Skip to content

fix xwayland/selection crash

John Good requested to merge archiesix/weston:xselection into main

When copying from or pasting to an Xwayland application, sometimes Weston crashes. This happens rather frequently in libreoffice calc (just repeatedly press very quickly CTRL-C in a void cell). The reason for the crash is calling twice the function wl_array_release(&wm->source) at line 462 in xwayland/selection.c, thus freeing the already freed array wm->source without an intervening allocation.

More thorough investigation reveals that actually the problem comes from overriding (at least twice) the wm->property_source value set by the call to the function wl_event_loop_add_fd in the function weston_wm_send_data. As a consequence, the call to wl_event_source_remove(wm->property_source) does not remove the previously set file descriptor event source. This in turn, causes the function weston_wm_read_data_source to be called again, thus leading to freeing the already freed array.

The commit 3ea5437d introduced extra checks to wm->property_source that are not needed, but leaved the possibility that wm->property_source be overwritten.

The proposed check reverts the commit 3ea5437d and avoids that wm->property_source be overwritten before the set callback frees it.

Merge request reports

Loading