[PATCH 1/2] Set to NULL event source after a call to wl_event_source_remove
Hardening
rdp.effort at gmail.com
Fri May 9 07:03:51 PDT 2014
This patch sets to NULL event sources after a call to wl_event_source_remove()
has been made.
---
src/clipboard.c | 3 ++-
src/compositor-drm.c | 3 +++
src/compositor-rpi.c | 1 +
src/compositor-x11.c | 2 ++
src/compositor.c | 6 +++++-
src/evdev-touchpad.c | 1 +
src/evdev.c | 4 +++-
src/libinput-seat.c | 1 +
src/logind-util.c | 2 ++
xwayland/launcher.c | 6 +++++-
xwayland/selection.c | 9 +++++++--
11 files changed, 32 insertions(+), 6 deletions(-)
diff --git a/src/clipboard.c b/src/clipboard.c
index 5a3a02d..0e25dc1 100644
--- a/src/clipboard.c
+++ b/src/clipboard.c
@@ -61,6 +61,7 @@ clipboard_source_unref(struct clipboard_source *source)
if (source->event_source) {
wl_event_source_remove(source->event_source);
+ source->event_source = NULL;
close(source->fd);
}
wl_signal_emit(&source->base.destroy_signal,
@@ -90,8 +91,8 @@ clipboard_source_data(int fd, uint32_t mask, void *data)
len = read(fd, p, size);
if (len == 0) {
wl_event_source_remove(source->event_source);
- close(fd);
source->event_source = NULL;
+ close(fd);
} else if (len < 0) {
clipboard_source_unref(source);
clipboard->source = NULL;
diff --git a/src/compositor-drm.c b/src/compositor-drm.c
index 5f59789..0110f41 100644
--- a/src/compositor-drm.c
+++ b/src/compositor-drm.c
@@ -2379,7 +2379,9 @@ drm_destroy(struct weston_compositor *ec)
udev_input_destroy(&d->input);
wl_event_source_remove(d->udev_drm_source);
+ d->udev_drm_source = NULL;
wl_event_source_remove(d->drm_source);
+ d->drm_source = NULL;
destroy_sprites(d);
@@ -2849,6 +2851,7 @@ drm_compositor_create(struct wl_display *display,
err_udev_monitor:
wl_event_source_remove(ec->udev_drm_source);
+ ec->udev_drm_source = NULL;
udev_monitor_unref(ec->udev_monitor);
err_drm_source:
wl_event_source_remove(ec->drm_source);
diff --git a/src/compositor-rpi.c b/src/compositor-rpi.c
index 287451d..cbfb770 100644
--- a/src/compositor-rpi.c
+++ b/src/compositor-rpi.c
@@ -213,6 +213,7 @@ static void
rpi_flippipe_release(struct rpi_flippipe *flippipe)
{
wl_event_source_remove(flippipe->source);
+ flippipe->source = NULL;
close(flippipe->readfd);
close(flippipe->writefd);
}
diff --git a/src/compositor-x11.c b/src/compositor-x11.c
index 56b3228..9f171e7 100644
--- a/src/compositor-x11.c
+++ b/src/compositor-x11.c
@@ -485,6 +485,7 @@ x11_output_destroy(struct weston_output *output_base)
(struct x11_compositor *)output->base.compositor;
wl_event_source_remove(output->finish_frame_timer);
+ output->finish_frame_timer = NULL;
if (compositor->use_pixman) {
pixman_renderer_output_destroy(output_base);
@@ -1424,6 +1425,7 @@ x11_destroy(struct weston_compositor *ec)
struct x11_compositor *compositor = (struct x11_compositor *)ec;
wl_event_source_remove(compositor->xcb_source);
+ compositor->xcb_source = NULL;
x11_input_destroy(compositor);
weston_compositor_shutdown(ec); /* destroys outputs, too */
diff --git a/src/compositor.c b/src/compositor.c
index cd1ca9a..6ad3387 100644
--- a/src/compositor.c
+++ b/src/compositor.c
@@ -3736,8 +3736,12 @@ weston_compositor_shutdown(struct weston_compositor *ec)
struct weston_output *output, *next;
wl_event_source_remove(ec->idle_source);
- if (ec->input_loop_source)
+ ec->idle_source = NULL;
+
+ if (ec->input_loop_source) {
wl_event_source_remove(ec->input_loop_source);
+ ec->input_loop_source = NULL;
+ }
/* Destroy all outputs associated with this compositor */
wl_list_for_each_safe(output, next, &ec->output_list, link)
diff --git a/src/evdev-touchpad.c b/src/evdev-touchpad.c
index 69f913a..360f87f 100644
--- a/src/evdev-touchpad.c
+++ b/src/evdev-touchpad.c
@@ -663,6 +663,7 @@ touchpad_destroy(struct evdev_dispatch *dispatch)
