diff options
| author | bruvzg <7645683+bruvzg@users.noreply.github.com> | 2020-08-25 13:50:41 +0300 |
|---|---|---|
| committer | bruvzg <7645683+bruvzg@users.noreply.github.com> | 2020-08-25 14:04:20 +0300 |
| commit | 9a85948907443f6e3893d5f2f75f8bda3f213b42 (patch) | |
| tree | 1fc1cdd85724b7579589e501fe2cd080f999e41a | |
| parent | dd58f4da66dab7b86d5919b6e1dc951dc0ad04c7 (diff) | |
[macOS] Fix heap use-after-free in DisplayServer.
| -rw-r--r-- | platform/osx/display_server_osx.mm | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/platform/osx/display_server_osx.mm b/platform/osx/display_server_osx.mm index dfb1783a2c..1676e0d425 100644 --- a/platform/osx/display_server_osx.mm +++ b/platform/osx/display_server_osx.mm @@ -311,8 +311,6 @@ static NSCursor *_cursorFromSelector(SEL selector, SEL fallback = nil) { DS_OSX->window_set_transient(wd.transient_children.front()->get(), DisplayServerOSX::INVALID_WINDOW_ID); } - DS_OSX->windows.erase(window_id); - if (wd.transient_parent != DisplayServerOSX::INVALID_WINDOW_ID) { DisplayServerOSX::WindowData &pwd = DS_OSX->windows[wd.transient_parent]; [pwd.window_object makeKeyAndOrderFront:nil]; // Move focus back to parent. @@ -332,6 +330,8 @@ static NSCursor *_cursorFromSelector(SEL selector, SEL fallback = nil) { DS_OSX->context_vulkan->window_destroy(window_id); } #endif + + DS_OSX->windows.erase(window_id); } - (void)windowDidEnterFullScreen:(NSNotification *)notification { @@ -3803,9 +3803,11 @@ DisplayServerOSX::~DisplayServerOSX() { } //destroy all windows - for (Map<WindowID, WindowData>::Element *E = windows.front(); E; E = E->next()) { - [E->get().window_object setContentView:nil]; - [E->get().window_object close]; + for (Map<WindowID, WindowData>::Element *E = windows.front(); E;) { + Map<WindowID, WindowData>::Element *F = E; + E = E->next(); + [F->get().window_object setContentView:nil]; + [F->get().window_object close]; } //destroy drivers |