desktop: Allow desktop_api to handle surface removal

This patch fixes the situation where the application wasnt't allowed
to create an (ivi) surface, leading to an illegal access of the surface
by the destroyer desktop_api callback.

In case we deny the applications to create the (ivi) surface we let the
desktop_api handle the removal of the surface. A surface without a
role won't have an output set so we use that to determine if we can
remove the link for it. We also avoid dealing with the surface
destruction in the desktop api itself rather than handling it on the
error path of the hook itself.

Bug-AGL: SPEC-3413

Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Change-Id: I0fd4d83924b0188f606544b41e70b631c90fc8ee

diff --git a/src/desktop.c b/src/desktop.c
index 479174d..5b7b2e5 100644 (file)
--- a/src/desktop.c
+++ b/src/desktop.c
@@ -85,14 +85,14 @@ desktop_surface_added(struct weston_desktop_surface *dsurface, void *userdata)
        surface->role = IVI_SURFACE_ROLE_NONE;
        surface->activated_by_default = false;
 
+       weston_desktop_surface_set_user_data(dsurface, surface);
+
        if (ivi->policy && ivi->policy->api.surface_create &&
            !ivi->policy->api.surface_create(surface, ivi)) {
-               free(surface);
                wl_client_post_no_memory(client);
                return;
        }
 
-       weston_desktop_surface_set_user_data(dsurface, surface);
 
        app_id = weston_desktop_surface_get_app_id(dsurface);
 
@@ -209,7 +209,11 @@ skip_output_asignment:
        weston_log("Removed surface %p, app_id %s, role %s\n", surface,
                        weston_desktop_surface_get_app_id(dsurface),
                        ivi_layout_get_surface_role_name(surface));
-       wl_list_remove(&surface->link);
+
+       /* we weren't added to any list if we are still with 'none' as role */
+       if (surface->role != IVI_SURFACE_ROLE_NONE)
+               wl_list_remove(&surface->link);
+
        free(surface);
 }