Skip to content

Commit 053e066

Browse files
committed
wayland: move info_done variable to vo_wayland
vo_wayland_preferred_description_info is destroyed after info_done, so obviously we can't store it here. This causes a use-after-free. Embarrassing mistake Fixes: 7a7d871
1 parent a339fe5 commit 053e066

File tree

2 files changed

+4
-3
lines changed

2 files changed

+4
-3
lines changed

video/out/wayland_common.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -288,7 +288,6 @@ struct vo_wayland_text_input {
288288

289289
struct vo_wayland_preferred_description_info {
290290
struct vo_wayland_state *wl;
291-
bool info_done;
292291
struct pl_color_space csp;
293292
float min_luma;
294293
float max_luma;
@@ -2140,7 +2139,7 @@ static void info_done(void *data, struct wp_image_description_info_v1 *image_des
21402139
{
21412140
struct vo_wayland_preferred_description_info *wd = data;
21422141
struct vo_wayland_state *wl = wd->wl;
2143-
wd->info_done = true;
2142+
wl->image_description_info_done = true;
21442143
wp_image_description_info_v1_destroy(image_description_info);
21452144
if (!wd->icc_file) {
21462145
MP_VERBOSE(wl, "Preferred surface feedback received:\n");
@@ -3110,10 +3109,11 @@ static void get_compositor_preferred_description(struct vo_wayland_state *wl)
31103109
struct wp_image_description_info_v1 *description_info =
31113110
wp_image_description_v1_get_information(image_description);
31123111
struct wl_event_queue *image_description_info_queue = wl_display_create_queue_with_name(wl->display, "image description info queue");
3112+
wl->image_description_info_done = false;
31133113
wl_proxy_set_queue((struct wl_proxy *)description_info, image_description_info_queue);
31143114
wp_image_description_info_v1_add_listener(description_info, &image_description_info_listener, wd);
31153115
while (wl_display_dispatch_queue(wl->display, image_description_info_queue) > 0)
3116-
if (wd->info_done)
3116+
if (wl->image_description_info_done)
31173117
break;
31183118
wp_image_description_v1_destroy(image_description);
31193119
wl_event_queue_destroy(image_description_info_queue);

video/out/wayland_common.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ struct vo_wayland_state {
103103
void *icc_file;
104104
uint32_t icc_size;
105105
struct pl_color_space preferred_csp;
106+
bool image_description_info_done;
106107

107108
/* color-representation */
108109
struct wp_color_representation_manager_v1 *color_representation_manager;

0 commit comments

Comments
 (0)