wayland-egl: Fix use after free
authorDerek Foreman <derekf@osg.samsung.com>
Mon, 4 Apr 2016 18:08:55 +0000 (13:08 -0500)
committerMike Blumenkrantz <zmike@osg.samsung.com>
Mon, 4 Apr 2016 18:11:28 +0000 (14:11 -0400)
eng_window_use() uses outbuf->redirect, so the clever code in
eng_outbuf_reconfigure that avoided setting it to NULL to check
if we needed to recreate the redirect was not very clever at all.

src/modules/evas/engines/wayland_egl/evas_wl_main.c

index 00c0f90..532e749 100644 (file)
@@ -317,17 +317,22 @@ eng_window_resurf(Outbuf *gw)
 void 
 eng_outbuf_reconfigure(Outbuf *ob, int w, int h, int rot, Outbuf_Depth depth EINA_UNUSED)
 {
+   Eina_Bool redirected;
+
    if (!ob->model) ob->model = wobbly_create(0, 0, w, h);
    wobbly_resize(ob->model, w, h);
+
+   redirected = !!ob->redirect;
    if (ob->redirect)
      glsym_evas_gl_common_context_unredirect(ob->redirect);
+   ob->redirect = NULL;
 
    ob->w = w;
    ob->h = h;
    ob->rot = rot;
    eng_window_use(ob);
    glsym_evas_gl_common_context_resize(ob->gl_context, w, h, rot);
-   if (ob->redirect)
+   if (redirected)
      ob->redirect = glsym_evas_gl_common_context_redirect(ob->gl_context);
 
    if (ob->win)