diff options
| author | John Brooks <john.brooks@crimson.no> | 2020-04-30 08:47:40 -0700 |
|---|---|---|
| committer | John Brooks <john.brooks@crimson.no> | 2020-05-07 03:22:41 -0700 |
| commit | 7038e1681863c8a59c6c6a758fc7ec41f29f2be7 (patch) | |
| tree | 1bf93e6ccdcc8f98ce792e97cfcab51d6f679e15 | |
| parent | ec68d74498e9103b11e86df394cc8d79c156adbc (diff) | |
Fix use-after-free on xdg pong
With the xdg shell, ping is not related to a particular surface.
WaylandCompositor associates the pong with its original WindowSurface
with a map of the serial number to WindowSurface.
If the WindowSurface is destroyed before pong arrives, the map will have
an invalid pointer leading to a compositor crash.
Change-Id: Ide32ac80d42bf8373e8180e12ab89b29e6d00341
Reviewed-by: Robert Griebl <robert.griebl@qt.io>
| -rw-r--r-- | src/window-lib/waylandcompositor.cpp | 2 | ||||
| -rw-r--r-- | src/window-lib/waylandcompositor.h | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/src/window-lib/waylandcompositor.cpp b/src/window-lib/waylandcompositor.cpp index 9a20154c..0f87f45d 100644 --- a/src/window-lib/waylandcompositor.cpp +++ b/src/window-lib/waylandcompositor.cpp @@ -180,7 +180,7 @@ void WaylandCompositor::xdgPing(WindowSurface* surface) void WaylandCompositor::onXdgPongReceived(uint serial) { - WindowSurface *surface = m_xdgPingMap.take(serial); + auto surface = m_xdgPingMap.take(serial); if (surface) { emit surface->pong(); } diff --git a/src/window-lib/waylandcompositor.h b/src/window-lib/waylandcompositor.h index 968457c2..fb6ca1a1 100644 --- a/src/window-lib/waylandcompositor.h +++ b/src/window-lib/waylandcompositor.h @@ -53,6 +53,7 @@ #include <QWaylandQuickItem> #include <QMap> +#include <QPointer> QT_FORWARD_DECLARE_CLASS(QWaylandResource) QT_FORWARD_DECLARE_CLASS(QWaylandWlShell) @@ -156,7 +157,7 @@ protected: QVector<QWaylandOutput *> m_outputs; WaylandQtAMServerExtension *m_amExtension; QWaylandTextInputManager *m_textInputManager; - QMap<uint, WindowSurface*> m_xdgPingMap; + QMap<uint, QPointer<WindowSurface>> m_xdgPingMap; }; QT_END_NAMESPACE_AM |