From e3c19bd103010e725f886ff33ba62a550cec9840 Mon Sep 17 00:00:00 2001 From: lkn Date: Sat, 27 Jun 2026 18:40:30 +0200 Subject: [PATCH] fix UAF: destroy WApplication before wUnmanageWindow in XWayland unmap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same fix as commit 2581233 for XDG toplevels — wApplicationDestroy needs main_window_desc (the wwin) to clean up the appicon. Call it before wUnmanageWindow which frees wwin. --- src/backend/wayland/wl_event.c | 2 ++ src/backend/wayland/wl_xwayland.c | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/backend/wayland/wl_event.c b/src/backend/wayland/wl_event.c index 4ff5877..6ca97ce 100644 --- a/src/backend/wayland/wl_event.c +++ b/src/backend/wayland/wl_event.c @@ -16,6 +16,8 @@ void wl_event_flush(void) (!wl_state.session || wl_state.session->active)) { wlr_scene_output_commit(wl_state.scene_output, NULL); wl_display_flush_clients(wl_state.display); + struct wl_event_loop *loop = wl_display_get_event_loop(wl_state.display); + wl_event_loop_dispatch(loop, 0); } } void wl_event_flush_expose(void) {} diff --git a/src/backend/wayland/wl_xwayland.c b/src/backend/wayland/wl_xwayland.c index 14ad860..ee29b4d 100644 --- a/src/backend/wayland/wl_xwayland.c +++ b/src/backend/wayland/wl_xwayland.c @@ -223,13 +223,13 @@ handle_xwayland_unmap(struct wl_listener *listener, void *data) if (desc && desc->parent_type == WCLASS_WINDOW) { WWindow *wwin = (WWindow *)desc->parent; WNativeWindow main_win = wwin->main_window; - wUnmanageWindow(wwin, False, True); WApplication *app = wApplicationOf(main_win); if (app) { - if (main_win == app->main_window) - app->refcount = 0; + app->refcount = 0; wApplicationDestroy(app); } + wwin->flags.destroyed = 1; + wUnmanageWindow(wwin, False, True); } } }