cursor: Unset cursor image when there is not available xcursor theme

This fixes a crash in the case where the last cursor was a client surface
cursor but then transitioned into a server managed xcursor that isn't
available. Because the logic would return early before, we would continue
to reference a texture pointer belonging to a client surface but would
otherwise disassociate with it (we wouldn't clear the cursor if the surface
is destroyed) resulting an an eventual UAF.

Let's just make the cursor invisible if we don't know what to show. It's
compositor policy if they want to show a default.

Co-authored-by: Scott Moreau <oreaus@gmail.com>
Fixes: #3686
This commit is contained in:
Alexander Orzechowski 2023-09-17 01:27:43 -04:00
parent 9816b59b0e
commit 00dcc68e16
1 changed files with 6 additions and 1 deletions

View File

@ -550,7 +550,12 @@ static void cursor_output_cursor_update(struct wlr_cursor_output_cursor *output_
float scale = output_cursor->output_cursor->output->scale;
wlr_xcursor_manager_load(manager, scale);
struct wlr_xcursor *xcursor = wlr_xcursor_manager_get_xcursor(manager, name, scale);
if (xcursor == NULL || output_cursor->xcursor == xcursor) {
if (xcursor == NULL) {
wlr_output_cursor_set_buffer(output_cursor->output_cursor, NULL, 0, 0);
return;
}
if (output_cursor->xcursor == xcursor) {
return;
}