Fix invalid write to random memory

A wrong static_cast QWaylandSurface to a QWaylandCompositor led to
wl_display_next_serial() incrementing an arbitrary value.

Change-Id: I6ff92b8fd86fcef38fb10db2524dcf5aefae6d0a
Reviewed-by: Johan Helsing <johan.helsing@qt.io>

1 files changed, 3 insertions, 1 deletions

diff --git a/src/compositor/extensions/qwaylandxdgshellv5.cpp b/src/compositor/extensions/qwaylandxdgshellv5.cpp
index 07453ffe5..88d7a1b04 100644
--- a/src/compositor/extensions/qwaylandxdgshellv5.cpp
+++ b/src/compositor/extensions/qwaylandxdgshellv5.cpp
@@ -924,7 +924,9 @@ uint QWaylandXdgSurfaceV5::sendConfigure(const QSize &size, const QVector<uint>
 {
     Q_D(QWaylandXdgSurfaceV5);
     auto statesBytes = QByteArray::fromRawData((char *)states.data(), states.size() * sizeof(State));
-    QWaylandCompositor *compositor = static_cast<QWaylandCompositor *>(extensionContainer());
+    QWaylandSurface *surface = qobject_cast<QWaylandSurface *>(extensionContainer());
+    Q_ASSERT(surface);
+    QWaylandCompositor *compositor = surface->compositor();
     Q_ASSERT(compositor);
     uint32_t serial = compositor->nextSerial();
     d->m_pendingConfigures.append(QWaylandXdgSurfaceV5Private::ConfigureEvent{states, size, serial});