clients: ungrab the correct input when menus close

We need to input_ungrab() on the stored input, not the one that caused
the release - otherwise bad things can happen in multi-seat environments
when a seat that didn't open the menu closes it.

To reproduce:
 configure two seats
 launch weston terminal
 open the right click pop up
 select a menu item from the other seat

The next click from the seat that opened the menu will cause a segfault.

Signed-off-by: Derek Foreman <derekf@osg.samsung.com>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>

diff --git a/clients/window.c b/clients/window.c
index 0e73f5bd5309e8aee63661d80214a6ab9bae7539..47a79aa64a7bb5942a74b20992c91a0350e89b6e 100644 (file)
--- a/clients/window.c
+++ b/clients/window.c
@@ -4738,7 +4738,7 @@ menu_button_handler(struct widget *widget,
                /* Either relase after press-drag-release or
                 * click-motion-click. */
                menu->func(menu->user_data, input, menu->current);
-               input_ungrab(input);
+               input_ungrab(menu->input);
                menu_destroy(menu);
        } else if (state == WL_POINTER_BUTTON_STATE_RELEASED) {
                menu->release_count++;