Commit 123746a
committed
guard seat_get_focus() NULL dereferences
seat_get_focus() can return NULL when the focus stack is empty. a few
call sites don't check for this and just dereference the result, which
crashes sway.
this happens when a client disconnects abruptly, leaving the seat with
a stale has_focus flag or empty focus stack. whatever touches focus next
dereferences NULL. the two confirmed crash sites were
seat_set_workspace_focus and seat_set_focus_surface (coredumps below).
seat_unfocus_unless_client has the same pattern so a check was added
there too for safety.
coredumps:
#0 seat_send_unfocus ()
#1 seat_set_workspace_focus ()
#2 seat_set_focus ()
#3 wl_signal_emit_mutable ()
#4 container_begin_destroy ()
#5 view_unmap ()
#6 handle_unmap ()
#0 seat_send_unfocus ()
#1 seat_set_workspace_focus ()
#2 seat_set_focus ()
#3 handle_button ()
#0 seat_send_unfocus ()
#1 seat_set_workspace_focus ()
#2 seat_set_focus ()
#3 workspace_switch ()
#4 cmd_workspace ()
#5 execute_command ()
#6 ipc_client_handle_command ()
#0 seat_send_unfocus ()
#1 seat_set_focus_surface ()
#2 seat_set_focus_layer ()
#3 handle_node_destroy ()1 parent c57daaf commit 123746a
1 file changed
Lines changed: 9 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1136 | 1136 | | |
1137 | 1137 | | |
1138 | 1138 | | |
1139 | | - | |
1140 | | - | |
| 1139 | + | |
| 1140 | + | |
| 1141 | + | |
| 1142 | + | |
| 1143 | + | |
1141 | 1144 | | |
1142 | | - | |
1143 | 1145 | | |
1144 | 1146 | | |
1145 | 1147 | | |
| |||
1291 | 1293 | | |
1292 | 1294 | | |
1293 | 1295 | | |
1294 | | - | |
| 1296 | + | |
| 1297 | + | |
| 1298 | + | |
1295 | 1299 | | |
1296 | 1300 | | |
1297 | 1301 | | |
| |||
1340 | 1344 | | |
1341 | 1345 | | |
1342 | 1346 | | |
1343 | | - | |
| 1347 | + | |
1344 | 1348 | | |
1345 | 1349 | | |
1346 | 1350 | | |
| |||
0 commit comments