aboutsummaryrefslogtreecommitdiffstats
path: root/sway/tree/container.c
diff options
context:
space:
mode:
authorLibravatar Brian Ashworth <bosrsf04@gmail.com>2020-02-10 20:52:34 -0500
committerLibravatar Simon Ser <contact@emersion.fr>2020-02-11 10:09:37 +0100
commit0b709702c134fcba2b8210ac6f85b8b2665484d0 (patch)
tree39122568182a85d9513a4f189c760db0356e0ea7 /sway/tree/container.c
parentinput: Map virtual-pointer to the requested output (diff)
downloadsway-0b709702c134fcba2b8210ac6f85b8b2665484d0.tar.gz
sway-0b709702c134fcba2b8210ac6f85b8b2665484d0.tar.zst
sway-0b709702c134fcba2b8210ac6f85b8b2665484d0.zip
container_at_{tabbed,stacked}: check x-axis bounds
The container_at_tabbed and container_at_stacked container were checking the bounds along the y-axis, but not the x-axis. This made it possible to cause a segfault for specific resolution, horizontal gap, and workspace children lengths. The issue is that child_index was -1 and was resulting in a buffer underflow. Adding the x-axis bound checks for early returns should prevent this from happening.
Diffstat (limited to 'sway/tree/container.c')
-rw-r--r--sway/tree/container.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/sway/tree/container.c b/sway/tree/container.c
index 56cdee1d..afb0f927 100644
--- a/sway/tree/container.c
+++ b/sway/tree/container.c
@@ -208,7 +208,8 @@ static struct sway_container *container_at_tabbed(struct sway_node *parent,
208 struct wlr_surface **surface, double *sx, double *sy) { 208 struct wlr_surface **surface, double *sx, double *sy) {
209 struct wlr_box box; 209 struct wlr_box box;
210 node_get_box(parent, &box); 210 node_get_box(parent, &box);
211 if (ly < box.y || ly > box.y + box.height) { 211 if (lx < box.x || lx > box.x + box.width ||
212 ly < box.y || ly > box.y + box.height) {
212 return NULL; 213 return NULL;
213 } 214 }
214 struct sway_seat *seat = input_manager_current_seat(); 215 struct sway_seat *seat = input_manager_current_seat();
@@ -242,7 +243,8 @@ static struct sway_container *container_at_stacked(struct sway_node *parent,
242 struct wlr_surface **surface, double *sx, double *sy) { 243 struct wlr_surface **surface, double *sx, double *sy) {
243 struct wlr_box box; 244 struct wlr_box box;
244 node_get_box(parent, &box); 245 node_get_box(parent, &box);
245 if (ly < box.y || ly > box.y + box.height) { 246 if (lx < box.x || lx > box.x + box.width ||
247 ly < box.y || ly > box.y + box.height) {
246 return NULL; 248 return NULL;
247 } 249 }
248 struct sway_seat *seat = input_manager_current_seat(); 250 struct sway_seat *seat = input_manager_current_seat();