Fix use-after-free when destroying an offer

This commit is contained in:
emersion 2017-12-30 09:26:48 +01:00
parent b20aed66d6
commit 720c1154dc
No known key found for this signature in database
GPG key ID: 0FDE7BE0E88F5E48
2 changed files with 3 additions and 5 deletions

View file

@ -173,6 +173,8 @@ static void data_offer_resource_destroy(struct wl_resource *resource) {
goto out;
}
offer->source->offer = NULL;
// If the drag destination has version < 3, wl_data_offer.finish
// won't be called, so do this here as a safety net, because
// we still want the version >= 3 drag source to be happy.
@ -183,7 +185,6 @@ static void data_offer_resource_destroy(struct wl_resource *resource) {
offer->source->cancel(offer->source);
}
offer->source->offer = NULL;
out:
free(offer);
}

View file

@ -44,11 +44,8 @@ static void offer_resource_handle_destroy(struct wl_resource *resource) {
goto out;
}
if (offer->source->cancel) {
offer->source->cancel(offer->source);
}
offer->source->offer = NULL;
out:
free(offer);
}