From 433c325fb2a1d90b36206925fc429e354e248c99 Mon Sep 17 00:00:00 2001 From: Guido Cella Date: Tue, 15 Sep 2026 23:29:30 +0200 Subject: [PATCH] fix a use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prevent a use-after-free when closing a nested dwl with Ctrl+c. It happened because cleanup() → input_method_relay_finish() frees input_method_relay, and then closemon() → focusclient() → input_method_relay_set_focus() uses relay->surface. --- dwl.c | 1 + ime.h | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/dwl.c b/dwl.c index 63996a2..a2418d0 100644 --- a/dwl.c +++ b/dwl.c @@ -792,6 +792,7 @@ cleanup(void) destroykeyboardgroup(&kb_group->destroy, NULL); input_method_relay_finish(input_method_relay); + input_method_relay = NULL; /* If it's not destroyed manually, it will cause a use-after-free of wlr_seat. * Destroy it until it's fixed on the wlroots side */ diff --git a/ime.h b/ime.h index f537a2d..b9591f5 100644 --- a/ime.h +++ b/ime.h @@ -625,7 +625,7 @@ void input_method_relay_set_focus(struct input_method_relay *relay, struct wlr_surface *surface) { - if (relay->focused_surface == surface) + if (!relay || relay->focused_surface == surface) return; if (relay->focused_surface)