Skip to content

Conversation

@Katana-Steel
Copy link

rebased on upstream xfwm4 master
and then updated wlroots to 0.17

adlocode and others added 5 commits October 3, 2024 13:35
This adds a --wayland option to request that xfwm4 run as a Wayland
compositor, in preparation for Wayland support.
Add a Wayland compositor based on wlroots
adlocode pushed a commit that referenced this pull request Jul 8, 2025
Longs must be used instead of ints when calling XChangeProperty
with a format=32 parameter.

This commit fixes the following overflow detected by ASan:

ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7baddb87a3a8
READ of size 8 at 0x7baddb87a3a8 thread T0
    #0 0x7bade030095c in _XData32 libx11/src/XlibInt.c:1684
    #1 0x7bade01e0e53 in XChangeProperty libx11/src/ChProp.c:83
    #2 0x58f754bce6a8 in setWMState xfwm4/src/hints.c:91
    #3 0x58f754b48c84 in clientShowSingle xfwm4/src/client.c:2403
    #4 0x58f754b48c84 in clientShow xfwm4/src/client.c:2429
    #5 0x58f754bbcf3b in clientFocusNew xfwm4/src/focus.c:249
    #6 0x58f754b61a38 in clientFrame xfwm4/src/client.c:2017
    #7 0x58f754bb17c4 in handleMapRequest xfwm4/src/events.c:1171
    #8 0x58f754bb17c4 in handleEvent xfwm4/src/events.c:2221
    #9 0x58f754bb17c4 in xfwm4_event_filter xfwm4/src/events.c:2302
    #10 0x58f754ba422a in eventXfwmFilter xfwm4/src/event_filter.c:175
    #11 0x7bade6d5d337 in gdk_event_apply_filters gdk/x11/gdkeventsource.c:79
    #12 0x7bade6d5dc84 in gdk_event_source_translate_event gdk/x11/gdkeventsource.c:198
    #13 0x7bade6d5dc84 in _gdk_x11_display_queue_events gdk/x11/gdkeventsource.c:341
    #14 0x7bade6c9c1fc in gdk_display_get_event gdk/gdkdisplay.c:442
    #15 0x7bade6d5d492 in gdk_event_source_dispatch gdk/x11/gdkeventsource.c:363
    #16 0x7bade128ed06 in g_main_dispatch glib/gmain.c:3357
    #17 0x7bade128ed06 in g_main_context_dispatch_unlocked glib/gmain.c:4208
    #18 0x7bade129ba5a in g_main_context_iterate_unlocked glib/gmain.c:4273
    #19 0x7bade129d1be in g_main_loop_run glib/gmain.c:4475
    #20 0x7bade75f7bd6 in gtk_main gtk/gtkmain.c:1329
    #21 0x58f754be21a2 in main xfwm4/src/main.c:721

Address 0x7baddb87a3a8 is located in stack of thread T0 at offset 40 in frame
    #0 0x58f754bce568 in setWMState xfwm4/src/hints.c:83

  This frame has 1 object(s):
    [32, 40) 'data' (line 84) <== Memory access at offset 40 overflows this variable
adlocode pushed a commit that referenced this pull request Jul 8, 2025
The terminate dialog can outlive its associated client when
programs are slowed down by Valgrind or ASan instrumentation.

ERROR: AddressSanitizer: heap-use-after-free
READ of size 4 at 0x7da1c2beeecc thread T0
    #0 0x5604a1e05f78 in terminateCloseDialog xfwm4/src/terminate.c:42:12
    #1 0x5604a1e06a94 in terminateProcessIO xfwm4/src/terminate.c:91:5
    #2 0x7fe1ca8ed2f6 in g_io_unix_dispatch glib/glib/giounix.c:170:10
[...snip...]

0x7da1c2beeecc is located 1612 bytes inside of 1696-byte region
freed by thread T0 here:
    #0 0x7fe1cab7205d in free
    #1 0x7fe1ca798968 in g_free glib/glib/gmem.c:208:3
    #2 0x5604a1cafd90 in clientFree xfwm4/src/client.c:1389:5
    #3 0x5604a1cafd90 in clientUnframe xfwm4/src/client.c:2151:5
    #4 0x5604a1d2ae96 in handleUnmapNotify xfwm4/src/events.c
    #5 0x5604a1d1fc2c in handleEvent xfwm4/src/events.c:2218:30
    #6 0x5604a1d1e929 in xfwm4_event_filter xfwm4/src/events.c:2302:14
    #7 0x5604a1d1e6e7 in eventXfwmFilter xfwm4/src/event_filter.c:175:16
[...snip...]

previously allocated by thread T0 here:
    #0 0x7fe1cab7335d in calloc
    #1 0x7fe1ca7988ba in g_malloc0 glib/glib/gmem.c:133:13
    #2 0x5604a1ca5a92 in clientFrame xfwm4/src/client.c:1674:9
    #3 0x5604a1d2b743 in handleMapRequest xfwm4/src/events.c:1171:9
    #4 0x5604a1d1fbb2 in handleEvent xfwm4/src/events.c:2221:30
    #5 0x5604a1d1e929 in xfwm4_event_filter xfwm4/src/events.c:2302:14
    #6 0x5604a1d1e6e7 in eventXfwmFilter xfwm4/src/event_filter.c:175:16
[...snip...]

Closes #822
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants