hyprwm
/
wlroots-hyprland
mirror of https://github.com/hyprwm/wlroots-hyprland.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

wlr_drm_lease_v1: Fix use-after-free in backend_destroy() 

valgrind said (on exit from labwc):

    Invalid write of size 8
       at 0x487DEAF: wl_list_remove (wayland-util.c:56)
       by 0x487DF80: wl_signal_emit_mutable (wayland-server.c:2182)
       by 0x48CD6B7: backend_destroy.part.0.lto_priv.0 (backend.c:41)
       by 0x48DC19D: multi_backend_destroy (backend.c:58)
       by 0x4880286: UnknownInlinedFun (wayland-server.c:2315)
       by 0x4880286: wl_display_destroy (wayland-server.c:1170)
       by 0x112491: UnknownInlinedFun (server.c:485)
       by 0x112491: main (main.c:110)
     Address 0x1f9d0210 is 112 bytes inside a block of size 136 free'd
       at 0x484426F: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
       by 0x487DF6D: wl_signal_emit_mutable (wayland-server.c:2179)
       by 0x48CD6B7: backend_destroy.part.0.lto_priv.0 (backend.c:41)
       by 0x48DC19D: multi_backend_destroy (backend.c:58)
       by 0x4880286: UnknownInlinedFun (wayland-server.c:2315)
       by 0x4880286: wl_display_destroy (wayland-server.c:1170)
       by 0x112491: UnknownInlinedFun (server.c:485)
       by 0x112491: main (main.c:110)
     Block was alloc'd at
       at 0x4846A73: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
       by 0x4918D4E: drm_lease_device_v1_create (wlr_drm_lease_v1.c:639)
       by 0x48D3B00: wlr_multi_for_each_backend (backend.c:249)
       by 0x49191D2: wlr_drm_lease_v1_manager_create (wlr_drm_lease_v1.c:706)
       by 0x111EE9: UnknownInlinedFun (server.c:384)
       by 0x111EE9: main (main.c:92)
This commit is contained in:
John Lindgren 2022-09-15 21:20:27 -04:00
parent 7d9c595f19
commit 1facdeabe5
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
types/wlr_drm_lease_v1.c
View File

@ -126,6 +126,7 @@ static void drm_lease_device_v1_destroy(
}
wl_list_remove(&device->link);
wl_list_remove(&device->backend_destroy.link);
wlr_global_destroy_safe(device->global);
free(device);