From 30226eb1fbf2da0f1d6ff6e0c230541e95dfb46b Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Wed, 5 Aug 2020 18:00:29 +0200 Subject: [PATCH] gamma-control-v1: fix use-after-free in gamma_control_handle_set_gamma gamma_control_send_failed destroys gamma_control. --- types/wlr_gamma_control_v1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/types/wlr_gamma_control_v1.c b/types/wlr_gamma_control_v1.c index 48356ee1..f96c84aa 100644 --- a/types/wlr_gamma_control_v1.c +++ b/types/wlr_gamma_control_v1.c @@ -107,8 +107,8 @@ static void gamma_control_handle_set_gamma(struct wl_client *client, wlr_output_set_gamma(gamma_control->output, ramp_size, r, g, b); if (!wlr_output_test(gamma_control->output)) { - gamma_control_send_failed(gamma_control); wlr_output_rollback(gamma_control->output); + gamma_control_send_failed(gamma_control); goto error_table; } free(table);