brl/mutter
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

backends/x11: Fix use after free on device removal

Browse Source 
The devices_by_id hash table is responsible for managing the reference
to the devices. In remove_device however, for non-core devices there are
additional calls to dispose/unref, after the last reference has
already been dropped by the hash table.

https://gitlab.gnome.org/GNOME/mutter/merge_requests/1032
This commit is contained in:
Sebastian Keller 2020-02-01 02:28:12 +01:00 committed by Robert Mader
parent ffad55c66f
commit 81de2c2913
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/backends/x11/meta-seat-x11.c
View File

@ -698,12 +698,11 @@ remove_device (MetaSeatX11 *seat_x11,
{
seat_x11->devices = g_list_remove (seat_x11->devices, device);
g_signal_emit_by_name (seat_x11, "device-removed", device);
g_hash_table_remove (seat_x11->devices_by_id,
GINT_TO_POINTER (device_id));
}
g_object_run_dispose (G_OBJECT (device));
g_object_unref (device);
g_hash_table_remove (seat_x11->devices_by_id,
GINT_TO_POINTER (device_id));
}
}