From 6668c822b3bf58ca5af5d370ef03b075be3e4d27 Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Thu, 1 Jun 2023 17:36:28 +0200 Subject: [PATCH] cursor: unset wlr_output_cursor.texture on surface destroy When the surface is destroyed, its current wlr_texture is about to get destroyed as well. Reset wlr_output_cursor.texture to prevent use-after-free. Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/issues/3652 --- types/wlr_cursor.c | 1 + 1 file changed, 1 insertion(+) diff --git a/types/wlr_cursor.c b/types/wlr_cursor.c index 867e7d90..fdb40a72 100644 --- a/types/wlr_cursor.c +++ b/types/wlr_cursor.c @@ -424,6 +424,7 @@ static void output_cursor_output_handle_surface_destroy( struct wlr_cursor_output_cursor *output_cursor = wl_container_of(listener, output_cursor, surface_destroy); assert(output_cursor->surface != NULL); + wlr_output_cursor_set_buffer(output_cursor->output_cursor, NULL, 0, 0); cursor_output_cursor_reset_image(output_cursor); }