mirror of
https://gitlab.freedesktop.org/wayland/weston
synced 2024-07-22 03:04:13 +00:00
![]() Similar to how we do it with drm_fb ref counts, increase a reference count and return the same object. Plug-in in desktop-shell when we map up the view in order to survive a weston_surface destruction. Astute readers will notice that this patch removes weston_view_destroy() while keeping the balance between removing and adding a weston_surface_unref() call in desktop_shell_destroy_surface(). The reason is to let weston_surface_unref() handle destruction on its own. If multiple references are taken, then weston_surface_unref() doesn't destroy the view, it just decreases the reference, with a latter call to weston_surface_unref() to determine if the view should be destroyed as well. This situation happens if we have close animation enabled, were we have more than one reference taken: one when mapping the view/surface and when when the surface itself was created, (what we call, a weak reference). If only a single reference is taken (for instance if we don't have close animations enabled) then this weston_surface_unref() call is inert as that reference is not set-up, leaving libweston to handle the view destruction. Following that with a weston_view_destroy() explicit call would cause a UAF as the view was previous destroyed by a weston_surface_unref() call. A side-effect of not keeping the weston_view_destroy() call would happen when tearing down the compositor. If close animations are enabled, weston_surface_unref() would not destroy the view, and because weston_view_destroy() no longer exists, we would still have the view in the other layers by the time we check-up if layers have views present. Signed-off-by: Marius Vlad <marius.vlad@collabora.com> |
||
---|---|---|
.. | ||
backend-drm | ||
backend-headless | ||
backend-rdp | ||
backend-wayland | ||
backend-x11 | ||
color-lcms | ||
renderer-gl | ||
animation.c | ||
backend.h | ||
bindings.c | ||
clipboard.c | ||
color-noop.c | ||
color.c | ||
color.h | ||
compositor.c | ||
content-protection.c | ||
data-device.c | ||
dbus.c | ||
dbus.h | ||
drm-formats.c | ||
git-version.h.meson | ||
input.c | ||
launcher-impl.h | ||
launcher-libseat.c | ||
launcher-logind.c | ||
launcher-util.c | ||
launcher-util.h | ||
libinput-device.c | ||
libinput-device.h | ||
libinput-seat.c | ||
libinput-seat.h | ||
libweston-internal.h | ||
linux-dmabuf.c | ||
linux-dmabuf.h | ||
linux-explicit-synchronization.c | ||
linux-explicit-synchronization.h | ||
linux-sync-file-uapi.h | ||
linux-sync-file.c | ||
linux-sync-file.h | ||
log.c | ||
meson.build | ||
noop-renderer.c | ||
pixel-formats.c | ||
pixel-formats.h | ||
pixman-renderer.c | ||
pixman-renderer.h | ||
plugin-registry.c | ||
screenshooter.c | ||
spring-tool.c | ||
timeline.c | ||
timeline.h | ||
touch-calibration.c | ||
vertex-clipping.c | ||
vertex-clipping.h | ||
weston-direct-display.c | ||
weston-log-file.c | ||
weston-log-flight-rec.c | ||
weston-log-internal.h | ||
weston-log-wayland.c | ||
weston-log.c |