buffet / kiwmi

A fully programmable Wayland Compositor
Mozilla Public License 2.0
585 stars 22 forks source link

Fix use-after-free in the lua object management #77

Open kuruczgy opened 1 year ago

kuruczgy commented 1 year ago

Wlroots does not call wl_list_remove(&destroy.listener_list) after the destroy signal fires. It is the responsibility of the subscriber to handle their own wl_listener being left with an invalid link.

This was an issue because it might happen that the kiwmi_object is not destroyed immediately, but only later by a lua gc handler that finally decrements the refcount to zero. We have to ensure that kiwmi_object_destroy can succeed.

Here we first use wl_list_remove to unsubscribe from the signal, and then wl_list_init to leave the link in a valid state for kiwmi_object_destroy.