Miroirs/libliftoff
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/emersion/libliftoff.git synced 2024-12-26 21:59:18 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Unset plane->layer and layer->plane on destroy

Browse source 
This fixes a use-after-free when destroying a layer/plane early.
This commit is contained in:
Simon Ser 2019-12-06 15:06:14 +01:00
parent 333e454e98
commit 99ef3d5b2e
No known key found for this signature in database
GPG key ID: 0FDE7BE0E88F5E48
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
layer.c
View file

@ -20,6 +20,9 @@ struct liftoff_layer *liftoff_layer_create(struct liftoff_output *output)
void liftoff_layer_destroy(struct liftoff_layer *layer)
{
layer->output->layers_changed = true;
if (layer->plane != NULL) {
layer->plane->layer = NULL;
}
if (layer->output->composition_layer == layer) {
layer->output->composition_layer = NULL;
}

3
plane.c
View file

@ -130,6 +130,9 @@ struct liftoff_plane *plane_create(struct liftoff_device *device, uint32_t id)
void plane_destroy(struct liftoff_plane *plane)
{
if (plane->layer != NULL) {
plane->layer->plane = NULL;
}
liftoff_list_remove(&plane->link);
free(plane->props);
free(plane);