lkn
/
windowmaker-wl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

WINGs/wayland: clamp pixman composite to actual backing image size 

During W_RealizeView the WME_EXPOSE handler can trigger child resizes
that make view->size exceed the backing image dimensions. Clamp the
composite width/height to the source image actual size to prevent
out-of-bounds reads in pixman_image_composite32.
This commit is contained in:
Window Maker 2026-05-25 13:12:17 +02:00
parent 9c83db6977
commit 53b0b65b3b
2 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
WINGs/wview_wl.c
View File

@ -479,10 +479,14 @@ static void wl_redisplay(void *vctx, W_View *view)
pixman_image_t *src = (pixman_image_t *)W_GetViewBacking(view->window);
pixman_image_t *dst = (pixman_image_t *)W_GetViewBacking(view->parent->window);
if (src && dst) {
pixman_image_composite32(PIXMAN_OP_OVER, src, NULL, dst,
0, 0, 0, 0,
view->pos.x, view->pos.y,
view->size.width, view->size.height);
int sw = pixman_image_get_width(src);
int sh = pixman_image_get_height(src);
int cw = sw < (int)view->size.width ? sw : (int)view->size.width;
int ch = sh < (int)view->size.height ? sh : (int)view->size.height;
if (cw > 0 && ch > 0)
pixman_image_composite32(PIXMAN_OP_OVER, src, NULL, dst,
0, 0, 0, 0,
view->pos.x, view->pos.y, cw, ch);
}
}

5
wprefs.log
View File

@ -1,4 +1,6 @@
== WPrefs CRASH ===
WPrefs(registry_handle_global(wclient_wl.c:1130)): warning: wclient_wl: bound wmaker_popup_manager_v1
=== WPrefs CRASH ===
signal 11
WPrefs(+0xe13a) [0x55555556213a]
/usr/lib64/libc.so.6(+0x3d520) [0x7ffff732e520]
@ -26,3 +28,4 @@ WPrefs(+0xdf36) [0x555555561f36]
/usr/lib64/libc.so.6(+0x273fb) [0x7ffff73183fb]
/usr/lib64/libc.so.6(__libc_start_main+0x8b) [0x7ffff73184ab]
WPrefs(+0xe015) [0x555555562015]
;