[PATCH wayland v4 09/11] client: Consume file descriptors destined for zombie proxies

[Daniel Stone]

From: Derek Foreman <derekf at osg.samsung.com>

We need to close file descriptors sent to zombie proxies to avoid leaking
them, and perhaps more importantly, to prevent them from being dispatched
in events on other objects (since they would previously be left in the
buffer and potentially fed to following events destined for live proxies)

Signed-off-by: Derek Foreman <derekf at osg.samsung.com>
Reviewed-by: Daniel Stone <daniels at collabora.com>
Signed-off-by: Daniel Stone <daniels at collabora.com>
---
 src/connection.c      | 6 ++++++
 src/wayland-client.c  | 8 ++++++++
 src/wayland-private.h | 3 +++
 3 files changed, 17 insertions(+)

diff --git a/src/connection.c b/src/connection.c
index 426be574..6f83bab2 100644
--- a/src/connection.c
+++ b/src/connection.c
@@ -192,6 +192,12 @@ close_fds(struct wl_buffer *buffer, int max)
 	buffer->tail += size;
 }
 
+void
+wl_connection_close_fds_in(struct wl_connection *connection, int max)
+{
+	close_fds(&connection->fds_in, max);
+}
+
 int
 wl_connection_destroy(struct wl_connection *connection)
 {
diff --git a/src/wayland-client.c b/src/wayland-client.c
index 62d4f222..c1369b88 100644
--- a/src/wayland-client.c
+++ b/src/wayland-client.c
@@ -1353,8 +1353,16 @@ queue_event(struct wl_display *display, int len)
 	if (len < size)
 		return 0;
 
+	/* If our proxy is gone or a zombie, just eat the event (and any FDs,
+	 * if applicable). */
 	proxy = wl_map_lookup(&display->objects, id);
 	if (!proxy || wl_object_is_zombie(&display->objects, id)) {
+		struct wl_zombie *zombie = wl_map_lookup(&display->objects, id);
+
+		if (zombie)
+			wl_connection_close_fds_in(display->connection,
+						   zombie->fd_count[opcode]);
+
 		wl_connection_consume(display->connection, size);
 		return size;
 	}
diff --git a/src/wayland-private.h b/src/wayland-private.h
index 8e94864a..12b9032c 100644
--- a/src/wayland-private.h
+++ b/src/wayland-private.h
@@ -253,4 +253,7 @@ wl_priv_signal_get(struct wl_priv_signal *signal, wl_notify_func_t notify);
 void
 wl_priv_signal_emit(struct wl_priv_signal *signal, void *data);
 
+void
+wl_connection_close_fds_in(struct wl_connection *connection, int max);
+
 #endif
-- 
2.14.3