Nulo/river
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

river-status: fix output status destruction

Browse source 
There was a use-after-free if the Output was destroyed first, and the
memory of the output status was leaked.
This commit is contained in:
Isaac Freund 2021-08-12 22:38:08 +02:00
parent d4c249a5cb
commit 6e51a8fcdd
No known key found for this signature in database
GPG key ID: 86DED400DDFD7A11
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
river/OutputStatus.zig
View file

@ -43,6 +43,13 @@ pub fn init(self: *Self, output: *Output, output_status: *zriver.OutputStatusV1)
self.sendFocusedTags(output.current.tags); self.sendFocusedTags(output.current.tags);
} }
pub fn destroy(self: *Self) void {
const node = @fieldParentPtr(std.SinglyLinkedList(Self).Node, "data", self);
self.output.status_trackers.remove(node);
self.output_status.setHandler(*Self, handleRequest, null, self);
util.gpa.destroy(node);
}
fn handleRequest(output_status: *zriver.OutputStatusV1, request: zriver.OutputStatusV1.Request, self: *Self) void { fn handleRequest(output_status: *zriver.OutputStatusV1, request: zriver.OutputStatusV1.Request, self: *Self) void {
switch (request) { switch (request) {
.destroy => output_status.destroy(), .destroy => output_status.destroy(),
@ -50,8 +57,7 @@ fn handleRequest(output_status: *zriver.OutputStatusV1, request: zriver.OutputSt
} }
fn handleDestroy(output_status: *zriver.OutputStatusV1, self: *Self) void { fn handleDestroy(output_status: *zriver.OutputStatusV1, self: *Self) void {
const node = @fieldParentPtr(std.SinglyLinkedList(Self).Node, "data", self); self.destroy();
self.output.status_trackers.remove(node);
} }
/// Send the current tags of each view on the output to the client. /// Send the current tags of each view on the output to the client.

2
river/Root.zig
View file

@ -203,6 +203,8 @@ pub fn removeOutput(self: *Self, output: *Output) void {
// Destroy all layouts of the output // Destroy all layouts of the output
while (output.layouts.first) |layout_node| layout_node.data.destroy(); while (output.layouts.first) |layout_node| layout_node.data.destroy();
while (output.status_trackers.first) |status_node| status_node.data.destroy();
// Arrange the root in case evacuated views affect the layout // Arrange the root in case evacuated views affect the layout
fallback_output.arrangeViews(); fallback_output.arrangeViews();
self.startTransaction(); self.startTransaction();