quickshell/quickshell
1
1
Fork 2
Code Issues Wiki Activity

wayland/screencopy: fix UAF in dmabuf modifier collection

Browse source 
The QList optimization the code was for no longer exists.
This commit is contained in:
outfoxxed 2025-01-15 03:24:19 -08:00
parent ca79715cce
commit d195ca7680
Signed by: outfoxxed
GPG key ID: 4C88A185FB89301E
1 changed files with 0 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/wayland/buffer/dmabuf.cpp
View file

@ -167,7 +167,6 @@ void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_tranche_formats(wl_array*
auto indexTableLength = indices->size / sizeof(uint16_t); auto indexTableLength = indices->size / sizeof(uint16_t);
uint32_t lastFormat = 0; uint32_t lastFormat = 0;
LinuxDmabufModifiers* lastModifiers = nullptr;
LinuxDmabufModifiers* modifiers = nullptr; LinuxDmabufModifiers* modifiers = nullptr;
for (uint16_t ti = 0; ti != indexTableLength; ++ti) { for (uint16_t ti = 0; ti != indexTableLength; ++ti) {
@ -176,14 +175,7 @@ void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_tranche_formats(wl_array*
// Compositors usually send a single format's modifiers as a block. // Compositors usually send a single format's modifiers as a block.
if (!modifiers || entry.format != lastFormat) { if (!modifiers || entry.format != lastFormat) {
// We can often share modifier lists between formats
if (lastModifiers && modifiers->modifiers == lastModifiers->modifiers) {
// avoids storing a second list
modifiers->modifiers = lastModifiers->modifiers;
}
lastFormat = entry.format; lastFormat = entry.format;
lastModifiers = modifiers;
auto modifiersIter = std::ranges::find_if(tranche.formats.formats, [&](const auto& pair) { auto modifiersIter = std::ranges::find_if(tranche.formats.formats, [&](const auto& pair) {
return pair.first == entry.format; return pair.first == entry.format;
@ -203,10 +195,6 @@ void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_tranche_formats(wl_array*
modifiers->modifiers.push(entry.modifier); modifiers->modifiers.push(entry.modifier);
} }
} }
if (lastModifiers && modifiers && modifiers->modifiers == lastModifiers->modifiers) {
modifiers->modifiers = lastModifiers->modifiers;
}
} }
void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_tranche_done() { void LinuxDmabufFeedback::zwp_linux_dmabuf_feedback_v1_tranche_done() {