|
 |
776610 |
From f41e9517ffd362505ca91c21387e6457e7c53a2d Mon Sep 17 00:00:00 2001
|
|
|
776610 |
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
|
776610 |
Date: Mon, 19 Nov 2018 11:25:57 +0100
|
|
|
776610 |
Subject: [PATCH 02/12] clutter: Keep a device reference with events
|
|
|
776610 |
|
|
|
776610 |
If a device (virtual or real) is removed while there are remaining
|
|
|
776610 |
events queued for that device, the event loop may try to access the
|
|
|
776610 |
event freed memory.
|
|
|
776610 |
|
|
|
776610 |
To avoid the issue, add a reference to the device when the event is
|
|
|
776610 |
created or copied, and remove the reference once the device is freed.
|
|
|
776610 |
|
|
|
776610 |
Closes: https://gitlab.gnome.org/GNOME/mutter/issues/393
|
|
|
776610 |
---
|
|
|
776610 |
clutter/clutter/clutter-event.c | 16 ++++++++++++----
|
|
|
776610 |
1 file changed, 12 insertions(+), 4 deletions(-)
|
|
|
776610 |
|
|
|
776610 |
diff --git a/clutter/clutter/clutter-event.c b/clutter/clutter/clutter-event.c
|
|
|
776610 |
index 10b6c00..1b21b6a 100644
|
|
|
776610 |
--- a/clutter/clutter/clutter-event.c
|
|
|
776610 |
+++ b/clutter/clutter/clutter-event.c
|
|
|
776610 |
@@ -1095,7 +1095,7 @@ clutter_event_set_device (ClutterEvent *event,
|
|
|
776610 |
{
|
|
|
776610 |
ClutterEventPrivate *real_event = (ClutterEventPrivate *) event;
|
|
|
776610 |
|
|
|
776610 |
- real_event->device = device;
|
|
|
776610 |
+ g_set_object (&real_event->device, device);
|
|
|
776610 |
}
|
|
|
776610 |
|
|
|
776610 |
switch (event->type)
|
|
|
776610 |
@@ -1364,8 +1364,8 @@ clutter_event_copy (const ClutterEvent *event)
|
|
|
776610 |
{
|
|
|
776610 |
ClutterEventPrivate *real_event = (ClutterEventPrivate *) event;
|
|
|
776610 |
|
|
|
776610 |
- new_real_event->device = real_event->device;
|
|
|
776610 |
- new_real_event->source_device = real_event->source_device;
|
|
|
776610 |
+ g_set_object (&new_real_event->device, real_event->device);
|
|
|
776610 |
+ g_set_object (&new_real_event->source_device, real_event->source_device);
|
|
|
776610 |
new_real_event->delta_x = real_event->delta_x;
|
|
|
776610 |
new_real_event->delta_y = real_event->delta_y;
|
|
|
776610 |
new_real_event->is_pointer_emulated = real_event->is_pointer_emulated;
|
|
|
776610 |
@@ -1435,6 +1435,14 @@ clutter_event_free (ClutterEvent *event)
|
|
|
776610 |
{
|
|
|
776610 |
_clutter_backend_free_event_data (clutter_get_default_backend (), event);
|
|
|
776610 |
|
|
|
776610 |
+ if (is_event_allocated (event))
|
|
|
776610 |
+ {
|
|
|
776610 |
+ ClutterEventPrivate *real_event = (ClutterEventPrivate *) event;
|
|
|
776610 |
+
|
|
|
776610 |
+ g_clear_object (&real_event->device);
|
|
|
776610 |
+ g_clear_object (&real_event->source_device);
|
|
|
776610 |
+ }
|
|
|
776610 |
+
|
|
|
776610 |
switch (event->type)
|
|
|
776610 |
{
|
|
|
776610 |
case CLUTTER_BUTTON_PRESS:
|
|
|
776610 |
@@ -1689,7 +1697,7 @@ clutter_event_set_source_device (ClutterEvent *event,
|
|
|
776610 |
return;
|
|
|
776610 |
|
|
|
776610 |
real_event = (ClutterEventPrivate *) event;
|
|
|
776610 |
- real_event->source_device = device;
|
|
|
776610 |
+ g_set_object (&real_event->source_device, device);
|
|
|
776610 |
}
|
|
|
776610 |
|
|
|
776610 |
/**
|
|
|
776610 |
--
|
|
|
776610 |
2.19.2
|
|
|
776610 |
|