This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch master
in repository enlightenment.
View the commit online.
commit f252f8e89ada907ba0440ad0e77665620a6f6542
Author: [email protected] <[email protected]>
AuthorDate: Sun Mar 15 15:54:41 2026 -0600
fix: eliminate use-after-free in notification reshuffle callback
The _notification_reshuffle_cb function can be invoked re-entrantly when
_notification_popdown calls evas_object_hide, triggering EFL's internal
cleanup chain that fires the DEL callback before the first _notification_popdown
call completes. The original code called _notification_popdown again in this
scenario, freeing the struct while the initial call was still executing on the
stack, causing use-after-free violations on subsequent accesses.
Restructure the callback to handle both cases: if pending is set (re-entrant
case), remove the DEL callback and clear pending so the in-progress first call
proceeds and frees the struct. Otherwise (normal case), call _notification_popdown
as before. Always remove the popup from the list before checking pending.
Fixes use-after-free confirmed by valgrind in close_notification_cb.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---
src/modules/notification/e_mod_popup.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/modules/notification/e_mod_popup.c b/src/modules/notification/e_mod_popup.c
index 7cd548254..ca51932ee 100644
--- a/src/modules/notification/e_mod_popup.c
+++ b/src/modules/notification/e_mod_popup.c
@@ -92,9 +92,21 @@ _notification_reshuffle_cb(void *data EINA_UNUSED, Evas *e EINA_UNUSED, Evas_Obj
{
if (popup->theme == obj)
{
- popup->pending = 0;
- _notification_popdown(popup, 0);
notification_cfg->popups = eina_list_remove_list(notification_cfg->popups, l);
+ if (popup->pending)
+ {
+ /* _notification_popdown() is already in progress for this popup:
+ * the reshuffle DEL callback fired re-entrantly via evas_object_hide()
+ * inside that call. Clear pending so the in-progress _notification_popdown
+ * will proceed past the early-return guard and free the struct.
+ * Also remove the DEL callback so it does not fire a second time when
+ * evas_object_del(popup->win) finishes destroying the theme object. */
+ evas_object_event_callback_del(popup->theme, EVAS_CALLBACK_DEL,
+ _notification_reshuffle_cb);
+ popup->pending = 0;
+ }
+ else
+ _notification_popdown(popup, 0);
}
else
pos = _notification_popup_place(popup, pos);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
