Fix UAF when granting an output lease

Wlroots now destroys the wlr_output when granting a lease.
So we can't iterate through the outputs in the request after
granting the lease. This is also not necessary anymore because
they are already destroyed and thus removed from the layout.

diff --git a/include/labwc.h b/include/labwc.h
index 2e031d499b83e1d54c01f0c7613775f3bb24ae8e..cff785881e42224b549ea12a24fa31d5e2f60089 100644 (file)
--- a/include/labwc.h
+++ b/include/labwc.h
@@ -433,7 +433,6 @@ struct output {
        struct wl_listener frame;
        struct wl_listener request_state;
 
-       bool leased;
        bool gamma_lut_changed;
 };
 

diff --git a/src/output.c b/src/output.c
index 00e1faf0e021e8e9e304bea32585e75eb67834e0..85157c7dbfcb2728d030e9c8596be56e6c7c30f8 100644 (file)
--- a/src/output.c
+++ b/src/output.c
@@ -609,7 +609,7 @@ output_config_apply(struct server *server,
                struct wlr_output *o = head->state.output;
                struct output *output = output_from_wlr_output(server, o);
                struct wlr_output_state *os = &output->pending;
-               bool output_enabled = head->state.enabled && !output->leased;
+               bool output_enabled = head->state.enabled;
 
                wlr_output_state_set_enabled(os, output_enabled);
                if (output_enabled) {
@@ -1006,7 +1006,7 @@ bool
 output_is_usable(struct output *output)
 {
        /* output_is_usable(NULL) is safe and returns false */
-       return output && output->wlr_output->enabled && !output->leased;
+       return output && output->wlr_output->enabled;
 }
 
 /* returns true if usable area changed */

diff --git a/src/server.c b/src/server.c
index 3666d86ab0eb0c0cb5586651105d8882bbe2aa54..214885b1defa29266d6aaeeafeff1d2bc96540f9 100644 (file)
--- a/src/server.c
+++ b/src/server.c
@@ -183,22 +183,6 @@ handle_drm_lease_request(struct wl_listener *listener, void *data)
                wlr_drm_lease_request_v1_reject(req);
                return;
        }
-
-       for (size_t i = 0; i < req->n_connectors; ++i) {
-               struct output *output = req->connectors[i]->output->data;
-               if (!output) {
-                       continue;
-               }
-
-               wlr_output_state_set_enabled(&output->pending, false);
-               output_state_commit(output);
-
-               wlr_output_layout_remove(output->server->output_layout,
-                       output->wlr_output);
-               output->scene_output = NULL;
-
-               output->leased = true;
-       }
 }
 
 static bool