diff options
| author | Peter Harris <pharris@opentext.com> | 2018-02-22 18:07:38 -0500 |
|---|---|---|
| committer | Adam Jackson <ajax@redhat.com> | 2018-02-23 12:12:15 -0500 |
| commit | efd84bff238f8e12bf652525990d36baada8785b (patch) | |
| tree | 79dba23e54d605a669cf4f05cd45e9edfeb6b457 /composite | |
| parent | ac13d740bf14ba8799d4dfbee1f6f99a297dbc7e (diff) | |
composite: Fix use-after-free in compReparentWindow
If an implicitly redirected window is unredirected by the reparent
operation, cw will be a stale pointer.
Signed-off-by: Peter Harris <pharris@opentext.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Diffstat (limited to 'composite')
| -rw-r--r-- | composite/compwindow.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/composite/compwindow.c b/composite/compwindow.c index e74ce661a..54b4e6ac4 100644 --- a/composite/compwindow.c +++ b/composite/compwindow.c @@ -432,7 +432,7 @@ compReparentWindow(WindowPtr pWin, WindowPtr pPriorParent) { ScreenPtr pScreen = pWin->drawable.pScreen; CompScreenPtr cs = GetCompScreen(pScreen); - CompWindowPtr cw = GetCompWindow(pWin); + CompWindowPtr cw; pScreen->ReparentWindow = cs->ReparentWindow; /* @@ -471,6 +471,7 @@ compReparentWindow(WindowPtr pWin, WindowPtr pPriorParent) cs->ReparentWindow = pScreen->ReparentWindow; pScreen->ReparentWindow = compReparentWindow; + cw = GetCompWindow(pWin); if (pWin->damagedDescendants || (cw && cw->damaged)) compMarkAncestors(pWin); |