jachym/dwl
1
0
Fork 0
mirror of https://codeberg.org/dwl/dwl.git synced 2026-09-19 13:52:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix a use-after-free

Browse Source 
Prevent a use-after-free when closing a nested dwl with Ctrl+c.

It happened because cleanup() → input_method_relay_finish() frees
input_method_relay, and then closemon() → focusclient() →
input_method_relay_set_focus() uses relay->surface.
This commit is contained in:
Guido Cella
2026-09-15 23:29:50 +02:00
parent 6013835337
commit 433c325fb2
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dwl.c
+1
View File
@@ -792,6 +792,7 @@ cleanup(void)
destroykeyboardgroup(&kb_group->destroy, NULL); destroykeyboardgroup(&kb_group->destroy, NULL);
input_method_relay_finish(input_method_relay); input_method_relay_finish(input_method_relay);
input_method_relay = NULL;
/* If it's not destroyed manually, it will cause a use-after-free of wlr_seat. /* If it's not destroyed manually, it will cause a use-after-free of wlr_seat.
* Destroy it until it's fixed on the wlroots side */ * Destroy it until it's fixed on the wlroots side */
ime.h
+1 -1
View File
@@ -625,7 +625,7 @@ void
input_method_relay_set_focus(struct input_method_relay *relay, input_method_relay_set_focus(struct input_method_relay *relay,
struct wlr_surface *surface) struct wlr_surface *surface)
{ {
if (relay->focused_surface == surface) if (!relay || relay->focused_surface == surface)
return; return;
if (relay->focused_surface) if (relay->focused_surface)