Skip to content

Commit

Permalink
backend/drm: fix segfault in init_drm_surface
Browse files Browse the repository at this point in the history
When surf->gbm was previously set, we destroy it without setting it to
NULL. Later on, we only create the GBM surface if surf->gbm is NULL.
This result in a use-after-free when we start using surf->gbm.

Closes: swaywm#1868
Closes: swaywm#1874
Closes: swaywm/sway#4785
Closes: swaywm/sway#4717
Closes: swaywm/sway#4730
Fixes: 2bdd1d0 ("backend/drm: use modifiers for our GBM buffers")
  • Loading branch information
emersion authored and aiqs4 committed Dec 19, 2019
1 parent 7a5d8e8 commit c46b427
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions backend/drm/renderer.c
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ bool init_drm_surface(struct wlr_drm_surface *surf,
surf->back = NULL;
}
gbm_surface_destroy(surf->gbm);
surf->gbm = NULL;
}
wlr_egl_destroy_surface(&surf->renderer->egl, surf->egl);

Expand Down

0 comments on commit c46b427

Please sign in to comment.