Release 1.4.3

- Fix Issue 17
- Fix Issue 18
- Fix Issue 19
- Fix Issue 20

Bugs.md

@@ -224,3 +224,37 @@ Steps to reproduce:
 Cagebreak up to and including release 1.4.1 has a difficult-to-reproduce
 use-after-free bug, which can sometimes trigger crashes when popups are closed.
 
+### Issue 17
+
+  * github issue number: N/A
+  * Fixed: 1.4.3
+
+Cagebreak up to and including version 1.4.2 might have a use-after-free
+on destroying unmapped views. view->workspace was set on view creation.
+If the output containing this view was subsequently destroyed, the workspace
+was freed, leading to a use-after-free when the view was destroyed.
+
+### Issue 18
+
+  * github issue number: N/A
+  * Fixed: 1.4.3
+
+Cagebreak up to and including release 1.4.2 does not handle the position of
+xwayland views adequately.
+
+### Issue 19
+
+  * github issue number: N/A
+  * Fixed: 1.4.3
+
+Cagebreak up to and including release 1.4.2 does not handle unmanaged views
+adequately.
+
+### Issue 20
+
+  * github issue number: N/A
+  * Fixed: 1.4.3
+
+Cagebreak up to and including release 1.4.2 does not handle damaging adequately,
+when scanning out views.
+

README.md

@@ -180,6 +180,11 @@ ninja -C build
 
 For every release after 1.0.5, hashes will be provided.
 
+1.4.3
+
+  * sha 256: 5e29cbaf7c0c5ca74f71a5605bb3d6e302e051798401fee9a79419720b8d8e95
+  * sha 512: 8004865f8603648d9ac9bb700f3ee040e6516c222ad3d783b34219c8fa3a7bdbba6abb74fe92c4d0bd4dbbce0ec4d08be12297a8bad5032baeb589eec557e24e
+
 1.4.2
 
   * sha 256: 27efb9328cf9cab1f81e66627696baf8c7cc2c372339a2890f955b40f3a7c396

man/cagebreak-config.5.md

@@ -1,4 +1,4 @@
-% CAGEBREAK-CONFIG(1) Version 1.4.2 | Cagebreak Manual
+% CAGEBREAK-CONFIG(1) Version 1.4.3 | Cagebreak Manual
 
 # NAME
 

man/cagebreak.1.md

@@ -1,4 +1,4 @@
-% CAGEBREAK(1) Version 1.4.2 | Cagebreak Manual
+% CAGEBREAK(1) Version 1.4.3 | Cagebreak Manual
 
 # NAME
 

meson.build

@@ -1,5 +1,5 @@
 project('cagebreak', 'c',
-  version: '1.4.2',
+  version: '1.4.3',
   license: 'MIT',
   default_options: [
     'c_std=c11',

output.c

@@ -226,7 +226,8 @@ scan_out_primary_view(struct cg_output *output) {
 		}
 	}
 
-	struct cg_view *view = seat_get_focus(server->seat);
+	struct cg_view *view =
+	    output->workspaces[output->curr_workspace]->focused_tile->view;
 	if(view == NULL || view->wlr_surface == NULL) {
 		return false;
 	}
@@ -312,20 +313,24 @@ handle_output_damage_frame(struct wl_listener *listener, void *data) {
 		return;
 	}
 
-	/* Check if we can scan-out the primary view. */
-	static bool last_scanned_out = false;
 	bool scanned_out = scan_out_primary_view(output);
 
