lkn
/
windowmaker-wl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wview: remove view from lookup table in destroyView before freeing — fix use-after-free race

This commit is contained in:
Ollie 2026-05-29 17:06:19 +02:00
parent 7fcfb0870d
commit 03fa233ff7
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
WINGs/wview.c
View File

@ -318,6 +318,11 @@ static void destroyView(W_View * view)
return; return;
view->flags.alreadyDead = 1; view->flags.alreadyDead = 1;
/* Remove from view lookup table before freeing memory.
* Otherwise a concurrent W_GetViewForWindow can return a
* dangling pointer after wfree(view) reuses the memory. */
view_table_remove(view->window);
/* delete the balloon text for the view, if there's any */ /* delete the balloon text for the view, if there's any */
WMSetBalloonTextForView(NULL, view); WMSetBalloonTextForView(NULL, view);