use wl_list_for_each_safe instead of wl_list_for_each

frame_callback may has invalid value if it's freed heap area
is overwritten after wl_resource_destroy

Change-Id: I61d6484857624e9c379ec96e85903e86b55531e0
Reviewed-by: Jørgen Lind <jorgen.lind@nokia.com>

diff --git a/src/compositor/wayland_wrapper/wlsurface.cpp b/src/compositor/wayland_wrapper/wlsurface.cpp
index 87f7eae..34c1127 100644 (file)
--- a/src/compositor/wayland_wrapper/wlsurface.cpp
+++ b/src/compositor/wayland_wrapper/wlsurface.cpp
@@ -236,8 +236,8 @@ void Surface::sendFrameCallback()
     bool updateNeeded = advanceBufferQueue();
 
     uint time = Compositor::currentTimeMsecs();
-    struct wl_resource *frame_callback;
-    wl_list_for_each(frame_callback, &m_frame_callback_list, link) {
+    struct wl_resource *frame_callback, *next;
+    wl_list_for_each_safe(frame_callback, next, &m_frame_callback_list, link) {
         wl_callback_send_done(frame_callback, time);
         wl_resource_destroy(frame_callback);
     }