From 91eba100f5d8ef300a58b16160d07de09925a01b Mon Sep 17 00:00:00 2001
From: Steve3184 <77789906+Steve3184@users.noreply.github.com>
Date: Sat, 28 Feb 2026 22:15:33 +0800
Subject: [PATCH] fix: UAF race between capturer clone and clear()

Signed-off-by: Steve3184 <77789906+Steve3184@users.noreply.github.com>
---
 src/server/video_service.rs | 3 ---
 src/server/wayland.rs       | 2 ++
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/server/video_service.rs b/src/server/video_service.rs
index eb9612dc5..ffe60551f 100644
--- a/src/server/video_service.rs
+++ b/src/server/video_service.rs
@@ -549,9 +549,6 @@ fn run(vs: VideoService) -> ResultType<()> {
     let mut c = get_capturer(vs.source, display_idx, last_portable_service_running)?;
     #[cfg(target_os = "linux")]
     let _wayland_call_on_ret = {
-        // Increment active display count when starting
-        let _display_count = super::wayland::increment_active_display_count();
-
         SimpleCallOnReturn {
             b: true,
             f: Box::new(|| {
diff --git a/src/server/wayland.rs b/src/server/wayland.rs
index bad5eef9d..d6e25c089 100644
--- a/src/server/wayland.rs
+++ b/src/server/wayland.rs
@@ -349,6 +349,7 @@ pub(super) fn get_capturer_for_display(
     {
         let cap_map = CAP_DISPLAY_INFO.read().unwrap();
         if let Some(&addr) = cap_map.get(&display_idx) {
+            increment_active_display_count();
             return build_capturer_info(addr);
         }
     }
@@ -383,6 +384,7 @@ pub(super) fn get_capturer_for_display(
             "get_capturer_for_display: re-initialization succeeded for display {}.",
             display_idx
         );
+        increment_active_display_count();
         build_capturer_info(addr)
     } else {
         bail!(