mirror of
https://github.com/X11Libre/xserver.git
synced 2026-04-05 15:32:49 +00:00
During a VT-Switch a raw pointer to the shared cursor object is saved which is then freed (in case of low refcount) by a call to xf86CursorSetCursor with argument pCurs = NullCursor. This leads to a dangling pointer which can follow in a use after free. This fix ensures that there is a shared handle saved for the VT-Switch cycle. Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>