From 0a5ba708e4a8448a0d29d4e263f939c9d1d2b953 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Ekl=C3=B6f?= <daniel@ekloef.se>
Date: Tue, 30 Jul 2024 16:33:19 +0200
Subject: [PATCH] notify: don't close FD 0

This fixes a regression where closing a terminal instance, or hard- or
soft-resetting a terminal caused FD 0 to be closed.

This meant it became re-usable. Usually, by memfd_create() when
allocating a new surface buffer. So far nothing _really_ bad has
happened.

But what if FD 0 is now used by a memfd, and we close _another_
terminal instance?

This causes our memfd to be closed. And then, when e.g. trying to
scroll the terminal content: fallocate() fails with bad FD.
---
 notify.c   | 9 ++++++---
 shm.c      | 2 +-
 terminal.c | 4 ++++
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/notify.c b/notify.c
index 39e8db4e..7c5f0731 100644
--- a/notify.c
+++ b/notify.c
@@ -505,10 +505,13 @@ notify_icon_del(struct terminal *term, const char *id)
 void
 notify_icon_free(struct notification_icon *icon)
 {
-    if (icon->tmp_file_fd >= 0)
-        close(icon->tmp_file_fd);
-    if (icon->tmp_file_name != NULL)
+    if (icon->tmp_file_name != NULL) {
         unlink(icon->tmp_file_name);
+        if (icon->tmp_file_fd >= 0) {
+            xassert(icon->tmp_file_fd > 0);  // DEBUG
+            close(icon->tmp_file_fd);
+        }
+    }
 
     free(icon->id);
     free(icon->symbolic_name);
diff --git a/shm.c b/shm.c
index 879745d4..04cec211 100644
--- a/shm.c
+++ b/shm.c
@@ -255,7 +255,7 @@ instantiate_offset(struct buffer_private *buf, off_t new_offset)
 
     void *mmapped = MAP_FAILED;
     struct wl_buffer *wl_buf = NULL;
-    pixman_image_t **pix = xcalloc(buf->public.pix_instances, sizeof(*pix));
+    pixman_image_t **pix = xcalloc(buf->public.pix_instances, sizeof(pix[0]));
 
     mmapped = (uint8_t *)pool->real_mmapped + new_offset;
 
diff --git a/terminal.c b/terminal.c
index dc4f37b6..e95a3615 100644
--- a/terminal.c
+++ b/terminal.c
@@ -1330,6 +1330,10 @@ term_init(const struct config *conf, struct fdm *fdm, struct reaper *reaper,
         }
     }
 
+    for (size_t i = 0; i < ALEN(term->notification_icons); i++) {
+        term->notification_icons[i].tmp_file_fd = -1;
+    }
+
     add_utmp_record(conf, reaper, ptmx);
 
     if (!pty_path) {