From 2bece94b9bf2cf099d2f166808385ce8a7940476 Mon Sep 17 00:00:00 2001 From: Di Ma Date: Sun, 22 Mar 2020 16:18:29 -0700 Subject: [PATCH] Fix a use-after-free error in switch binding --- sway/commands/bind.c | 1 + sway/input/switch.c | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sway/commands/bind.c b/sway/commands/bind.c index 4e49982a5..de2e7bd4f 100644 --- a/sway/commands/bind.c +++ b/sway/commands/bind.c @@ -608,6 +608,7 @@ void seat_execute_command(struct sway_seat *seat, struct sway_binding *binding) return; } memcpy(deferred, binding, sizeof(struct sway_binding)); + deferred->command = strdup(binding->command); list_add(seat->deferred_bindings, deferred); return; } diff --git a/sway/input/switch.c b/sway/input/switch.c index 3bbc636d3..b7c28df1f 100644 --- a/sway/input/switch.c +++ b/sway/input/switch.c @@ -1,4 +1,3 @@ -#define _POSIX_C_SOURCE 200809L #include "sway/config.h" #include "sway/desktop/transaction.h" #include "sway/input/switch.h" @@ -57,7 +56,7 @@ static void execute_binding(struct sway_switch *sway_switch) { calloc(1, sizeof(struct sway_binding)); dummy_binding->type = BINDING_SWITCH; dummy_binding->flags = matched_binding->flags; - dummy_binding->command = strdup(matched_binding->command); + dummy_binding->command = matched_binding->command; seat_execute_command(seat, dummy_binding); free(dummy_binding);