xwayland: Protect against crash on x11->wayland transfer cancellation

If the transfer is cancelled, the X11SelectionData will be cleared from
the MetaSelectionBridge, although x11_data_write_cb() was invariably
expecting it to be non-NULL.

If the write was cancelled, all the actions done in x11_data_write_cb()
are moot, so just return early. If there's other errors happening
(eg. "connection closed" if the target client happens to crash), we
should still attempt at clearing the data anyway.

https://bugzilla.gnome.org/show_bug.cgi?id=754357

1 files changed, 17 insertions, 11 deletions

diff --git a/src/wayland/meta-xwayland-selection.c b/src/wayland/meta-xwayland-selection.c
index 3a97a40b8..081a24439 100644
--- a/src/wayland/meta-xwayland-selection.c
+++ b/src/wayland/meta-xwayland-selection.c
@@ -410,27 +410,33 @@ x11_data_write_cb (GObject      *object,
   MetaSelectionBridge *selection = user_data;
   X11SelectionData *data = selection->x11_selection;
   GError *error = NULL;
+  gboolean success = TRUE;
 
   g_output_stream_write_finish (G_OUTPUT_STREAM (object), res, &error);
 
-  if (data->incr)
+  if (error)
+    {
+      if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+        {
+          g_error_free (error);
+          return;
+        }
+
+      g_warning ("Error writing from X11 selection: %s\n", error->message);
+      g_error_free (error);
+      success = FALSE;
+    }
+
+  if (success && data->incr)
     {
       Display *xdisplay = GDK_DISPLAY_XDISPLAY (gdk_display_get_default ());
       XDeleteProperty (xdisplay, selection->window,
                        gdk_x11_get_xatom_by_name ("_META_SELECTION"));
     }
-
-  if (error)
+  else
     {
-      if (error->domain != G_IO_ERROR ||
-          error->code != G_IO_ERROR_CANCELLED)
-        g_warning ("Error writing from X11 selection: %s\n", error->message);
-
-      g_error_free (error);
+      x11_selection_data_finish (selection, success);
     }
-
-  if (!data->incr)
-    x11_selection_data_finish (selection, TRUE);
 }
 
 static void