdg_foreign_v1.c
+++ b/types/wlr_xdg_foreign_v1.c
@@ -159,6 +159,7 @@ static void finish_imported(struct wlr_xdg_imported_v1 *imported) {
 
 	wl_list_remove(&imported->link);
 	wl_list_init(&imported->link);
+	wl_resource_set_user_data(imported->resource, NULL);
 	free(imported);
 }
 
@@ -167,6 +168,7 @@ static void finish_exported(struct wlr_xdg_exported_v1 *exported) {
 
 	wl_list_remove(&exported->xdg_surface_destroy.link);
 	wl_list_remove(&exported->link);
+	wl_resource_set_user_data(exported->resource, NULL);
 	free(exported);
 }
 
@@ -185,7 +187,6 @@ static void handle_xdg_surface_destroy(
 	struct wlr_xdg_exported_v1 *exported =
 		wl_container_of(listener, exported, xdg_surface_destroy);
 
-	wl_resource_set_user_data(exported->resource, NULL);
 	finish_exported(exported);
 }
 
diff --git a/types/wlr_xdg_foreign_v2.c b/types/wlr_xdg_foreign_v2.c
index e1b078c1..3ef74a94 100644
--- a/types/wlr_xdg_foreign_v2.c
+++ b/types/wlr_xdg_foreign_v2.c
@@ -159,6 +159,7 @@ static void finish_imported(struct wlr_xdg_imported_v2 *imported) {
 
 	wl_list_remove(&imported->link);
 	wl_list_init(&imported->link);
+	wl_resource_set_user_data(imported->resource, NULL);
 	free(imported);
 }
 
@@ -167,6 +168,7 @@ static void finish_exported(struct wlr_xdg_exported_v2 *exported) {
 
 	wl_list_remove(&exported->xdg_surface_destroy.link);
 	wl_list_remove(&exported->link);
+	wl_resource_set_user_data(exported->resource, NULL);
 	free(exported);
 }
 
@@ -185,7 +187,6 @@ static void handle_xdg_surface_destroy(
 	struct wlr_xdg_exported_v2 *exported =
 		wl_container_of(listener, exported, xdg_surface_destroy);
 
-	wl_resource_set_user_data(exported->resource, NULL);
 	finish_exported(exported);
 }