cry/Hyprland
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

desktop/popup: fix use after free in Popup (#13335)

Browse source 
m_alpha was freed by fullyDestroy, but was then being touched because setCallbackOnEnd is activated by tick, which is the same function that updates animating variables

---------

Co-authored-by: Vaxry <vaxry@vaxry.net>
This commit is contained in:
jmanc3 2026-02-23 10:58:06 -06:00 • committed by GitHub
parent f4bc8c3a64
commit bc09504ea5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/desktop/view/Popup.cpp
View file

@ -9,6 +9,7 @@
#include "../../managers/animation/AnimationManager.hpp" #include "../../managers/animation/AnimationManager.hpp"
#include "LayerSurface.hpp" #include "LayerSurface.hpp"
#include "../../managers/input/InputManager.hpp" #include "../../managers/input/InputManager.hpp"
#include "../../managers/eventLoop/EventLoopManager.hpp"
#include "../../render/Renderer.hpp" #include "../../render/Renderer.hpp"
#include "../../render/OpenGL.hpp" #include "../../render/OpenGL.hpp"
#include <ranges> #include <ranges>
@ -108,8 +109,12 @@ void CPopup::initAllSignals() {
m_alpha->setCallbackOnEnd( m_alpha->setCallbackOnEnd(
[this](auto) { [this](auto) {
if (inert()) { if (inert()) {
g_pHyprRenderer->damageBox(CBox{coordsGlobal(), size()}); g_pEventLoopManager->doLater([p = m_self] {
fullyDestroy(); if (!p)
return;
g_pHyprRenderer->damageBox(CBox{p->coordsGlobal(), p->size()});
p->fullyDestroy();
});
} }
}, },
false); false);