From 4a6c5330a39ad242d0f17e1498c60a8f08e40f8a Mon Sep 17 00:00:00 2001
From: Window Maker <wmaker@localhost>
Date: Mon, 25 May 2026 13:12:58 +0200
Subject: [PATCH] WINGs/wayland: also clip composite to destination bounds and
 check data

The previous source-only clamp was insufficient. Also check that both
src and dst have non-NULL pixel data, and clip the composite region to
the destination image dimensions to prevent out-of-bounds writes.
---
 WINGs/wview_wl.c |  9 +++++++--
 wprefs.log       | 35 ++++++++++++++++-------------------
 2 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/WINGs/wview_wl.c b/WINGs/wview_wl.c
index d2bb49f..52c1242 100644
--- a/WINGs/wview_wl.c
+++ b/WINGs/wview_wl.c
@@ -478,12 +478,17 @@ static void wl_redisplay(void *vctx, W_View *view)
 	if (view->parent && view->size.width > 0 && view->size.height > 0) {
 		pixman_image_t *src = (pixman_image_t *)W_GetViewBacking(view->window);
 		pixman_image_t *dst = (pixman_image_t *)W_GetViewBacking(view->parent->window);
-		if (src && dst) {
+		if (src && dst && pixman_image_get_data(src) && pixman_image_get_data(dst)) {
 			int sw = pixman_image_get_width(src);
 			int sh = pixman_image_get_height(src);
+			int dw = pixman_image_get_width(dst);
+			int dh = pixman_image_get_height(dst);
 			int cw = sw < (int)view->size.width ? sw : (int)view->size.width;
 			int ch = sh < (int)view->size.height ? sh : (int)view->size.height;
-			if (cw > 0 && ch > 0)
+			/* Clip to destination bounds */
+			if (view->pos.x + cw > dw) cw = dw - view->pos.x;
+			if (view->pos.y + ch > dh) ch = dh - view->pos.y;
+			if (cw > 0 && ch > 0 && view->pos.x >= 0 && view->pos.y >= 0)
 				pixman_image_composite32(PIXMAN_OP_OVER, src, NULL, dst,
 					0, 0, 0, 0,
 					view->pos.x, view->pos.y, cw, ch);
diff --git a/wprefs.log b/wprefs.log
index f45ee5e..e2edb67 100644
--- a/wprefs.log
+++ b/wprefs.log
@@ -1,31 +1,28 @@
-WPrefs(registry_handle_global(wclient_wl.c:1130)): warning: wclient_wl: bound wmaker_popup_manager_v1
-
 === WPrefs CRASH ===
 signal 11
 WPrefs(+0xe13a) [0x55555556213a]
 /usr/lib64/libc.so.6(+0x3d520) [0x7ffff732e520]
 /usr/lib64/libpixman-1.so.0(+0x4780d) [0x7ffff7a0380d]
 /usr/lib64/libpixman-1.so.0(pixman_image_composite32+0x41) [0x7ffff79c2a81]
-/usr/local/lib/libWINGs.so.3(+0x34804) [0x7ffff7f79804]
-/usr/local/lib/libWINGs.so.3(+0x2d22c) [0x7ffff7f7222c]
-/usr/local/lib/libWINGs.so.3(+0x2d35d) [0x7ffff7f7235d]
-/usr/local/lib/libWINGs.so.3(WMHandleEvent+0x132) [0x7ffff7f6ac52]
-/usr/local/lib/libWINGs.so.3(+0x45af6) [0x7ffff7f8aaf6]
-/usr/local/lib/libWINGs.so.3(+0x45b22) [0x7ffff7f8ab22]
-/usr/local/lib/libWINGs.so.3(+0x45b22) [0x7ffff7f8ab22]
-/usr/local/lib/libWINGs.so.3(+0x45b22) [0x7ffff7f8ab22]
-/usr/local/lib/libWINGs.so.3(+0x45b22) [0x7ffff7f8ab22]
-/usr/local/lib/libWINGs.so.3(+0x45b22) [0x7ffff7f8ab22]
-/usr/local/lib/libWINGs.so.3(W_MapView+0x36) [0x7ffff7f898e6]
-/usr/local/lib/libWINGs.so.3(W_RealizeView+0xd8) [0x7ffff7f899f8]
-/usr/local/lib/libWINGs.so.3(W_RealizeView+0x77) [0x7ffff7f89997]
-/usr/local/lib/libWINGs.so.3(W_RealizeView+0x77) [0x7ffff7f89997]
-/usr/local/lib/libWINGs.so.3(W_RealizeView+0x77) [0x7ffff7f89997]
+/usr/local/lib/libWINGs.so.3(+0x34844) [0x7ffff7f79844]
+/usr/local/lib/libWINGs.so.3(+0x2d26c) [0x7ffff7f7226c]
+/usr/local/lib/libWINGs.so.3(+0x2d39d) [0x7ffff7f7239d]
+/usr/local/lib/libWINGs.so.3(WMHandleEvent+0x132) [0x7ffff7f6ac92]
+/usr/local/lib/libWINGs.so.3(+0x45b36) [0x7ffff7f8ab36]
+/usr/local/lib/libWINGs.so.3(+0x45b61) [0x7ffff7f8ab61]
+/usr/local/lib/libWINGs.so.3(+0x45b61) [0x7ffff7f8ab61]
+/usr/local/lib/libWINGs.so.3(+0x45b61) [0x7ffff7f8ab61]
+/usr/local/lib/libWINGs.so.3(+0x45b61) [0x7ffff7f8ab61]
+/usr/local/lib/libWINGs.so.3(+0x45b61) [0x7ffff7f8ab61]
+/usr/local/lib/libWINGs.so.3(W_MapView+0x36) [0x7ffff7f89926]
+/usr/local/lib/libWINGs.so.3(W_RealizeView+0xd8) [0x7ffff7f89a38]
+/usr/local/lib/libWINGs.so.3(W_RealizeView+0x77) [0x7ffff7f899d7]
+/usr/local/lib/libWINGs.so.3(W_RealizeView+0x77) [0x7ffff7f899d7]
+/usr/local/lib/libWINGs.so.3(W_RealizeView+0x77) [0x7ffff7f899d7]
 WPrefs(+0x188c8) [0x55555556c8c8]
 WPrefs(+0xe2e6) [0x5555555622e6]
-/usr/local/lib/libWINGs.so.3(WMHandleEvent+0x132) [0x7ffff7f6ac52]
+/usr/local/lib/libWINGs.so.3(WMHandleEvent+0x132) [0x7ffff7f6ac92]
 WPrefs(+0xdf36) [0x555555561f36]
 /usr/lib64/libc.so.6(+0x273fb) [0x7ffff73183fb]
 /usr/lib64/libc.so.6(__libc_start_main+0x8b) [0x7ffff73184ab]
 WPrefs(+0xe015) [0x555555562015]
-;