From: John Lindgren <john@jlindgren.net>
Date: Fri, 16 Sep 2022 00:02:06 +0000 (-0400)
Subject: seat: Fix use-after-free in touch_finish()
X-Git-Url: https://git.mdlowis.com/?a=commitdiff_plain;h=a3fbb52bb046de79336d540c8152b101a1dc6e8d;p=proto%2Flabwc.git

seat: Fix use-after-free in touch_finish()
---

diff --git a/src/seat.c b/src/seat.c
index 70a240e8..e19c663f 100644
--- a/src/seat.c
+++ b/src/seat.c
@@ -317,8 +317,13 @@ seat_finish(struct server *server)
 	struct seat *seat = &server->seat;
 	wl_list_remove(&seat->new_input.link);
 	keyboard_finish(seat);
-	cursor_finish(seat);
+	/*
+	 * Caution - touch_finish() unregisters event listeners from
+	 * seat->cursor and must come before cursor_finish(), otherwise
+	 * a use-after-free occurs.
+	 */
 	touch_finish(seat);
+	cursor_finish(seat);
 }
 
 void