-	if(scanned_out && !last_scanned_out) {
+	if(scanned_out && !output->last_scanned_out_view) {
 		wlr_log(WLR_DEBUG, "Scanning out primary view");
 	}
-	if(last_scanned_out && !scanned_out) {
+	if(output->last_scanned_out_view && !scanned_out) {
 		wlr_log(WLR_DEBUG, "Stopping primary view scan out");
-		if(seat_get_focus(output->server->seat) != NULL) {
-			view_damage_whole(seat_get_focus(output->server->seat));
-		}
+		wlr_output_damage_add_whole(output->damage);
+		output->last_scanned_out_view = NULL;
+	}
+	if(output->last_scanned_out_view &&
+	   output->last_scanned_out_view != seat_get_focus(output->server->seat)) {
+		wlr_output_damage_add_whole(output->damage);
+	}
+	if(scanned_out) {
+		output->last_scanned_out_view =
+		    output->workspaces[output->curr_workspace]->focused_tile->view;
 	}
-	last_scanned_out = scanned_out;
 
 	if(scanned_out) {
 		goto frame_done;
@@ -436,7 +441,7 @@ output_destroy(struct cg_output *output) {
 					wl_list_insert(
 					    &server->curr_output
 					         ->workspaces[server->curr_output->curr_workspace]
-					         ->views,
+					         ->unmanaged_views,
 					    &view->link);
 					view->workspace =
 					    server->curr_output
@@ -563,6 +568,7 @@ handle_new_output(struct wl_listener *listener, void *data) {
 	output->wlr_output = wlr_output;
 	output->server = server;
 	output->damage = wlr_output_damage_create(wlr_output);
+	output->last_scanned_out_view = NULL;
 	wl_list_insert(&server->outputs, &output->link);
 
 	output->mode.notify = handle_output_mode;

output.h

@@ -23,6 +23,7 @@ struct cg_output {
 	struct cg_workspace **workspaces;
 	struct wl_list messages;
 	int curr_workspace;
+	struct cg_view *last_scanned_out_view;
 
 	struct wl_list link; // cg_server::outputs
 };

seat.c

@@ -53,8 +53,7 @@ static bool
 view_at(const struct cg_view *view, double lx, double ly,
         struct wlr_surface **surface, double *sx, double *sy) {
 	struct wlr_box *output_layout_box = wlr_output_layout_get_box(
-	    view->workspace->output->server->output_layout,
-	    view->workspace->output->wlr_output);
+	    view->server->output_layout, view->workspace->output->wlr_output);
 
 	double view_sx = lx - view->ox - output_layout_box->x;
 	double view_sy = ly - view->oy - output_layout_box->y;

view.c

@@ -281,6 +281,10 @@ view_for_each_popup(struct cg_view *view, wlr_surface_iterator_func_t iterator,
 
 void
 view_unmap(struct cg_view *view) {
+	/* If the view is not mapped, do nothing */
+	if(view->wlr_surface == NULL) {
+		return;
+	}
 #if CG_HAS_XWAYLAND
 	if((view->type != CG_XWAYLAND_VIEW || xwayland_view_should_manage(view)))
 #endif
@@ -290,14 +294,13 @@ view_unmap(struct cg_view *view) {
 			struct cg_view *prev = view_get_prev_view(view);
 			wlr_output_damage_add_box(view_tile->workspace->output->damage,
 			                          &view_tile->tile);
-			if(view == view->workspace->server->seat->focused_view) {
-				seat_set_focus(view->workspace->server->seat, prev);
-			} else if(view->workspace->server->seat->seat->keyboard_state
+			if(view == view->server->seat->focused_view) {
+				seat_set_focus(view->server->seat, prev);
+			} else if(view->server->seat->seat->keyboard_state
 			              .focused_surface == view->wlr_surface) {
-				wlr_seat_keyboard_clear_focus(
-				    view->workspace->server->seat->seat);
-				seat_set_focus(view->workspace->server->seat,
-				               view->workspace->server->seat->focused_view);
+				wlr_seat_keyboard_clear_focus(view->server->seat->seat);
+				seat_set_focus(view->server->seat,
+				               view->server->seat->focused_view);
 			} else {
 				view_tile->view = prev;
 				if(prev != NULL) {
@@ -309,12 +312,11 @@ view_unmap(struct cg_view *view) {
 #if CG_HAS_XWAYLAND
 	else {
 		view_damage_whole(view);
-		if(view->workspace->server->seat->seat->keyboard_state
-		           .focused_surface == NULL ||
-		   view->workspace->server->seat->seat->keyboard_state
-		           .focused_surface == view->wlr_surface) {
-			seat_set_focus(view->workspace->server->seat,
-			               view->workspace->server->seat->focused_view);
+		if(view->server->seat->seat->keyboard_state.focused_surface == NULL ||
+		   view->server->seat->seat->keyboard_state.focused_surface ==
+		       view->wlr_surface) {
+			seat_set_focus(view->server->seat,
+			               view->server->seat->focused_view);
 		}
 	}
 #endif
@@ -363,7 +365,7 @@ view_map(struct cg_view *view, struct wlr_surface *surface,
 
