Wayland: touch events, use of memory after it is freed

libsdl-org · Oct 30, 2019 · 88ba679 · 88ba679
1 parent 86ae245
commit 88ba679
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/src/video/wayland/SDL_waylandevents.c b/src/video/wayland/SDL_waylandevents.c
@@ -151,10 +151,14 @@ touch_del(SDL_TouchID id, float* x, float* y, struct wl_surface **surface)
                 touch_points.tail = tp->prev;
             }
 
-            SDL_free(tp);
+            {
+                struct SDL_WaylandTouchPoint *next = tp->next;
+                SDL_free(tp);
+                tp = next;
+            }
+        } else {
+            tp = tp->next;
         }
-
-        tp = tp->next;
     }
 }