Fix heap-use-after-free in wlr_send_tablet_v2_tablet_pad_leave
See swaywm/sway#4660
@@ -171,6 +171,9 @@ void destroy_tablet_pad_v2(struct wl_resource *resource) {
}
free(pad->strips);
+ if (pad->pad->current_client == pad) {
+ pad->pad->current_client = NULL;
+ }
free(pad);
wl_resource_set_user_data(resource, NULL);
}
