Eric Anholt ea80b5db25 Fix a use-after-free of cursor data by refcounting for the sprite.current ...

reference. The particular path seen was XFixes' ReplaceCursor()
    resulting in the sprite.current being freed, but then it getting
    accessed during the ChangeToCursor() that happens as a result of
    WindowHasNewCursor().

2005-08-25 22:11:04 +00:00

123 KiB

Raw Blame History

View Raw