Fix invalid write to random memory

A wrong static_cast QWaylandSurface to a QWaylandCompositor led to
wl_display_next_serial() incrementing an arbitrary value.

Change-Id: I6ff92b8fd86fcef38fb10db2524dcf5aefae6d0a
Reviewed-by: Johan Helsing <johan.helsing@qt.io>

2 files changed, 4 insertions, 2 deletions

diff --git a/src/compositor/extensions/qwaylandwlshell.cpp b/src/compositor/extensions/qwaylandwlshell.cpp
index f3af4d15f..2fca88fef 100644
--- a/src/compositor/extensions/qwaylandwlshell.cpp
+++ b/src/compositor/extensions/qwaylandwlshell.cpp
@@ -316,7 +316,7 @@ void QWaylandWlShell::initialize()
 {
     Q_D(QWaylandWlShell);
     QWaylandShellTemplate::initialize();
-    QWaylandCompositor *compositor = static_cast<QWaylandCompositor *>(extensionContainer());
+    QWaylandCompositor *compositor = qobject_cast<QWaylandCompositor *>(extensionContainer());
     if (!compositor) {
         qWarning() << "Failed to find QWaylandCompositor when initializing QWaylandWlShell";
         return;
diff --git a/src/compositor/extensions/qwaylandxdgshellv5.cpp b/src/compositor/extensions/qwaylandxdgshellv5.cpp
index 07453ffe5..88d7a1b04 100644
--- a/src/compositor/extensions/qwaylandxdgshellv5.cpp
+++ b/src/compositor/extensions/qwaylandxdgshellv5.cpp
@@ -924,7 +924,9 @@ uint QWaylandXdgSurfaceV5::sendConfigure(const QSize &size, const QVector<uint>
 {
     Q_D(QWaylandXdgSurfaceV5);
     auto statesBytes = QByteArray::fromRawData((char *)states.data(), states.size() * sizeof(State));
-    QWaylandCompositor *compositor = static_cast<QWaylandCompositor *>(extensionContainer());
+    QWaylandSurface *surface = qobject_cast<QWaylandSurface *>(extensionContainer());
+    Q_ASSERT(surface);
+    QWaylandCompositor *compositor = surface->compositor();
     Q_ASSERT(compositor);
     uint32_t serial = compositor->nextSerial();
     d->m_pendingConfigures.append(QWaylandXdgSurfaceV5Private::ConfigureEvent{states, size, serial});