|
 |
84ed0d0 |
From 6711b5c6fdf0581c77150306fff909d7bc63b8a4 Mon Sep 17 00:00:00 2001
|
|
|
84ed0d0 |
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
|
84ed0d0 |
Date: Thu, 9 May 2019 10:36:19 +0200
|
|
|
84ed0d0 |
Subject: [PATCH xserver] xwayland: Avoid a crash on pointer enter with a grab
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
On pointer enter notification, Xwayland checks for an existing pointer
|
|
|
84ed0d0 |
warp with a `NULL` sprite.
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
In turn, `xwl_pointer_warp_emulator_maybe_lock()` checks for an existing
|
|
|
84ed0d0 |
grab and the destination window using `XYToWindow()` which does not
|
|
|
84ed0d0 |
check for the actual sprite not being `NULL`.
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
So, in some cases, when the pointer enters the surface and there is an
|
|
|
84ed0d0 |
existing X11 grab which is not an ownerEvents grab, Xwayland would crash
|
|
|
84ed0d0 |
trying to dereference the `NULL` sprite pointer:
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
#0 __GI_raise ()
|
|
|
84ed0d0 |
#1 __GI_abort () at abort.c:79
|
|
|
84ed0d0 |
#2 OsAbort () at utils.c:1351
|
|
|
84ed0d0 |
#3 AbortServer () at log.c:879
|
|
|
84ed0d0 |
#4 FatalError () at log.c:1017
|
|
|
84ed0d0 |
#5 OsSigHandler () at osinit.c:156
|
|
|
84ed0d0 |
#6 OsSigHandler () at osinit.c:110
|
|
|
84ed0d0 |
#7 <signal handler called>
|
|
|
84ed0d0 |
#8 XYToWindow (pSprite=0x0, x=0, y=0) at events.c:2880
|
|
|
84ed0d0 |
#9 xwl_pointer_warp_emulator_maybe_lock () at xwayland-input.c:2673
|
|
|
84ed0d0 |
#10 pointer_handle_enter () at xwayland-input.c:434
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
Avoid the crash by simply checking for the sprite being not `NULL` in
|
|
|
84ed0d0 |
`xwl_pointer_warp_emulator_maybe_lock()`
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
|
84ed0d0 |
Bugzilla: https://bugzilla.redhat.com/1708119
|
|
|
84ed0d0 |
(cherry picked from commit 0a07446318f248b65fcbc8ab8a73ead51153f09e)
|
|
|
84ed0d0 |
---
|
|
|
84ed0d0 |
hw/xwayland/xwayland-input.c | 1 +
|
|
|
84ed0d0 |
1 file changed, 1 insertion(+)
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
diff --git a/hw/xwayland/xwayland-input.c b/hw/xwayland/xwayland-input.c
|
|
|
84ed0d0 |
index fbbcb39cc..fa46ac3e7 100644
|
|
|
84ed0d0 |
--- a/hw/xwayland/xwayland-input.c
|
|
|
84ed0d0 |
+++ b/hw/xwayland/xwayland-input.c
|
|
|
84ed0d0 |
@@ -2667,6 +2667,7 @@ xwl_pointer_warp_emulator_maybe_lock(struct xwl_pointer_warp_emulator *warp_emul
|
|
|
84ed0d0 |
*/
|
|
|
84ed0d0 |
if (pointer_grab &&
|
|
|
84ed0d0 |
!pointer_grab->ownerEvents &&
|
|
|
84ed0d0 |
+ sprite &&
|
|
|
84ed0d0 |
XYToWindow(sprite, x, y) != xwl_seat->focus_window->window)
|
|
|
84ed0d0 |
return;
|
|
|
84ed0d0 |
|
|
|
84ed0d0 |
--
|
|
|
84ed0d0 |
2.21.0
|
|
|
84ed0d0 |
|