e_blur_video_capture: Fix crash of use after free 22/324122/2
authorChangyeon Lee <cyeon.lee@samsung.com>
Tue, 13 May 2025 06:48:04 +0000 (15:48 +0900)
committerTizen Window System <tizen.windowsystem@gmail.com>
Tue, 13 May 2025 07:19:51 +0000 (07:19 +0000)
Change-Id: I26dfee2b25aeecf1a1af058c75019a467154f443

src/bin/compmgr/e_blur_video_capture.c

index 55f0ec4085cb39f9d76224cfaf7512bce43e0e9e..3057106ed0823eb72be8f3a8a50fee8109769295 100644 (file)
@@ -211,9 +211,17 @@ static void
 _e_blur_video_capture_object_destroy(E_Blur_Video_Capture_Object *object)
 {
    E_Blur_Video_Capture_Client *client = object->client;
+   E_View *view;
 
    ELOGF("E_BLUR", "Destroy Video_Capture_Object:%p", client->ec, object);
 
+   view = e_view_image_view_get(object->blur_img);
+   e_view_event_listener_del(view, E_VIEW_SHOW, &object->listener.show);
+   e_view_event_listener_del(view, E_VIEW_HIDE, &object->listener.hide);
+   e_view_event_listener_del(view, E_VIEW_MOVE, &object->listener.move);
+   e_view_event_listener_del(view, E_VIEW_DESTROY, &object->listener.destroy);
+   wl_list_remove(&object->listener.resize.link);
+
    e_view_destroy(e_view_image_view_get(object->src_img));
    e_view_destroy(e_view_rect_view_get(object->src_clip_rect));
    e_view_destroy(e_view_image_view_get(object->blur_clip_img));
@@ -977,18 +985,7 @@ _e_blur_video_capture_client_cb_ec_free(void *data, void *obj)
      e_hwc_presentation_callback_del(client->presentation_callback);
 
    EINA_LIST_FOREACH_SAFE(client->capture_objs, l, ll, object)
-     {
-        if (object->blur_img)
-          {
-             E_View *view = e_view_image_view_get(object->blur_img);
-             e_view_event_listener_del(view, E_VIEW_SHOW, &object->listener.show);
-             e_view_event_listener_del(view, E_VIEW_HIDE, &object->listener.hide);
-             e_view_event_listener_del(view, E_VIEW_MOVE, &object->listener.move);
-             e_view_event_listener_del(view, E_VIEW_DESTROY, &object->listener.destroy);
-             wl_list_remove(&object->listener.resize.link);
-          }
-        _e_blur_video_capture_object_destroy(object);
-     }
+     _e_blur_video_capture_object_destroy(object);
 
    client->ec_delfn = NULL;