From a168e96cbcf88f8b858b8d9f0c73819010634583 Mon Sep 17 00:00:00 2001 From: Mason Remaley Date: Mon, 29 Jun 2026 17:36:47 -0700 Subject: [PATCH] Fixes invalid dereference in animated cursor sort `Wayland_CreateAnimatedCursor` calls `SDL_qsort` on an array of type `**SDL_Surface`, not on an array of `*SDL_Surface`. As such the void pointers in the callback need to be casted to `SDL_Surface **` not `SDL_Surface *`. This was likely not caught since it's very unlikely that reading a few bytes past the end of this array results in reading unreadable memory, so the only side effect was invalid sort results, which is a bit subtle. I caught this because I build SDL with UBSAN enabled in my debug builds, and it trapped when the multiplication of the garbage `SDL_Surface*` width and heights overflowed. I validated that the change is correct by adding logs (that have then since been removed) demonstrating that it was previously comparing garbage, and is now comparing the actual cursor surfaces. --- src/video/wayland/SDL_waylandmouse.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/video/wayland/SDL_waylandmouse.c b/src/video/wayland/SDL_waylandmouse.c index 861a0c0f21..fbc00e5258 100644 --- a/src/video/wayland/SDL_waylandmouse.c +++ b/src/video/wayland/SDL_waylandmouse.c @@ -720,8 +720,8 @@ static bool Wayland_GetSystemCursor(SDL_CursorData *cdata, SDL_WaylandCursorStat static int surface_sort_callback(const void *a, const void *b) { - SDL_Surface *s1 = (SDL_Surface *)a; - SDL_Surface *s2 = (SDL_Surface *)b; + SDL_Surface *s1 = *(SDL_Surface **)a; + SDL_Surface *s2 = *(SDL_Surface **)b; return (s1->w * s1->h) <= (s2->w * s2->h) ? -1 : 1; }