wlr_scene: Fix potential use-after-free in wlr_scene_buffer_set_buffer

Fixes: #3636
This commit is contained in:
Alexander Orzechowski 2023-04-16 14:01:54 +02:00
parent 39be67df46
commit eac2eaa6a9

View file

@ -602,7 +602,6 @@ void wlr_scene_buffer_set_buffer_with_damage(struct wlr_scene_buffer *scene_buff
assert(buffer || !damage);
bool update = false;
wlr_buffer_unlock(scene_buffer->buffer);
wlr_texture_destroy(scene_buffer->texture);
scene_buffer->texture = NULL;
@ -616,8 +615,10 @@ void wlr_scene_buffer_set_buffer_with_damage(struct wlr_scene_buffer *scene_buff
(scene_buffer->buffer->width != buffer->width ||
scene_buffer->buffer->height != buffer->height));
wlr_buffer_unlock(scene_buffer->buffer);
scene_buffer->buffer = wlr_buffer_lock(buffer);
} else {
wlr_buffer_unlock(scene_buffer->buffer);
update = true;
scene_buffer->buffer = NULL;
}