mirrors/SDL
1
0
Fork 0
mirror of https://github.com/libsdl-org/SDL.git synced 2026-07-09 10:49:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixes invalid dereference in animated cursor sort

Browse Source 
`Wayland_CreateAnimatedCursor` calls `SDL_qsort` on an array of
type `**SDL_Surface`, not on an array of `*SDL_Surface`. As such the void
pointers in the callback need to be casted to `SDL_Surface **` not
`SDL_Surface *`.

This was likely not caught since it's very unlikely that reading a few
bytes past the end of this array results in reading unreadable memory,
so the only side effect was invalid sort results, which is a bit subtle.

I caught this because I build SDL with UBSAN enabled in my debug builds,
and it trapped when the multiplication of the garbage `SDL_Surface*`
width and heights overflowed. I validated that the change is correct by
adding logs (that have then since been removed) demonstrating that it
was previously comparing garbage, and is now comparing the actual cursor
surfaces.
This commit is contained in:
Mason Remaley
2026-06-29 17:36:47 -07:00
committed by Frank Praznik
parent 79ae27bba1
commit a168e96cbc
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/video/wayland/SDL_waylandmouse.c
View File

@@ -720,8 +720,8 @@ static bool Wayland_GetSystemCursor(SDL_CursorData *cdata, SDL_WaylandCursorStat
static int surface_sort_callback(const void *a, const void *b)
{
SDL_Surface *s1 = (SDL_Surface *)a;
SDL_Surface *s2 = (SDL_Surface *)b;
SDL_Surface *s1 = *(SDL_Surface **)a;
SDL_Surface *s2 = *(SDL_Surface **)b;
return (s1->w * s1->h) <= (s2->w * s2->h) ? -1 : 1;
}