From de15ca228206025b712759e180661042689343ec Mon Sep 17 00:00:00 2001 From: lkn Date: Wed, 24 Jun 2026 21:59:53 +0200 Subject: [PATCH] =?UTF-8?q?wayland:=20fix=20heap=20corruption=20=E2=80=94?= =?UTF-8?q?=20update=20backing=20table=20after=20frame=20resize?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wl_frame_configure and wl_window_resize reallocate fb->image (unref old pixman image, create new one) but never updated the WINGs backing table. W_GetViewBacking() continued returning the freed pointer. Any subsequent draw into that backing (e.g. WMDrawString for titlebar text) wrote into freed memory, corrupting the heap. The corruption manifested as SIGSEGV/SIGABRT at the next malloc or free — in fontconfig, Mesa, RReleaseImage, etc. depending on timing. Fix: call W_RegisterBacking(fb->id, fb->image) after reallocation in both resize paths. --- src/backend/wayland/wl_framebuf.c | 1 + src/backend/wayland/wl_window.c | 1 + 2 files changed, 2 insertions(+) diff --git a/src/backend/wayland/wl_framebuf.c b/src/backend/wayland/wl_framebuf.c index 3dd8945..2a8cd16 100644 --- a/src/backend/wayland/wl_framebuf.c +++ b/src/backend/wayland/wl_framebuf.c @@ -554,6 +554,7 @@ wl_frame_configure(WNativeWindow win, int x, int y, int width, int height) fb->height = height; fb->base.width = width; fb->base.height = height; + W_RegisterBacking(fb->id, fb->image); if (fb->scene_buf) wlr_scene_buffer_set_dest_size(fb->scene_buf, width, height); } diff --git a/src/backend/wayland/wl_window.c b/src/backend/wayland/wl_window.c index a34f386..cf2b353 100644 --- a/src/backend/wayland/wl_window.c +++ b/src/backend/wayland/wl_window.c @@ -285,6 +285,7 @@ void wl_window_resize(WNativeWindow win, int w, int h) fb->height = h; fb->base.width = w; fb->base.height = h; + W_RegisterBacking(fb->id, fb->image); if (fb->scene_buf) wlr_scene_buffer_set_dest_size(fb->scene_buf, w, h); }