From b05fef20ff27e975948859667d1bf4543826474c Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Fri, 24 Nov 2023 17:00:34 +0100 Subject: [PATCH] viewporter: fix src buffer bounds check The surface scale and transform are applied before the viewport. Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/issues/3766 (cherry picked from commit 4fbe648fafe687a061e246c2f16b971ecfaf89ec) --- types/wlr_viewporter.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/types/wlr_viewporter.c b/types/wlr_viewporter.c index cb5d1df12..0e5069bbc 100644 --- a/types/wlr_viewporter.c +++ b/types/wlr_viewporter.c @@ -131,6 +131,19 @@ static void viewport_handle_resource_destroy(struct wl_resource *resource) { viewport_destroy(viewport); } +static bool check_src_buffer_bounds(const struct wlr_surface_state *state) { + int width = state->buffer_width / state->scale; + int height = state->buffer_height / state->scale; + if (state->transform & WL_OUTPUT_TRANSFORM_90) { + int tmp = width; + width = height; + height = tmp; + } + + struct wlr_fbox box = state->viewport.src; + return box.x + box.width <= width && box.y + box.height <= height; +} + static void viewport_handle_surface_client_commit(struct wl_listener *listener, void *data) { struct wlr_viewport *viewport = @@ -148,10 +161,7 @@ static void viewport_handle_surface_client_commit(struct wl_listener *listener, } if (state->viewport.has_src && state->buffer != NULL && - (state->viewport.src.x + state->viewport.src.width > - state->buffer_width || - state->viewport.src.y + state->viewport.src.height > - state->buffer_height)) { + !check_src_buffer_bounds(state)) { wl_resource_post_error(viewport->resource, WP_VIEWPORT_ERROR_OUT_OF_BUFFER, "source rectangle out of buffer bounds"); return;