BramReuling/SDL
1
0
Fork 0
mirror of https://github.com/libsdl-org/SDL.git synced 2026-06-06 06:34:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

kmsdrm: Fix order of GBM and EGL teardown

Browse source 
All locked front buffers must be released prior to destroying
the EGL surface to avoid causing a UAF in libnvidia-egl-gbm.so.
This commit is contained in:
Cameron Gutman 2026-04-10 19:26:43 -05:00
parent 88017f5023
commit 9cc2f248f5
1 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/video/kmsdrm/SDL_kmsdrmvideo.c
View file

@ -1113,17 +1113,6 @@ static void KMSDRM_DestroySurfaces(_THIS, SDL_Window *window)
SDL_LogError(SDL_LOG_CATEGORY_VIDEO, "Could not restore CRTC");
}
/***************************/
/* Destroy the EGL surface */
/***************************/
SDL_EGL_MakeCurrent(_this, EGL_NO_SURFACE, EGL_NO_CONTEXT);
if (windata->egl_surface != EGL_NO_SURFACE) {
SDL_EGL_DestroySurface(_this, windata->egl_surface);
windata->egl_surface = EGL_NO_SURFACE;
}
/***************************/
/* Destroy the GBM buffers */
/***************************/
@ -1138,6 +1127,17 @@ static void KMSDRM_DestroySurfaces(_THIS, SDL_Window *window)
windata->next_bo = NULL;
}
/***************************/
/* Destroy the EGL surface */
/***************************/
SDL_EGL_MakeCurrent(_this, EGL_NO_SURFACE, EGL_NO_CONTEXT);
if (windata->egl_surface != EGL_NO_SURFACE) {
SDL_EGL_DestroySurface(_this, windata->egl_surface);
windata->egl_surface = EGL_NO_SURFACE;
}
/***************************/
/* Destroy the GBM surface */
/***************************/