From 6e18e1fe0d976195621b10c9b8b64ec948e332d6 Mon Sep 17 00:00:00 2001 From: Window Maker Date: Mon, 25 May 2026 13:22:41 +0200 Subject: [PATCH] WINGs/wayland: use backing image dimensions for fill_rectangles The fill_rectangles call used view->size which can exceed the backing image dimensions when a view is resized during realization without its backing being reallocated. This wrote past the allocated buffer, corrupting the heap and causing later pixman_image_composite32 crashes. Use pixman_image_get_width/height of the actual backing instead. --- WINGs/wview_wl.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/WINGs/wview_wl.c b/WINGs/wview_wl.c index 94fa761..9aea7e2 100644 --- a/WINGs/wview_wl.c +++ b/WINGs/wview_wl.c @@ -442,19 +442,20 @@ static void wl_redisplay(void *vctx, W_View *view) /* Fill background color */ pixman_image_t *backing = (pixman_image_t *)W_GetViewBacking(view->window); - if (backing && view->backColor) { + if (backing) { + int bw = pixman_image_get_width(backing); + int bh = pixman_image_get_height(backing); pixman_color_t bg; - bg.red = view->backColor->color.red; - bg.green = view->backColor->color.green; - bg.blue = view->backColor->color.blue; - bg.alpha = view->backColor->alpha ? view->backColor->alpha : 0xFFFF; + if (view->backColor) { + bg.red = view->backColor->color.red; + bg.green = view->backColor->color.green; + bg.blue = view->backColor->color.blue; + bg.alpha = view->backColor->alpha ? view->backColor->alpha : 0xFFFF; + } else { + bg = (pixman_color_t){0xAAAA, 0xAAAA, 0xAAAA, 0xFFFF}; + } pixman_image_fill_rectangles(PIXMAN_OP_SRC, backing, &bg, - 1, &(pixman_rectangle16_t){0, 0, view->size.width, view->size.height}); - } else if (backing) { - /* Default: light grey background */ - pixman_color_t bg = {0xAAAA, 0xAAAA, 0xAAAA, 0xFFFF}; - pixman_image_fill_rectangles(PIXMAN_OP_SRC, backing, &bg, - 1, &(pixman_rectangle16_t){0, 0, view->size.width, view->size.height}); + 1, &(pixman_rectangle16_t){0, 0, bw, bh}); } memset(&ev, 0, sizeof(ev));