compositor: fix wp_viewport use after free
If a client destroyed the wl_surface before the wp_viewport, Weston core
would access freed memory, because the weston_surface pointer stored in
the wp_viewport wl_resource's user data was stale.
Fix this by setting the user data to NULL on wl_surface destruction. It
is specifically about wl_surface and not weston_surface destruction,
because this is about client-visible behaviour. Something internal might
keep weston_surface alive past the wl_surface.
Add checks to all wp_viewport request handlers.
At the same time, implement the new error conditions in wp_viewport:
calling any request except destroy must result in a protocol error.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
1 file changed