e_pixmap: Remove 'deleted' hash table, and renamed e_pixmap_del() to e_pixmap_win_id_...

fix the problem that could use freed pointer as a key of hash table.

Change-Id: I967ee40e5dad5d29c7e607b25866d2055ef73202

diff --git a/src/bin/e_comp_wl.c b/src/bin/e_comp_wl.c
index 3b0dfbf75e0fdf5c94016dc7b3c4cd89b2194a63..72e3b0de27bd12ab494e3dfa353b1c8f420a2b63 100644 (file)
--- a/src/bin/e_comp_wl.c
+++ b/src/bin/e_comp_wl.c
@@ -2977,7 +2977,7 @@ _e_comp_wl_surface_destroy(struct wl_resource *resource)
 
    ec->comp_data->surface = NULL;
    ec->comp_data->wl_surface = NULL;
-   e_pixmap_del(ec->pixmap);
+   e_pixmap_win_id_del(ec->pixmap);
 
    _e_comp_wl_surface_render_stop(ec);
    e_object_del(E_OBJECT(ec));
@@ -3024,7 +3024,7 @@ _e_comp_wl_compositor_cb_surface_create(struct wl_client *client, struct wl_reso
         if ((ep = e_pixmap_find(E_PIXMAP_TYPE_WL, (uintptr_t)res)))
           {
              ERR("There is e_pixmap already, Delete old e_pixmap %p", ep);
-             e_pixmap_del(ep);
+             e_pixmap_win_id_del(ep);
              ep = NULL;
           }
      }
@@ -4378,7 +4378,7 @@ _e_comp_wl_client_usable_get(pid_t pid, E_Pixmap *ep)
              oldep = e_client_pixmap_change(ec, ep);
              if (oldep)
                {
-                  e_pixmap_del(oldep);
+                  e_pixmap_win_id_del(oldep);
                   e_pixmap_free(oldep);
                }
 

diff --git a/src/bin/e_pixmap.c b/src/bin/e_pixmap.c
index 33ff1ea7ec42ad3a16d6c9a8eb19f81ebc097675..f3dcf03a70dff15dac095a43ca95b07658e71619 100644 (file)
--- a/src/bin/e_pixmap.c
+++ b/src/bin/e_pixmap.c
@@ -11,7 +11,6 @@
 #include <uuid.h>
 
 static Eina_Hash *pixmaps[E_PIXMAP_TYPE_MAX] = {NULL};
-static Eina_Hash *deleted[E_PIXMAP_TYPE_MAX] = {NULL};
 static Eina_Hash *res_ids = NULL;
 static uint32_t res_id = 0;
 static Eina_Hash *aliases[E_PIXMAP_TYPE_MAX] = {NULL};
@@ -269,37 +268,25 @@ e_pixmap_free(E_Pixmap *cp)
 
    _e_pixmap_hook_call(E_PIXMAP_HOOK_DEL, cp);
    e_pixmap_image_clear(cp, EINA_FALSE);
-   eina_hash_del_by_key(pixmaps[cp->type], &cp->win);
    eina_hash_del_by_key(res_ids, &cp->res_id);
 
-   if (e_pixmap_is_del(cp))
-     eina_hash_del_by_key(deleted[cp->type], &cp->win);
-   else
-     _e_pixmap_free(cp);
+   if (cp->win)
+     eina_hash_del_by_key(pixmaps[cp->type], &cp->win);
+
+   _e_pixmap_free(cp);
 
    return 0;
 }
 
 E_API void
-e_pixmap_del(E_Pixmap *cp)
+e_pixmap_win_id_del(E_Pixmap *cp)
 {
    if (!cp) return;
    if (cp->type == E_PIXMAP_TYPE_X) return;
+   if (!cp->win) return;
 
-   if (eina_hash_find(pixmaps[cp->type], &cp->win))
-     {
-        eina_hash_del_by_key(pixmaps[cp->type], &cp->win);
-        eina_hash_add(deleted[cp->type], &cp->win, cp);
-     }
-}
-
-E_API Eina_Bool
-e_pixmap_is_del(E_Pixmap *cp)
-{
-   if (!cp) return 0;
-   if (cp->type == E_PIXMAP_TYPE_X) return 0;
-
-   return !!eina_hash_find(deleted[cp->type], &cp->win);
+   eina_hash_del_by_key(pixmaps[cp->type], &cp->win);
+   cp->win = 0;
 }
 
