diff options
| author | Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> | 2015-07-15 22:19:04 +0200 |
|---|---|---|
| committer | Bryce Harrington <bryce@osg.samsung.com> | 2015-07-15 13:55:58 -0700 |
| commit | 8c7287f5ba67d2a3116c7ec1c9c012b8f34a4423 (patch) | |
| tree | 11acadf7cfaa2f6df6c1d319de330bb96c122e27 /xwayland | |
| parent | a820b4d635854fb1bf21bc7a25d13a0599ce15ce (diff) | |
| download | weston-8c7287f5ba67d2a3116c7ec1c9c012b8f34a4423.tar.gz weston-8c7287f5ba67d2a3116c7ec1c9c012b8f34a4423.tar.bz2 weston-8c7287f5ba67d2a3116c7ec1c9c012b8f34a4423.zip | |
Partially revert "xwayland: Always free reply from xcb_get_property_reply()"
This reverts commit d3553c721c0fed07f85b70fea418ca65ed974fbb.
weston_wm_write_property() takes the ownership of the reply it gets as
a parameter, and will eventually free it later in writable_callback.
This change introduced a double-free when Xwayland programs triggered a
copy to the clipboard, leading to a Weston crash.
Reviewed-By: Derek Foreman <derekf@osg.samsung.com>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
Diffstat (limited to 'xwayland')
| -rw-r--r-- | xwayland/selection.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/xwayland/selection.c b/xwayland/selection.c index 452cd69d..25ec8482 100644 --- a/xwayland/selection.c +++ b/xwayland/selection.c @@ -117,13 +117,14 @@ weston_wm_get_incr_chunk(struct weston_wm *wm) dump_property(wm, wm->atom.wl_selection, reply); if (xcb_get_property_value_length(reply) > 0) { + /* reply's ownership is transfered to wm, which is responsible + * for freeing it */ weston_wm_write_property(wm, reply); } else { weston_log("transfer complete\n"); close(wm->data_source_fd); + free(reply); } - - free(reply); } struct x11_data_source { @@ -247,12 +248,13 @@ weston_wm_get_selection_data(struct weston_wm *wm) return; } else if (reply->type == wm->atom.incr) { wm->incr = 1; + free(reply); } else { wm->incr = 0; + /* reply's ownership is transfered to wm, which is responsible + * for freeing it */ weston_wm_write_property(wm, reply); } - - free(reply); } static void |