Skip to content
  • Martin Weber's avatar
    hw/xfree86: Avoid cursor use after free · c726ceac
    Martin Weber authored and Matt Turner's avatar Matt Turner committed
    
    
    During a VT-Switch a raw pointer to the shared cursor object
    is saved which is then freed (in case of low refcount) by a call to
    xf86CursorSetCursor with argument pCurs = NullCursor.
    This leads to a dangling pointer which can follow in a use after free.
    
    This fix ensures that there is a shared handle saved for the VT-Switch cycle.
    
    Reviewed-by: default avatarMichel Dänzer <mdaenzer@redhat.com>
    (cherry picked from commit 7ae221ad)
    c726ceac