From 25e2ec0407b1e6061437bfb864c8d361fc289083 Mon Sep 17 00:00:00 2001 From: Mason Remaley Date: Mon, 29 Jun 2026 17:36:47 -0700 Subject: [PATCH] Fixes invalid dereference in animated cursor sort `Wayland_CreateAnimatedCursor` calls `SDL_qsort` on an array of type `**SDL_Surface`, not on an array of `*SDL_Surface`. As such the void pointers in the callback need to be casted to `SDL_Surface **` not `SDL_Surface *`. This was likely not caught since it's very unlikely that reading a few bytes past the end of this array results in reading unreadable memory, so the only side effect was invalid sort results, which is a bit subtle. I caught this because I build SDL with UBSAN enabled in my debug builds, and it trapped when the multiplication of the garbage `SDL_Surface*` width and heights overflowed. I validated that the change is correct by adding logs (that have then since been removed) demonstrating that it was previously comparing garbage, and is now comparing the actual cursor surfaces. (cherry picked from commit a168e96cbcf88f8b858b8d9f0c73819010634583) --- src/video/wayland/SDL_waylandmouse.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/video/wayland/SDL_waylandmouse.c b/src/video/wayland/SDL_waylandmouse.c index 3550a4fcdd..de755100f2 100644 --- a/src/video/wayland/SDL_waylandmouse.c +++ b/src/video/wayland/SDL_waylandmouse.c @@ -717,8 +717,8 @@ static bool Wayland_GetSystemCursor(SDL_CursorData *cdata, SDL_WaylandCursorStat static int surface_sort_callback(const void *a, const void *b) { - SDL_Surface *s1 = (SDL_Surface *)a; - SDL_Surface *s2 = (SDL_Surface *)b; + SDL_Surface *s1 = *(SDL_Surface **)a; + SDL_Surface *s2 = *(SDL_Surface **)b; return (s1->w * s1->h) <= (s2->w * s2->h) ? -1 : 1; }