From 13f98475a2a8068d9b3ce3a50fa93ebd46ac1738 Mon Sep 17 00:00:00 2001
From: "Charles Le (cle-air-m3)" <cle@clrb.net>
Date: Tue, 9 Jun 2026 23:32:33 -0700
Subject: [PATCH] fix: remove ClipboardSending handler in proxy destructors
 (UAF)

fixes: #9842
---
 src/lib/client/ServerProxy.cpp    | 1 +
 src/lib/server/ClientProxy1_6.cpp | 5 +++++
 src/lib/server/ClientProxy1_6.h   | 2 +-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/lib/client/ServerProxy.cpp b/src/lib/client/ServerProxy.cpp
index cd7cf5183..8fc69a88c 100644
--- a/src/lib/client/ServerProxy.cpp
+++ b/src/lib/client/ServerProxy.cpp
@@ -55,6 +55,7 @@ ServerProxy::~ServerProxy()
 {
   setKeepAliveRate(-1.0);
   m_events->removeHandler(EventTypes::StreamInputReady, m_stream->getEventTarget());
+  m_events->removeHandler(EventTypes::ClipboardSending, this);
 }
 
 void ServerProxy::resetKeepAliveAlarm()
diff --git a/src/lib/server/ClientProxy1_6.cpp b/src/lib/server/ClientProxy1_6.cpp
index 675e11709..4334729d4 100644
--- a/src/lib/server/ClientProxy1_6.cpp
+++ b/src/lib/server/ClientProxy1_6.cpp
@@ -26,6 +26,11 @@ ClientProxy1_6::ClientProxy1_6(const std::string &name, deskflow::IStream *strea
   });
 }
 
+ClientProxy1_6::~ClientProxy1_6()
+{
+  m_events->removeHandler(EventTypes::ClipboardSending, this);
+}
+
 void ClientProxy1_6::setClipboard(ClipboardID id, const IClipboard *clipboard)
 {
   // ignore if this clipboard is already clean
diff --git a/src/lib/server/ClientProxy1_6.h b/src/lib/server/ClientProxy1_6.h
index 87280edaa..d66f0c5cf 100644
--- a/src/lib/server/ClientProxy1_6.h
+++ b/src/lib/server/ClientProxy1_6.h
@@ -16,7 +16,7 @@ class ClientProxy1_6 : public ClientProxy1_5
 {
 public:
   ClientProxy1_6(const std::string &name, deskflow::IStream *adoptedStream, Server *server, IEventQueue *events);
-  ~ClientProxy1_6() override = default;
+  ~ClientProxy1_6() override;
 
   void setClipboard(ClipboardID id, const IClipboard *clipboard) override;
   bool recvClipboard() override;