norohind/kmscon
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

wlt: toolkit: fix use after free of dp_fd

Browse Source 
We need to keep dp_fd alive for all calls to wl_display_*(). Otherwise,
the callback will use it and access invalid memory.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
This commit is contained in:
David Herrmann 2012-09-27 11:34:15 +02:00
parent e5855f8b61
commit de2536f4e4
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wlt_toolkit.c
View File

@ -896,9 +896,9 @@ void wlt_display_unref(struct wlt_display *disp)
unload_cursors(disp);
wl_display_remove_global_listener(disp->dp, disp->dp_listener);
ev_eloop_rm_fd(disp->dp_fd);
wl_display_flush(disp->dp);
wl_display_disconnect(disp->dp);
ev_eloop_rm_fd(disp->dp_fd);
xkb_context_unref(disp->xkb_ctx);
shl_hook_free(disp->listeners);
ev_eloop_unref(disp->eloop);