wl_list_for_each dereference's output to increment the
next iteration of the loop.  However, output is free'd
inside the loop resulting in a dereference to free'd
memory.

Use wl_list_for_each_safe instead, which is designed to
handle this kind of pattern.

Signed-off-by: U. Artie Eoff <ullysses.a.e...@intel.com>
---
 src/compositor-wayland.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/compositor-wayland.c b/src/compositor-wayland.c
index a08b71a..76e5396 100644
--- a/src/compositor-wayland.c
+++ b/src/compositor-wayland.c
@@ -1997,9 +1997,9 @@ err_free:
 static void
 wayland_compositor_destroy(struct wayland_compositor *c)
 {
-       struct weston_output *output;
+       struct weston_output *output, *next;
 
-       wl_list_for_each(output, &c->base.output_list, link)
+       wl_list_for_each_safe(output, next, &c->base.output_list, link)
                wayland_output_destroy(output);
 
        c->base.renderer->destroy(&c->base);
-- 
1.9.0

_______________________________________________
wayland-devel mailing list
wayland-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/wayland-devel

Reply via email to