From 53b0b65b3b197db61cb78fb19d87f9a41c92f19d Mon Sep 17 00:00:00 2001 From: Window Maker Date: Mon, 25 May 2026 13:12:17 +0200 Subject: [PATCH] WINGs/wayland: clamp pixman composite to actual backing image size During W_RealizeView the WME_EXPOSE handler can trigger child resizes that make view->size exceed the backing image dimensions. Clamp the composite width/height to the source image actual size to prevent out-of-bounds reads in pixman_image_composite32. --- WINGs/wview_wl.c | 12 ++++++++---- wprefs.log | 5 ++++- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/WINGs/wview_wl.c b/WINGs/wview_wl.c index 80afb2f..d2bb49f 100644 --- a/WINGs/wview_wl.c +++ b/WINGs/wview_wl.c @@ -479,10 +479,14 @@ static void wl_redisplay(void *vctx, W_View *view) pixman_image_t *src = (pixman_image_t *)W_GetViewBacking(view->window); pixman_image_t *dst = (pixman_image_t *)W_GetViewBacking(view->parent->window); if (src && dst) { - pixman_image_composite32(PIXMAN_OP_OVER, src, NULL, dst, - 0, 0, 0, 0, - view->pos.x, view->pos.y, - view->size.width, view->size.height); + int sw = pixman_image_get_width(src); + int sh = pixman_image_get_height(src); + int cw = sw < (int)view->size.width ? sw : (int)view->size.width; + int ch = sh < (int)view->size.height ? sh : (int)view->size.height; + if (cw > 0 && ch > 0) + pixman_image_composite32(PIXMAN_OP_OVER, src, NULL, dst, + 0, 0, 0, 0, + view->pos.x, view->pos.y, cw, ch); } } diff --git a/wprefs.log b/wprefs.log index 97ff2be..f45ee5e 100644 --- a/wprefs.log +++ b/wprefs.log @@ -1,4 +1,6 @@ -== WPrefs CRASH === +WPrefs(registry_handle_global(wclient_wl.c:1130)): warning: wclient_wl: bound wmaker_popup_manager_v1 + +=== WPrefs CRASH === signal 11 WPrefs(+0xe13a) [0x55555556213a] /usr/lib64/libc.so.6(+0x3d520) [0x7ffff732e520] @@ -26,3 +28,4 @@ WPrefs(+0xdf36) [0x555555561f36] /usr/lib64/libc.so.6(+0x273fb) [0x7ffff73183fb] /usr/lib64/libc.so.6(__libc_start_main+0x8b) [0x7ffff73184ab] WPrefs(+0xe015) [0x555555562015] +;