From 01904fdb393c67586265a84f788f60b0d9b8a81f Mon Sep 17 00:00:00 2001 From: lkn Date: Tue, 23 Jun 2026 22:08:29 +0200 Subject: [PATCH] fix use-after-free: destroy child tree before dropping buffer When destroying child frame_bufs, the tree node was not destroyed before wlr_buffer_drop freed the struct. Later, cascade destruction of the parent tree would fire fb_tree_destroy_handler on the freed child, corrupting the heap. Destroy the child tree explicitly first. --- src/backend/wayland/wl_framebuf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/wayland/wl_framebuf.c b/src/backend/wayland/wl_framebuf.c index 587dfa2..823cf5a 100644 --- a/src/backend/wayland/wl_framebuf.c +++ b/src/backend/wayland/wl_framebuf.c @@ -463,9 +463,10 @@ wl_frame_destroy(WScreen *scr, WNativeWindow win) struct wl_frame_buf *child, *tmp; wl_list_for_each_safe(child, tmp, &wl_state.frame_list, link) { if (child->parent_id == win) { - W_UnregisterBacking(child->id); if (child->scene_buf) wlr_scene_node_destroy(&child->scene_buf->node); + if (child->tree) + wlr_scene_node_destroy(&child->tree->node); wl_list_remove(&child->link); wlr_buffer_drop(&child->base); }