alex/swayfx
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Fix use after free in transaction code

Browse source 
If we set an instruction as ready twice, it decreases the transaction's
num_waiting a second time and applies the transaction earlier than it
should. This no doubt has undesired effects, probably resulting in a use
after free.

Hopefully fixes the first part of #2207.
This commit is contained in:
Ryan Dwyer 2018-07-04 22:58:17 +10:00
parent f414885b1d
commit 50b401677b
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sway/desktop/transaction.c
View file

@ -377,9 +377,11 @@ static void set_instructions_ready(struct sway_view *view, int index) {
for (int i = 0; i <= index; ++i) { for (int i = 0; i <= index; ++i) {
struct sway_transaction_instruction *instruction = struct sway_transaction_instruction *instruction =
view->swayc->instructions->items[i]; view->swayc->instructions->items[i];
if (!instruction->ready) {
set_instruction_ready(instruction); set_instruction_ready(instruction);
} }
} }
}
void transaction_notify_view_ready(struct sway_view *view, uint32_t serial) { void transaction_notify_view_ready(struct sway_view *view, uint32_t serial) {
for (int i = 0; i < view->swayc->instructions->length; ++i) { for (int i = 0; i < view->swayc->instructions->length; ++i) {