semfault/dwl
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

check null in toplevel_from_popup

Browse source 
managed to SEGFAULT the server by trying to create a popup
without setting a parent first.

Not sure if this is dwl or wlroots issue, so also opened a ticket upstream: https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/3811
This commit is contained in:
shua 2022-11-09 01:01:50 -05:00 committed by GitHub
parent 8bd3442575
commit f1639ba9d5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
client.h
View file

@ -304,7 +304,9 @@ toplevel_from_popup(struct wlr_xdg_popup *popup)
while (1) { while (1) {
switch (surface->role) { switch (surface->role) {
case WLR_XDG_SURFACE_ROLE_POPUP: case WLR_XDG_SURFACE_ROLE_POPUP:
if (wlr_surface_is_layer_surface(surface->popup->parent)) if (!surface->popup->parent)
return NULL;
else if (wlr_surface_is_layer_surface(surface->popup->parent))
return wlr_layer_surface_v1_from_wlr_surface(surface->popup->parent)->data; return wlr_layer_surface_v1_from_wlr_surface(surface->popup->parent)->data;
else if (!wlr_surface_is_xdg_surface(surface->popup->parent)) else if (!wlr_surface_is_xdg_surface(surface->popup->parent))
return NULL; return NULL;

2
dwl.c
View file

@ -1016,6 +1016,8 @@ createnotify(struct wl_listener *listener, void *data)
if (xdg_surface->role == WLR_XDG_SURFACE_ROLE_POPUP) { if (xdg_surface->role == WLR_XDG_SURFACE_ROLE_POPUP) {
struct wlr_box box; struct wlr_box box;
LayerSurface *l = toplevel_from_popup(xdg_surface->popup); LayerSurface *l = toplevel_from_popup(xdg_surface->popup);
if (!xdg_surface->popup->parent)
return;
xdg_surface->surface->data = wlr_scene_xdg_surface_create( xdg_surface->surface->data = wlr_scene_xdg_surface_create(
xdg_surface->popup->parent->data, xdg_surface); xdg_surface->popup->parent->data, xdg_surface);
/* Probably the check of `l` is useless, the only thing that can be NULL /* Probably the check of `l` is useless, the only thing that can be NULL