From 09d389564287abcad237f6e4187a09c3fd3c4163 Mon Sep 17 00:00:00 2001 From: lkn Date: Fri, 26 Jun 2026 07:18:26 +0200 Subject: [PATCH] wayland: fix use-after-free in popup resource destroy callback ASAN found the heap corruption bug. When a toplevel is destroyed, the view is freed but the wmaker-popup-v1 wl_resource still exists. When the client later disconnects, wayland-server calls the resource destroy callback which accessed the freed view (writing to view->popup). This corrupted whatever was subsequently allocated in that memory region, causing the SIGSEGV-in-malloc crashes. Fix: NULL out the resource user_data before freeing the view. --- src/backend/wayland/wl_xdg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/backend/wayland/wl_xdg.c b/src/backend/wayland/wl_xdg.c index 64d7f25..0cf562e 100644 --- a/src/backend/wayland/wl_xdg.c +++ b/src/backend/wayland/wl_xdg.c @@ -454,6 +454,10 @@ handle_toplevel_destroy(struct wl_listener *listener, void *data) wfree(view->wm_command[ci]); wfree(view->wm_command); } + /* Clear popup resource user_data so the resource destroy callback + * doesn't access the freed view. */ + if (view->popup) + wl_resource_set_user_data(view->popup, NULL); /* Save frame_id before freeing view */ WNativeWindow frame_id = view->frame_id; wfree(view);