Skip to content
This repository has been archived by the owner on Nov 1, 2021. It is now read-only.

Commit

Permalink
backend/drm: fix segfault in init_drm_surface
Browse files Browse the repository at this point in the history
When surf->gbm was previously set, we destroy it without setting it to
NULL. Later on, we only create the GBM surface if surf->gbm is NULL.
This result in a use-after-free when we start using surf->gbm.

Closes: #1868
Closes: #1874
Closes: swaywm/sway#4785
Closes: swaywm/sway#4717
Closes: swaywm/sway#4730
Fixes: 2bdd1d0 ("backend/drm: use modifiers for our GBM buffers")
  • Loading branch information
emersion authored and ddevault committed Dec 5, 2019
1 parent 8681e4a commit 6ca8208
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions backend/drm/renderer.c
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ bool init_drm_surface(struct wlr_drm_surface *surf,
surf->back = NULL;
}
gbm_surface_destroy(surf->gbm);
surf->gbm = NULL;
}
wlr_egl_destroy_surface(&surf->renderer->egl, surf->egl);

Expand Down

0 comments on commit 6ca8208

Please sign in to comment.