Skip to content
  • Olivier Fourdan's avatar
    xwayland: Fix use after free of cursors · 59ad0e6a
    Olivier Fourdan authored
    Sometimes, Xwayland will try to use a cursor that has just been freed,
    leading to a crash when trying to access that cursor data either in
    miPointerUpdateSprite() or AnimCurTimerNotify().
    
    CheckMotion() updates the pointer's cursor based on which xwindow
    XYToWindow() returns, and Xwayland implements its own xwl_xy_to_window()
    to fake a crossing to the root window when the pointer has left the
    Wayland surface but is still within the xwindow.
    
    But after an xwindow is unrealized, the last xwindow used to match the
    xwindows is cleared so two consecutive calls to xwl_xy_to_window() may
    not return the same xwindow.
    
    To avoid this issue, update the last_xwindow based on enter and leave
    notifications instead of xwl_xy_to_window(), and check if the xwindow
    found by the regular miXYToWindow() is a child of the known last
    xwindow, so that multiple consecutive calls to xwl_xy_to_window()
    return the same xwindow, being either the one found by miXYToWindow()
    or the root window.
    
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1385258
    
    
    Signed-off-by: default avatarOlivier Fourdan <ofourdan@redhat.com>
    Tested-by: default avatarVít Ondruch <vondruch@redhat.com>
    Tested-by: default avatarSatish Balay <balay@fastmail.fm>
    Reviewed-by: default avatarJonas Ådahl <jadahl@gmail.com>
    59ad0e6a