yukijoou/kwin
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix use-after-free when the user hovers over an auto-hide plasma panel in wayland...

Browse source 
Edge::handle calls showOnScreenEdge, which (on wayland) eventually calls internalShow, which eventually calls ScreenEdges::reserve, which destroys the same edge.
When showScreenOnEdge returns, 'this' has been freed.
Using a singleshot timer allows Edge::handle to return before the Edge is destroyed.
This commit is contained in:
Andreas Haratzis 2020-06-24 22:29:53 -07:00 committed by David Edmundson
parent 2e93829259
commit 71dfd60284
1 changed files with 10 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
xdgshellclient.cpp
View file

@ -715,11 +715,16 @@ void XdgToplevelClient::showOnScreenEdge()
if (!m_plasmaShellSurface) { if (!m_plasmaShellSurface) {
return; return;
} }
hideClient(false);
workspace()->raiseClient(this); // ShowOnScreenEdge can be called by an Edge, and hideClient could destroy the Edge
if (m_plasmaShellSurface->panelBehavior() == PlasmaShellSurfaceInterface::PanelBehavior::AutoHide) { // Use the singleshot to avoid use-after-free
m_plasmaShellSurface->showAutoHidingPanel(); QTimer::singleShot(0, [this](){
} hideClient(false);
workspace()->raiseClient(this);
if (m_plasmaShellSurface->panelBehavior() == PlasmaShellSurfaceInterface::PanelBehavior::AutoHide) {
m_plasmaShellSurface->showAutoHidingPanel();
}
});
} }
void XdgToplevelClient::closeWindow() void XdgToplevelClient::closeWindow()