discomfitor pushed a commit to branch master.
http://git.enlightenment.org/core/efl.git/commit/?id=2760afbb0e8c8adfb35b1dee016be7883fa07323
commit 2760afbb0e8c8adfb35b1dee016be7883fa07323
Author: Derek Foreman <der...@osg.samsung.com>
Date: Mon Apr 4 13:08:55 2016 -0500
wayland-egl: Fix use after free
eng_window_use() uses outbuf->redirect, so the clever code in
eng_outbuf_reconfigure that avoided setting it to NULL to check
if we needed to recreate the redirect was not very clever at all.
---
src/modules/evas/engines/wayland_egl/evas_wl_main.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/modules/evas/engines/wayland_egl/evas_wl_main.c
b/src/modules/evas/engines/wayland_egl/evas_wl_main.c
index 00c0f908..532e749 100644
--- a/src/modules/evas/engines/wayland_egl/evas_wl_main.c
+++ b/src/modules/evas/engines/wayland_egl/evas_wl_main.c
@@ -317,17 +317,22 @@ eng_window_resurf(Outbuf *gw)
void
eng_outbuf_reconfigure(Outbuf *ob, int w, int h, int rot, Outbuf_Depth depth
EINA_UNUSED)
{
+ Eina_Bool redirected;
+
if (!ob->model) ob->model = wobbly_create(0, 0, w, h);
wobbly_resize(ob->model, w, h);
+
+ redirected = !!ob->redirect;
if (ob->redirect)
glsym_evas_gl_common_context_unredirect(ob->redirect);
+ ob->redirect = NULL;
ob->w = w;
ob->h = h;
ob->rot = rot;
eng_window_use(ob);
glsym_evas_gl_common_context_resize(ob->gl_context, w, h, rot);
- if (ob->redirect)
+ if (redirected)
ob->redirect = glsym_evas_gl_common_context_redirect(ob->gl_context);
if (ob->win)
--