 void
 view_destroy(struct cg_view *view) {
-	struct cg_output *curr_output = view->workspace->server->curr_output;
+	struct cg_output *curr_output = view->server->curr_output;
 	if(view->wlr_surface != NULL) {
 		view_unmap(view);
 	}
@@ -375,9 +377,10 @@ view_destroy(struct cg_view *view) {
 }
 
 void
-view_init(struct cg_view *view, struct cg_workspace *ws, enum cg_view_type type,
-          const struct cg_view_impl *impl) {
-	view->workspace = ws;
+view_init(struct cg_view *view, enum cg_view_type type,
+          const struct cg_view_impl *impl, struct cg_server *server) {
+	view->workspace = NULL;
+	view->server = server;
 	view->type = type;
 	view->impl = impl;
 

view.h

@@ -19,6 +19,7 @@ enum cg_view_type {
 
 struct cg_view {
 	struct cg_workspace *workspace;
+	struct cg_server *server;
 	struct wl_list link;     // server::views
 	struct wl_list children; // cg_view_child::link
 	struct wlr_surface *wlr_surface;
@@ -106,8 +107,8 @@ view_map(struct cg_view *view, struct wlr_surface *surface,
 void
 view_destroy(struct cg_view *view);
 void
-view_init(struct cg_view *view, struct cg_workspace *ws, enum cg_view_type type,
-          const struct cg_view_impl *impl);
+view_init(struct cg_view *view, enum cg_view_type type,
+          const struct cg_view_impl *impl, struct cg_server *server);
 
 struct wlr_surface *
 view_wlr_surface_at(const struct cg_view *view, double sx, double sy,

xdg_shell.c

@@ -102,8 +102,7 @@ popup_unconstrain(struct cg_xdg_popup *popup) {
 	struct cg_view *view = popup->view_child.view;
 	struct wlr_box *popup_box = &popup->wlr_popup->geometry;
 
-	struct wlr_output_layout *output_layout =
-	    view->workspace->output->server->output_layout;
+	struct wlr_output_layout *output_layout = view->server->output_layout;
 	struct wlr_box *view_output_box = wlr_output_layout_get_box(
 	    output_layout, view->workspace->output->wlr_output);
 	struct wlr_output *wlr_output = wlr_output_layout_output_at(
@@ -297,11 +296,13 @@ handle_xdg_shell_surface_map(struct wl_listener *listener, void *_data) {
 	xdg_shell_view->commit.notify = handle_xdg_shell_surface_commit;
 	wl_signal_add(&xdg_shell_view->xdg_surface->surface->events.commit,
 	              &xdg_shell_view->commit);
+	xdg_shell_view->new_popup.notify = handle_new_xdg_popup;
+	wl_signal_add(&xdg_shell_view->xdg_surface->events.new_popup,
+	              &xdg_shell_view->new_popup);
 
