[PATCH weston] compositor-rdp: rdp_destroy() double free error #91457

[Dawid Gajownik]

When something goes wrong during weston initialization,
weston_compositor_destroy() is executed. It destroys the backend and
then frees compositor memory. Unfortunately RDP backend is not correctly
destroyed. It frees compositor instead of a backend memory.  This causes
later a double free error. The easiest way to reproduce a problem is to
run weston with an invalid option.

Additionally some other objects of rdp_backend structure are not
destroyed/freed. The patch fixes both issues.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=91457

Signed-off-by: Dawid Gajownik <gajownik at gmail.com>
---
 src/compositor-rdp.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/compositor-rdp.c b/src/compositor-rdp.c
index 4ef0dd1..a83948b 100644
--- a/src/compositor-rdp.c
+++ b/src/compositor-rdp.c
@@ -541,9 +541,20 @@ rdp_restore(struct weston_compositor *ec)
 static void
 rdp_destroy(struct weston_compositor *ec)
 {
+	struct rdp_backend *b = (struct rdp_backend *) ec->backend;
+	int i;
+
 	weston_compositor_shutdown(ec);
+	for(i = 0 ; i < MAX_FREERDP_FDS; i++)
+		if(b->listener_events[i])
+			wl_event_source_remove(b->listener_events[i]);
 
-	free(ec);
+	freerdp_listener_free(b->listener);
+
+	free(b->server_cert);
+	free(b->server_key);
+	free(b->rdp_key);
+	free(b);
 }
 
 static
-- 
2.4.3