kiwmi icon indicating copy to clipboard operation
kiwmi copied to clipboard

Fix use-after-free in the lua object management

Open kuruczgy opened this issue 1 year ago • 1 comments

Original PR: #77

Wlroots does not call wl_list_remove(&destroy.listener_list) after the destroy signal fires. It is the responsibility of the subscriber to handle their own wl_listener being left with an invalid link.

This was an issue because it might happen that the kiwmi_object is not destroyed immediately, but only later by a lua gc handler that finally decrements the refcount to zero. We have to ensure that kiwmi_object_destroy can succeed.

Here we first use wl_list_remove to unsubscribe from the signal, and then wl_list_init to leave the link in a valid state for kiwmi_object_destroy.

kuruczgy avatar Nov 15 '24 21:11 kuruczgy

@buffet rebased my original PR that was closed due to the history rewriting.

If you ever want to pick up working on the project in the future (no pressure or anything), let me know, and I can create updated versions of my other closed PRs as well :)

kuruczgy avatar Nov 15 '24 21:11 kuruczgy