-	view_map(
-	    view, xdg_shell_view->xdg_surface->surface,
-	    view->workspace->server->curr_output
-	        ->workspaces[view->workspace->server->curr_output->curr_workspace]);
+	view_map(view, xdg_shell_view->xdg_surface->surface,
+	         view->server->curr_output
+	             ->workspaces[view->server->curr_output->curr_workspace]);
 	view_damage_whole(view);
 }
 
@@ -350,10 +351,8 @@ handle_xdg_shell_surface_new(struct wl_listener *listener, void *data) {
 		wlr_log(WLR_ERROR, "Failed to allocate XDG Shell view");
 		return;
 	}
-	view_init(
-	    &xdg_shell_view->view,
-	    server->curr_output->workspaces[server->curr_output->curr_workspace],
-	    CG_XDG_SHELL_VIEW, &xdg_shell_view_impl);
+	view_init(&xdg_shell_view->view, CG_XDG_SHELL_VIEW, &xdg_shell_view_impl,
+	          server);
 
 	xdg_shell_view->xdg_surface = xdg_surface;
 
@@ -367,8 +366,6 @@ handle_xdg_shell_surface_new(struct wl_listener *listener, void *data) {
 	    handle_xdg_shell_surface_request_fullscreen;
 	wl_signal_add(&xdg_surface->toplevel->events.request_fullscreen,
 	              &xdg_shell_view->request_fullscreen);
-	xdg_shell_view->new_popup.notify = handle_new_xdg_popup;
-	wl_signal_add(&xdg_surface->events.new_popup, &xdg_shell_view->new_popup);
 }
 
 void

xwayland.c

@@ -82,9 +82,8 @@ maximize(struct cg_view *view, int width, int height) {
 	struct cg_xwayland_view *xwayland_view = xwayland_view_from_view(view);
 	struct cg_output *output = view->workspace->output;
 
-	struct wlr_box *box =
-	    wlr_output_layout_get_box(view->workspace->server->output_layout,
-	                              view->workspace->output->wlr_output);
+	struct wlr_box *box = wlr_output_layout_get_box(
+	    view->server->output_layout, view->workspace->output->wlr_output);
 	struct wlr_xwayland_surface_size_hints *hints =
 	    xwayland_view->xwayland_surface->size_hints;
 
@@ -108,9 +107,8 @@ maximize(struct cg_view *view, int width, int height) {
 		}
 	}
 
-	wlr_xwayland_surface_configure(xwayland_view->xwayland_surface,
-	                               view->ox + box->x, view->oy + box->y, width,
-	                               height);
+	wlr_xwayland_surface_configure(xwayland_view->xwayland_surface, view->ox,
+	                               view->oy, width, height);
 	wlr_xwayland_surface_set_maximized(xwayland_view->xwayland_surface, true);
 }
 
@@ -188,10 +186,9 @@ handle_xwayland_surface_map(struct wl_listener *listener, void *_data) {
 	wl_signal_add(&xwayland_view->xwayland_surface->surface->events.commit,
 	              &xwayland_view->commit);
 
-	view_map(
-	    view, xwayland_view->xwayland_surface->surface,
-	    view->workspace->server->curr_output
-	        ->workspaces[view->workspace->server->curr_output->curr_workspace]);
+	view_map(view, xwayland_view->xwayland_surface->surface,
+	         view->server->curr_output
+	             ->workspaces[view->server->curr_output->curr_workspace]);
 
 	view_damage_whole(view);
 }
@@ -238,10 +235,8 @@ handle_xwayland_surface_new(struct wl_listener *listener, void *data) {
 		return;
 	}
 
-	view_init(
-	    &xwayland_view->view,
-	    server->curr_output->workspaces[server->curr_output->curr_workspace],
-	    CG_XWAYLAND_VIEW, &xwayland_view_impl);
+	view_init(&xwayland_view->view, CG_XWAYLAND_VIEW, &xwayland_view_impl,
+	          server);
 	xwayland_view->xwayland_surface = xwayland_surface;
 
 	xwayland_view->map.notify = handle_xwayland_surface_map;