seat: Fix use-after-free in touch_finish()

diff --git a/src/seat.c b/src/seat.c
index 70a240e85ff93fdf63801e4345aed0b27678f354..e19c663f39ef5695b3ac7e293f53532d8d8e44ec 100644 (file)
--- a/src/seat.c
+++ b/src/seat.c
@@ -317,8 +317,13 @@ seat_finish(struct server *server)
        struct seat *seat = &server->seat;
        wl_list_remove(&seat->new_input.link);
        keyboard_finish(seat);
-       cursor_finish(seat);
+       /*
+        * Caution - touch_finish() unregisters event listeners from
+        * seat->cursor and must come before cursor_finish(), otherwise
+        * a use-after-free occurs.
+        */
        touch_finish(seat);
+       cursor_finish(seat);
 }
 
 void