From bf926e31a0bda9f621eb25ffe77046d171e48b13 Mon Sep 17 00:00:00 2001 From: Isaac Freund Date: Tue, 5 Jan 2021 12:46:48 +0100 Subject: [PATCH] primary selection: destroy devices before manager Since device_destroy() calls wl_list_remove() on the device's link, the manager must still be valid. However if the manager is destroyed before the seat as the wl_display destroy handlers are called, devices listening for the seat to be destroyed will access free'd memory in wl_list_remove(). --- types/wlr_primary_selection_v1.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/types/wlr_primary_selection_v1.c b/types/wlr_primary_selection_v1.c index e5f2d01c..009b0955 100644 --- a/types/wlr_primary_selection_v1.c +++ b/types/wlr_primary_selection_v1.c @@ -452,6 +452,12 @@ static void primary_selection_device_manager_bind(struct wl_client *client, static void handle_display_destroy(struct wl_listener *listener, void *data) { struct wlr_primary_selection_v1_device_manager *manager = wl_container_of(listener, manager, display_destroy); + + struct wlr_primary_selection_v1_device *device, *tmp; + wl_list_for_each_safe(device, tmp, &manager->devices, link) { + device_destroy(device); + } + wlr_signal_emit_safe(&manager->events.destroy, manager); wl_list_remove(&manager->display_destroy.link); wl_global_destroy(manager->global);