touchpad->filter->interface->destroy(touchpad->filter);
wl_event_source_remove(touchpad->fsm.timer_source);
+ touchpad->fsm.timer_source = NULL;
free(dispatch);
}
diff --git a/src/evdev.c b/src/evdev.c
index 888dfbd..a1bce2c 100644
--- a/src/evdev.c
+++ b/src/evdev.c
@@ -697,8 +697,10 @@ evdev_device_destroy(struct evdev_device *device)
if (dispatch)
dispatch->interface->destroy(dispatch);
- if (device->source)
+ if (device->source) {
wl_event_source_remove(device->source);
+ device->source = NULL;
+ }
if (device->output)
wl_list_remove(&device->output_destroy_listener.link);
wl_list_remove(&device->link);
diff --git a/src/libinput-seat.c b/src/libinput-seat.c
index a38d470..34f1aab 100644
--- a/src/libinput-seat.c
+++ b/src/libinput-seat.c
@@ -291,6 +291,7 @@ udev_input_destroy(struct udev_input *input)
struct udev_seat *seat, *next;
wl_event_source_remove(input->libinput_source);
+ input->libinput_source = NULL;
wl_list_for_each_safe(seat, next, &input->compositor->seat_list, base.link)
udev_seat_destroy(seat);
libinput_destroy(input->libinput);
diff --git a/src/logind-util.c b/src/logind-util.c
index 6a1b498..b2187d8 100644
--- a/src/logind-util.c
+++ b/src/logind-util.c
@@ -803,6 +803,7 @@ weston_logind_setup_vt(struct weston_logind *wl)
err_sfd_source:
wl_event_source_remove(wl->sfd_source);
+ wl->sfd_source = NULL;
err_sfd:
close(wl->sfd);
err_mode:
@@ -820,6 +821,7 @@ weston_logind_destroy_vt(struct weston_logind *wl)
{
weston_logind_restore(wl);
wl_event_source_remove(wl->sfd_source);
+ wl->sfd_source = NULL;
close(wl->sfd);
close(wl->vt);
}
diff --git a/xwayland/launcher.c b/xwayland/launcher.c
index 70703a4..2b6b274 100644
--- a/xwayland/launcher.c
+++ b/xwayland/launcher.c
@@ -45,7 +45,7 @@ handle_sigusr1(int signal_number, void *data)
* this came from Xwayland.*/
weston_wm_create(wxs, wxs->wm_fd);
wl_event_source_remove(wxs->sigusr1_source);
-
+ wxs->sigusr1_source = NULL;
return 1;
}
@@ -133,7 +133,9 @@ weston_xserver_handle_event(int listen_fd, uint32_t mask, void *data)
weston_watch_process(&wxs->process);
wl_event_source_remove(wxs->abstract_source);
+ wxs->abstract_source = NULL;
wl_event_source_remove(wxs->unix_source);
+ wxs->unix_source = NULL;
break;
case -1:
@@ -155,7 +157,9 @@ weston_xserver_shutdown(struct weston_xserver *wxs)
unlink(path);
if (wxs->process.pid == 0) {
wl_event_source_remove(wxs->abstract_source);
+ wxs->abstract_source = NULL;
wl_event_source_remove(wxs->unix_source);
+ wxs->unix_source = NULL;
}
close(wxs->abstract_fd);
close(wxs->unix_fd);
diff --git a/xwayland/selection.c b/xwayland/selection.c
index b694477..3cad77e 100644
--- a/xwayland/selection.c
+++ b/xwayland/selection.c
@@ -44,8 +44,10 @@ writable_callback(int fd, uint32_t mask, void *data)
if (len == -1) {
free(wm->property_reply);
wm->property_reply = NULL;
- if (wm->property_source)
+ if (wm->property_source) {
wl_event_source_remove(wm->property_source);
+ wm->property_source = NULL;
+ }
close(fd);
weston_log("write error to target fd: %m\n");
return 1;
@@ -59,8 +61,10 @@ writable_callback(int fd, uint32_t mask, void *data)
if (len == remainder) {
free(wm->property_reply);
wm->property_reply = NULL;
- if (wm->property_source)
+ if (wm->property_source) {
wl_event_source_remove(wm->property_source);
+ wm->property_source = NULL;
+ }
if (wm->incr) {
xcb_delete_property(wm->conn,
@@ -352,6 +356,7 @@ weston_wm_read_data_source(int fd, uint32_t mask, void *data)
weston_log("read error from data source: %m\n");
weston_wm_send_selection_notify(wm, XCB_ATOM_NONE);
wl_event_source_remove(wm->property_source);
+ wm->property_source = NULL;
close(fd);
wl_array_release(&wm->source_data);
}
--
1.8.1.2
More information about the wayland-devel
mailing list