jachym/dwl
1
0
Fork 0
mirror of https://codeberg.org/dwl/dwl.git synced 2026-11-11 15:43:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

don't return a freed client for a surface whose toplevel is gone

Browse Source 
A client can destroy its xdg_toplevel and keep the xdg_surface. wlroots
keeps the role but sets toplevel to NULL, and xdg_surface->data still
points to the Client freed by destroynotify(), so e.g. a popup created on
that surface made toplevel_from_wlr_surface() read freed memory.
This commit is contained in:
dvh
2026-11-11 10:54:13 +01:00
parent 0b053233c2
commit 1f5b30aeb3
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client.h
+2
View File
@@ -98,6 +98,8 @@ toplevel_from_wlr_surface(struct wlr_surface *s, Client **pc, LayerSurface **pl)
xdg_surface = tmp_xdg_surface; xdg_surface = tmp_xdg_surface;
break; break;
case WLR_XDG_SURFACE_ROLE_TOPLEVEL: case WLR_XDG_SURFACE_ROLE_TOPLEVEL:
if (!xdg_surface->toplevel)
return -1;
c = xdg_surface->data; c = xdg_surface->data;
type = c->type; type = c->type;
goto end; goto end;