Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix use-after-free: fix frame callback running after destroy_output #24

Merged
merged 1 commit into from
Feb 12, 2019
Merged

Fix use-after-free: fix frame callback running after destroy_output #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion include/slurp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,8 @@ struct slurp_output {
struct wl_surface *surface;
struct zwlr_layer_surface_v1 *layer_surface;

struct wl_callback *frame_callback;
bool configured;
bool frame_scheduled;
bool dirty;
int32_t width, height;
struct pool_buffer buffers[2];
Expand Down
17 changes: 9 additions & 8 deletions main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,9 @@ static void destroy_output(struct slurp_output *output) {
wl_cursor_theme_destroy(output->cursor_theme);
zwlr_layer_surface_v1_destroy(output->layer_surface);
wl_surface_destroy(output->surface);
if (output->frame_callback) {
wl_callback_destroy(output->frame_callback);
}
wl_output_destroy(output->wl_output);
free(output);
}
Expand All @@ -237,9 +240,8 @@ static void send_frame(struct slurp_output *output) {
render(output);

// Schedule a frame in case the output becomes dirty again
struct wl_callback *callback = wl_surface_frame(output->surface);
wl_callback_add_listener(callback, &output_frame_listener, output);
output->frame_scheduled = true;
output->frame_callback = wl_surface_frame(output->surface);
wl_callback_add_listener(output->frame_callback, &output_frame_listener, output);

wl_surface_attach(output->surface, output->current_buffer->buffer, 0, 0);
wl_surface_damage(output->surface, 0, 0, output->width, output->height);
Expand All @@ -253,7 +255,7 @@ static void output_frame_handle_done(void *data, struct wl_callback *callback,
struct slurp_output *output = data;

wl_callback_destroy(callback);
output->frame_scheduled = false;
output->frame_callback = NULL;

if (output->dirty) {
send_frame(output);
Expand All @@ -266,14 +268,13 @@ static const struct wl_callback_listener output_frame_listener = {

static void set_output_dirty(struct slurp_output *output) {
output->dirty = true;
if (output->frame_scheduled) {
if (output->frame_callback) {
return;
}

struct wl_callback *callback = wl_surface_frame(output->surface);
wl_callback_add_listener(callback, &output_frame_listener, output);
output->frame_callback = wl_surface_frame(output->surface);
wl_callback_add_listener(output->frame_callback, &output_frame_listener, output);
wl_surface_commit(output->surface);
output->frame_scheduled = true;
}

static struct slurp_output *output_from_surface(struct slurp_state *state,
Expand Down