Compare commits

...

3 Commits
6.8 ... master

Author SHA1 Message Date
NRK
c3dd6a829b more overflow fix in getatomprop()
commit 244fa852 (and a9aa0d8) tried to fix overflow by checking
the number of items returned. however this is not sufficient
since the format may be lower than 32 bits.

to reproduce the crash, i used the reproducer given in commit
244fa85 but changed the XChangeProperty line to the following to
set the property to a 1 element 16 bit item:

	short si = 1;
	XChangeProperty(d, w, net_wm_state, XA_ATOM, 16,
		PropModeReplace, (unsigned char *)&si, 1);

this client reliably crashes dwm under ASAN since dwm is trying
to read a 32 bit value from a 16 bit one. fix it by checking for
format == 32 as well.

also change the access type from Atom to long, on my machine
Atom is typedef-ed to long already but that may not be true
everywere. the XGetWindowProperty manpage says format == 32 is
returned as `long` so use `long` directly.

(N.B: it also might be worth checking if the returned type is
 XA_ATOM as well, but i wasn't able to cause any crashes by
 setting different types so i'm leaving it out for now.)
2026-02-20 15:31:29 +01:00
NRK
5c9f30300b getstate: fix access type and remove redundant cast
WM_STATE is defined to be format == 32 which xlib returns as
`long` and so accessing it as `unsigned char` is incorrect.

and also &p is already an `unsigned char **` and so the cast was
completely redundant.

given the redundant cast, i assume `p` was `long *` at some time
but was changed to `unsigned char *` later, but the pointer
access (and the cast) wasn't updated.

also add a `format == 32` check as safety measure before
accessing, just in case.
2026-02-20 15:31:28 +01:00
NRK
397d618f1c fix not updating _NET_ACTIVE_WINDOW
currently clients that set the input field of WM_HINTS to true
(c->neverfocus) will never be updated as _NET_ACTIVE_WINDOW even
when they are focused. according to the ICCCM [0] the input
field of WM_HINTS tells the WM to either use or not use
XSetInputFocus(), it shouldn't have any relation to
_NET_ACTIVE_WINDOW. EWMH spec [1] also does not mention any
relationship between the two.

this issue was noticed when launching games via steam/proton and
noticing that _NET_ACTIVE_WINDOW was always wrong/stale (i.e not
updated to the game window).

for reference I've looked at bspwm [2] and it also seems to set
_NET_ACTIVE_WINDOW regardless of whether the client has WM_HINTS
input true or not.

[0]: https://x.org/releases/X11R7.6/doc/xorg-docs/specs/ICCCM/icccm.html#input_focus
[1]: https://specifications.freedesktop.org/wm/1.5/ar01s03.html#id-1.4.10
[2]: c5cf7d3943/src/tree.c (L659-L662)
2026-02-13 10:16:08 +01:00

22
dwm.c
View File

@ -863,15 +863,15 @@ focusstack(const Arg *arg)
Atom
getatomprop(Client *c, Atom prop)
{
int di;
int format;
unsigned long nitems, dl;
unsigned char *p = NULL;
Atom da, atom = None;
if (XGetWindowProperty(dpy, c->win, prop, 0L, sizeof atom, False, XA_ATOM,
&da, &di, &nitems, &dl, &p) == Success && p) {
if (nitems > 0)
atom = *(Atom *)p;
&da, &format, &nitems, &dl, &p) == Success && p) {
if (nitems > 0 && format == 32)
atom = *(long *)p;
XFree(p);
}
return atom;
@ -897,10 +897,10 @@ getstate(Window w)
Atom real;
if (XGetWindowProperty(dpy, w, wmatom[WMState], 0L, 2L, False, wmatom[WMState],
&real, &format, &n, &extra, (unsigned char **)&p) != Success)
&real, &format, &n, &extra, &p) != Success)
return -1;
if (n != 0)
result = *p;
if (n != 0 && format == 32)
result = *(long *)p;
XFree(p);
return result;
}
@ -1470,12 +1470,10 @@ sendevent(Client *c, Atom proto)
void
setfocus(Client *c)
{
if (!c->neverfocus) {
if (!c->neverfocus)
XSetInputFocus(dpy, c->win, RevertToPointerRoot, CurrentTime);
XChangeProperty(dpy, root, netatom[NetActiveWindow],
XA_WINDOW, 32, PropModeReplace,
(unsigned char *) &(c->win), 1);
}
XChangeProperty(dpy, root, netatom[NetActiveWindow], XA_WINDOW, 32,
PropModeReplace, (unsigned char *)&c->win, 1);
sendevent(c, wmatom[WMTakeFocus]);
}