diff options
author | Paul Olav Tvete <paul.tvete@qt.io> | 2016-09-30 15:00:01 +0200 |
---|---|---|
committer | Johan Helsing <johan.helsing@qt.io> | 2016-09-30 13:13:05 +0000 |
commit | 863bf669ed0b8fce782c177dfcfa1702fc28196a (patch) | |
tree | 5fbc293dd173658a206d2ae675d5792245f213f0 /src/compositor/extensions | |
parent | ff8ff591870c42d75a8b8b52bfc27aaf35895ce2 (diff) |
Fix invalid write to random memory
A wrong static_cast QWaylandSurface to a QWaylandCompositor led to
wl_display_next_serial() incrementing an arbitrary value.
Change-Id: I6ff92b8fd86fcef38fb10db2524dcf5aefae6d0a
Reviewed-by: Johan Helsing <johan.helsing@qt.io>
Diffstat (limited to 'src/compositor/extensions')
-rw-r--r-- | src/compositor/extensions/qwaylandwlshell.cpp | 2 | ||||
-rw-r--r-- | src/compositor/extensions/qwaylandxdgshellv5.cpp | 4 |
2 files changed, 4 insertions, 2 deletions
diff --git a/src/compositor/extensions/qwaylandwlshell.cpp b/src/compositor/extensions/qwaylandwlshell.cpp index f3af4d15f..2fca88fef 100644 --- a/src/compositor/extensions/qwaylandwlshell.cpp +++ b/src/compositor/extensions/qwaylandwlshell.cpp @@ -316,7 +316,7 @@ void QWaylandWlShell::initialize() { Q_D(QWaylandWlShell); QWaylandShellTemplate::initialize(); - QWaylandCompositor *compositor = static_cast<QWaylandCompositor *>(extensionContainer()); + QWaylandCompositor *compositor = qobject_cast<QWaylandCompositor *>(extensionContainer()); if (!compositor) { qWarning() << "Failed to find QWaylandCompositor when initializing QWaylandWlShell"; return; diff --git a/src/compositor/extensions/qwaylandxdgshellv5.cpp b/src/compositor/extensions/qwaylandxdgshellv5.cpp index 07453ffe5..88d7a1b04 100644 --- a/src/compositor/extensions/qwaylandxdgshellv5.cpp +++ b/src/compositor/extensions/qwaylandxdgshellv5.cpp @@ -924,7 +924,9 @@ uint QWaylandXdgSurfaceV5::sendConfigure(const QSize &size, const QVector<uint> { Q_D(QWaylandXdgSurfaceV5); auto statesBytes = QByteArray::fromRawData((char *)states.data(), states.size() * sizeof(State)); - QWaylandCompositor *compositor = static_cast<QWaylandCompositor *>(extensionContainer()); + QWaylandSurface *surface = qobject_cast<QWaylandSurface *>(extensionContainer()); + Q_ASSERT(surface); + QWaylandCompositor *compositor = surface->compositor(); Q_ASSERT(compositor); uint32_t serial = compositor->nextSerial(); d->m_pendingConfigures.append(QWaylandXdgSurfaceV5Private::ConfigureEvent{states, size, serial}); |