Skip to content

fix: remove ti->disconnect() in entityAboutToDestroy handler to prevent UAF SIGSEGV #809

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
felixonmars wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix: remove ti->disconnect() in entityAboutToDestroy handler to prevent UAF SIGSEGV #809

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion waylib/src/server/protocols/winputmethodhelper.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -348,7 +348,14 @@ void WInputMethodHelper::handleNewTI(WTextInput *ti)
connect(ti, &WTextInput::entityAboutToDestroy, this, [this, d, ti]{
d->textInputs.removeAll(ti);
disableTI(ti);
ti->disconnect();
// Do NOT call ti->disconnect() here: it would attempt to access
// the ConnectionData of sender objects (e.g. WSurface focusedSurface /
// enabledSurface) that wl_client_destroy may already have freed before
// reaching the text-input resource, causing a UAF SIGSEGV in
// QObjectPrivate::ConnectionData::removeConnection (fetch_sub on freed
// memory). The QObject destructor invoked by delete text_input in
// handle_text_input_resource_destroy will clean up all connections
// safely once the sender objects have finished tearing down.
}); // textInputs only save and traverse text inputs, do not handle connections
// Whether this text input belongs to current seat or not, we should connect
// its requestFocus signal for it might request focus from another seat to activate
Expand Down
Loading