 E_API E_Pixmap *
@@ -339,10 +326,7 @@ e_pixmap_new(E_Pixmap_Type type, ...)
           }
      }
    else
-     {
-        pixmaps[type] = eina_hash_pointer_new(NULL);
-        deleted[type] = eina_hash_pointer_new((Eina_Free_Cb)_e_pixmap_free);
-     }
+     pixmaps[type] = eina_hash_pointer_new(NULL);
 
    cp = _e_pixmap_new(type);
    if (!cp)

diff --git a/src/bin/e_pixmap.h b/src/bin/e_pixmap.h
index 194686a332bacc10ff437e9ccd6aaafb38f3094b..65d88be3c521bf3227776fe8a0dcc20a140cfde0 100644 (file)
--- a/src/bin/e_pixmap.h
+++ b/src/bin/e_pixmap.h
@@ -38,7 +38,7 @@ struct _E_Pixmap_Hook
 };
 
 E_API int e_pixmap_free(E_Pixmap *cp);
-E_API void e_pixmap_del(E_Pixmap *cp);
+E_API void e_pixmap_win_id_del(E_Pixmap *cp);
 E_API Eina_Bool e_pixmap_is_del(E_Pixmap *cp);
 E_API E_Pixmap *e_pixmap_ref(E_Pixmap *cp);
 E_API E_Pixmap *e_pixmap_new(E_Pixmap_Type type, ...);

diff --git a/src/bin/e_policy_wl.c b/src/bin/e_policy_wl.c
index 62bd1d75e5bd258591b2d1c441314e68bda0e7a0..04bb2f650c697fe3e246ea662517641a50b014ce 100644 (file)
--- a/src/bin/e_policy_wl.c
+++ b/src/bin/e_policy_wl.c
@@ -557,7 +557,7 @@ _e_policy_wl_tzsh_srv_del(E_Policy_Wl_Tzsh_Srv *tzsh_srv)
 
         if (ec && ec->internal)
           {
-             e_pixmap_del(tzsh_srv->tzsh->cp);
+             e_pixmap_win_id_del(tzsh_srv->tzsh->cp);
              e_object_del(E_OBJECT(ec));
           }
 
@@ -4430,7 +4430,7 @@ _launchscreen_img_off(E_Policy_Wl_Tzlaunch_Img *tzlaunch_img)
              ec->ignored = EINA_TRUE;
           }
 
-        e_pixmap_del(tzlaunch_img->ep);
+        e_pixmap_win_id_del(tzlaunch_img->ep);
         e_object_del(E_OBJECT(ec));
      }
    else if (!e_pixmap_resource_get(ec->pixmap))
@@ -4641,7 +4641,7 @@ _tzlaunch_img_iface_cb_owner(struct wl_client *client EINA_UNUSED, struct wl_res
                    old_ec, new_ec, tzlaunch_img->obj);
 
              /* delete ec was created for launchscreen */
-             e_pixmap_del(tzlaunch_img->ep);
+             e_pixmap_win_id_del(tzlaunch_img->ep);
              e_object_del(E_OBJECT(old_ec));
              tzlaunch_img->ep = NULL;
              if (old_ec->visible)
@@ -4711,7 +4711,7 @@ error:
      {
         ERR("Could not initialize launchscreen client");
         if (tzlaunch_img->ep)
-          e_pixmap_del(tzlaunch_img->ep);
+          e_pixmap_win_id_del(tzlaunch_img->ep);
         if (tzlaunch_img->ec)
           e_object_del(E_OBJECT(tzlaunch_img->ec));
         E_FREE(tzlaunch_img);

diff --git a/src/bin/e_win.c b/src/bin/e_win.c
index 55b5bcdc8ae9039689030b7d4a917c2688d91e18..f2acf47ccebf404437b8b2d41b8866d538b162c4 100644 (file)
--- a/src/bin/e_win.c
+++ b/src/bin/e_win.c
@@ -113,7 +113,7 @@ _e_elm_win_trap_show(void *data, Evas_Object *o)
                   if ((cp = e_pixmap_find(type, wl_win_id)))
                     {
                        ERR("There is e_pixmap already, Delete old e_pixmap %p", cp);
-                       e_pixmap_del(cp);
+                       e_pixmap_win_id_del(cp);
                        cp = NULL;
                     }
                   /* first creation of pixmap for internal window */