From 1067b9bf6964d3da99f663287a84e618d9686127 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Ekl=C3=B6f?= <daniel@ekloef.se>
Date: Fri, 22 May 2026 12:06:28 +0200
Subject: [PATCH] osc: kitty_clipboard_write_finish(): fix walias handling

* 'i' was never incremented, meaning we stored the *last* walias in
  the *first alias position in the mime-type list passed to the
  clipboard handling. The remaining elements were uninitialized and
  invalid.

* We only asserted that we'd found the target mime-type of a
  walias. But we need to handle it NOT being found, as it's perfectly
  possible for a user to send an "invalid" walias, where the target
  mime-type has NOT been sent in a wdata packet.
---
 osc.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/osc.c b/osc.c
index f8179b3a..16f5c325 100644
--- a/osc.c
+++ b/osc.c
@@ -567,7 +567,9 @@ kitty_clipboard_write_finish(struct terminal *term)
         /* Remove without freeing, data is now owned by clip */
         tll_remove(term->kitty_clipboard.committed_mime_data, it);
     }
+    xassert(i == data_count);
 
+    /* i keeps counting... */
     tll_foreach(term->kitty_clipboard.mime_aliases, it) {
         const struct kitty_mime_alias *alias = &it->item;
 
@@ -579,16 +581,28 @@ kitty_clipboard_write_finish(struct terminal *term)
                 break;
             }
         }
-        xassert(idx >= 0);
-        xassert(idx < data_count);
 
-        clip.mime_data_map[i].mime_type = alias->alias;
-        clip.mime_data_map[i].data_idx = idx;
+        if (likely(idx >= 0)) {
+            xassert(idx < data_count);
+
+            clip.mime_data_map[i].mime_type = alias->alias;
+            clip.mime_data_map[i].data_idx = idx;
+            i++;
+
+            /* TODO: can we make target point to the original mime-type, so that we don't have to free it here? */
+            free(alias->target);
+        } else {
+            LOG_WARN(
+                "OSC-5522: invalid WALIAS: %s is not a valid target mime-type",
+                alias->target);
+            free(alias->target);
+            free(alias->alias);
+        }
 
-        /* TODO: can we make target point to the original mime-type, so that we don't have to free it here? */
-        free(alias->target);
         tll_remove(term->kitty_clipboard.mime_aliases, it);
     }
+    xassert(i <= mime_count);  /* We _may_ have fewer, if there were invalid walias */
+    clip.mime_data_map_count = i;
 
     if (!term->kitty_clipboard.for_primary)
         text_to_clipboard(seat, term, NULL, &clip, seat->kbd.serial);