Skip to content
  • Keyu Tao's avatar
    keybindings: Add refcounting to fix use-after-free for key handlers · 8c39a254
    Keyu Tao authored and Marge Bot's avatar Marge Bot committed
    Two new fields: ref_count and removed, are added to MetaKeyHandler, and
    it would be freed only if the ref count has reached 0. When handler is
    removed from key_handlers GHashTable, key_handler_destroy() would mark
    removed as TRUE, and do an unref. handler->removed is checked in
    get_keybinding, and binding with handler removed would not be used.
    
    Also in MetaKeyBinding, it now has the ownership of the name field, to
    avoid it being freed before logging. Create or copy a binding would
    do a ref inc for handler, and free one would unref handler.
    
    Fixes gnome-shell#1870.
    
    Part-of: <!3711>
    8c39a254