KittyPatch/kitty
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix a use-after-free when handling fake mouse clicks and the action causes windows to be removed/re-allocated

Browse Source 
Fixes #5506
This commit is contained in:
Kovid Goyal 2022-09-17 18:21:10 +05:30
parent 1c44da2b4a
commit 5180a41e87
No known key found for this signature in database
GPG Key ID: 06BC317B515ACE7C
1 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
kitty/mouse.c
View File

@ -141,6 +141,17 @@ encode_mouse_scroll(Window *w, int button, int mods) {
// }}} // }}}
static Window*
window_for_id(id_type window_id) {
Tab *t = global_state.callback_os_window->tabs + global_state.callback_os_window->active_tab;
for (unsigned int i = 0; i < t->num_windows; i++) {
Window *w = t->windows + i;
if (w->id == window_id) return w;
}
return NULL;
}
static bool static bool
dispatch_mouse_event(Window *w, int button, int count, int modifiers, bool grabbed) { dispatch_mouse_event(Window *w, int button, int count, int modifiers, bool grabbed) {
bool handled = false; bool handled = false;
@ -492,8 +503,10 @@ send_pending_click_to_window(Window *w, void *data) {
) { ) {
MousePosition current_pos = w->mouse_pos; MousePosition current_pos = w->mouse_pos;
w->mouse_pos = pc->mouse_pos; w->mouse_pos = pc->mouse_pos;
id_type wid = w->id;
dispatch_mouse_event(w, pc->button, pc->count, pc->modifiers, pc->grabbed); dispatch_mouse_event(w, pc->button, pc->count, pc->modifiers, pc->grabbed);
w->mouse_pos = current_pos; w = window_for_id(wid);
if (w) w->mouse_pos = current_pos;
} }
#undef press #undef press
} }
@ -581,16 +594,6 @@ mouse_in_region(Region *r) {
return true; return true;
} }
static Window*
window_for_id(id_type window_id) {
Tab *t = global_state.callback_os_window->tabs + global_state.callback_os_window->active_tab;
for (unsigned int i = 0; i < t->num_windows; i++) {
Window *w = t->windows + i;
if (w->id == window_id) return w;
}
return NULL;
}
static Window* static Window*
window_for_event(unsigned int *window_idx, bool *in_tab_bar) { window_for_event(unsigned int *window_idx, bool *in_tab_bar) {
Region central, tab_bar; Region central, tab_bar;