lkn
/
windowmaker-wl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix crash: heap corruption from unsafe titlebar buffer resize 

wl_frame_paint replaced the titlebar pixman image while the scene
graph could still hold a wlr_buffer reference to the old data.
Falling back to the parent frame buffer when the titlebar is too
narrow avoids the use-after-free.
This commit is contained in:
lkn 2026-06-23 20:23:24 +02:00
parent 146f41008d
commit 503cdb5dca
1 changed files with 5 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/backend/wayland/wl_framebuf.c
View File

@ -578,19 +578,12 @@ wl_frame_paint(struct WFrameWindow *fwin)
wlr_scene_node_set_position(&tb_fb->scene_buf->node, 0, 0);
}
/* Ensure titlebar buffer is full width */
/* If titlebar buffer is too narrow, draw into parent frame instead
* to avoid replacing the pixman image while the scene graph may still
* hold a reference to the old wlr_buffer data. */
if (tb_fb && tb_fb->width < tb_w) {
pixman_image_unref(tb_fb->image);
tb_fb->image = pixman_image_create_bits(PIXMAN_a8r8g8b8,
tb_w, tb_h, NULL, 0);
tb_fb->width = tb_w;
tb_fb->height = tb_h;
tb_fb->base.width = tb_w;
tb_fb->base.height = tb_h;
tb_img = tb_fb->image;
/* Notify scene graph so hit-testing covers the new size. */
if (tb_fb->scene_buf)
wlr_scene_buffer_set_dest_size(tb_fb->scene_buf, tb_w, tb_h);
tb_img = fb->image;
tb_fb = NULL;
}
WTexture *tex = fwin->title_texture[state];