When something goes wrong during weston initialization, weston_compositor_destroy() is executed. It destroys the backend and then frees compositor memory. Unfortunately RDP backend is not correctly destroyed. It frees compositor instead of a backend memory. This causes later a double free error. The easiest way to reproduce a problem is to run weston with an invalid option.
Additionally some other objects of rdp_backend structure are not destroyed/freed. The patch fixes both issues. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=91457 Signed-off-by: Dawid Gajownik <gajow...@gmail.com> --- src/compositor-rdp.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/compositor-rdp.c b/src/compositor-rdp.c index 4ef0dd1..a83948b 100644 --- a/src/compositor-rdp.c +++ b/src/compositor-rdp.c @@ -541,9 +541,20 @@ rdp_restore(struct weston_compositor *ec) static void rdp_destroy(struct weston_compositor *ec) { + struct rdp_backend *b = (struct rdp_backend *) ec->backend; + int i; + weston_compositor_shutdown(ec); + for(i = 0 ; i < MAX_FREERDP_FDS; i++) + if(b->listener_events[i]) + wl_event_source_remove(b->listener_events[i]); - free(ec); + freerdp_listener_free(b->listener); + + free(b->server_cert); + free(b->server_key); + free(b->rdp_key); + free(b); } static -- 2.4.3 _______________________________________________ wayland-devel mailing list wayland-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/wayland-devel
