aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* util: fix use-after-free in for_each_helperHEADmainYaNing Lu5 days1-3/+5
| | | | | | | | | | | | | | | | | | for_each_helper caches the entries->data pointer and array size before iterating. If a compositor calls wl_client_for_each_resource() and the provided callback triggers the creation of a new client object, the underlying wl_array may be reallocated via realloc(). When this happens, the cached start pointer becomes dangling. Subsequent iterations will read from the freed memory block, causing already-destroyed resources to be destroyed a second time (e.g., leading to a double-free crash in wl_list_remove()). Fix this by dynamically re-fetching entries->data and entries->size on every loop iteration, ensuring the iterator always accesses the valid live array. Signed-off-by: YaNing Lu <luyaning@uniontech.com>
* Send wl_registry.global_remove to global's offer listVlad Zahorodnii11 days1-21/+19
| | | | | | | | Since the globals track the registries that received global announcements, we can use that instead of going through all present registries and duplicate some filtering logic. Signed-off-by: Vlad Zahorodnii <vlad.zahorodnii@kde.org>
* Add wl_fixes.ack_global_remove()Vlad Zahorodnii11 days2-32/+233
| | | | | | | | | | | | | | | | | | | | | | | | The wl_global_remove() function was introduce to help mitigate clients getting unintentionally disconnected if a global is added and removed in a short burst. The intended usage was: - the compositor calls wl_global_remove() - after a certain period of time, the compositor calls wl_global_destroy() Unfortunately, it did not fully fix the issue due to the way monotonic clock works on Linux. Specifically, it can tick even during sleep. This change adds a slightly better way to handle global removal. With the proposed changes, the clients need to signal to the compositor that they won't bind the global anymore. After all clients have acknowledged a wl_registry.global_remove, the compositor can finally destroy the global. Signed-off-by: Vlad Zahorodnii <vlad.zahorodnii@kde.org>
* server: improve wl_registry.bind error messagesKirill Primak2026-03-051-5/+4
| | | | | | | - Consistently use PRIu32 for global names (uint32_t) - Use expected/got instead of have/wanted (which were used differently anyway) Signed-off-by: Kirill Primak <vyivel@eclair.cafe>
* server: don't disclose the existence of invisible globalsKirill Primak2026-03-051-6/+2
| | | | | | | | Otherwise, a client iterate over a range of names binding with deliberately incorrect interfaces and receive error messages with expected interfaces regardless of global visibility. Signed-off-by: Kirill Primak <vyivel@eclair.cafe>
* scanner: enforce frozen attributeIsaac Freund2026-03-051-0/+17
| | | | Signed-off-by: Isaac Freund <mail@isaacfreund.com>
* server: improve version mismatch error messageKirill Primak2026-03-051-4/+4
| | | | | | | "1 < 2" is obviously true but not very useful information by itself. Provide a bit more context. Signed-off-by: Kirill Primak <vyivel@eclair.cafe>
* util: assert alloc is consistent with data in wl_array_add()Simon Ser2026-03-031-0/+3
| | | | | | | | | | | | | | | | | | | | | | | struct wl_array may be constructed by users manually from a foreign data pointer: uint32_t states[] = {1, 2, 3}; struct wl_array arr = { .data = states, .size = sizeof(states) / sizeof(states[0]), }; This is useful to avoid the need to allocate when sending Wayland messages. Users need to be careful not to use wl_array_add() on such arrays: the function will misbehave by leaving garbage at the start of the new buffer when reallocating. Add an assert to guard against wl_array_add() calls in this situation, to have a clear crash instead of undefined behavior. Signed-off-by: Simon Ser <contact@emersion.fr>
* client: fix crash when creating proxies with no queueLoïc Yhuel2026-03-011-3/+12
| | | | | | | | | | Before, it worked if the client did set a queue on the proxy before any event was received. Now we have the "warning: queue xxx destroyed while proxies still attached", then a crash if one of the proxies is used to create a proxy. Fixes: 674145dc3f ("client: Track the proxies attached to a queue") Fixes: 0ba650202e ("client: Warn when a queue is destroyed with attached proxies") Signed-off-by: Loïc Yhuel <loic.yhuel@softathome.com>
* server: document protocol logger callback functionSebastian Wick2026-01-031-0/+1
| | | | | | | | | | This fixes a validation error in the documentation which are not fatal. The idea is the same as in 12ec67a ("server: document listener fields and a vfunc"), which seems to have missed the reference to the wl_protocol_logger_func_t from the note in wl_log_func_t. Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* server: document listener fields and a vfuncPekka Paalanen2025-12-291-0/+4
| | | | | | | | Adding these simple documentation comments allows us to have meaningful link targets in the generated API documentation. That will help getting rid of broken links which cause XML validation to fail. Signed-off-by: Pekka Paalanen <pq@iki.fi>
* server: fix wl_signal_add Doxygen warningPekka Paalanen2025-12-291-1/+1
| | | | | | | | | | | | | | $ meson compile -C build -v xml-Server-doc INFO: autodetecting backend as ninja INFO: calculating backend command to run: /usr/bin/ninja -C /home/pq/git/wayland/build -v doc/doxygen/xml/Server/combine.xslt doc/doxygen/xml/Server/index.xml ninja: Entering directory `/home/pq/git/wayland/build' [1/1] /home/pq/git/wayland/doc/doxygen/gen-doxygen.py --builddir=doc/doxygen/xml/Server --section=Server --output-format=xml doc/doxygen/wayland.doxygen ../doc/doxygen/../../src/wayland-util.h ../doc/doxygen/../../src/event-loop.c ../doc/doxygen/../../src/wayland-server.c ../doc/doxygen/../../src/wayland-server.h ../doc/doxygen/../../src/wayland-server-core.h ../doc/doxygen/../../src/wayland-shm.c /home/pq/git/wayland/src/wayland-server-core.h:394: warning: explicit link request to 'wl_signal_add' could not be resolved I don't know why, but the "explicit link" mark-up fails, while the automatic link mark-up works. This warning disappears. Signed-off-by: Pekka Paalanen <pq@iki.fi>
* build: Bump to meson version 0.64.0Sebastian Wick2025-11-271-1/+0
| | | | | | | | | | | | | | | | This version will be required in the next commit. Bumps the CI image to get the required version from the debian package instead of from pip. Removes the bindir builtin directory from pkgconfig.generate() which is deprecated since 0.62.0. It will be automatically included when referenced. Use `meson setup` everywhere instead of relying on deprecated automatic detection of the setup command. Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* client: add wl_display_dispatch_pending_singleIsaac Freund2025-09-162-0/+82
| | | | | | | | | | | | | | | | | | | | | | | | | As well as wl_display_dispatch_queue_pending_single. The motivation is writing libwayland bindings for a dynamic language with exceptions/non-local returns. Since it is invalid for a wl_dispatcher_func_t callback provided to libwayland to not return, there is no way to prevent dispatching of further events in the case of an exception in the dynamic language event handler. Furthermore, since creating/destroying Wayland objects in an event handler affects the dispatching of subsequent events by libwayland, it is not possible to collect Wayland events in a queue outside libwayland and dispatch them one-by-one after wl_display_dispatch_pending() returns. Adding libwayland API to dispatch at most one pending event solves this problem cleanly. The bindings can have libwayland dispatch a single event, wait for wl_display_dispatch_pending_single() to return, run the dynamic language event handler (which may longjmp away), and continue the loop for as long as there are more events to dispatch. References: https://codeberg.org/ifreund/janet-wayland Signed-off-by: Isaac Freund <mail@isaacfreund.com>
* connection: Add a thread ID to WAYLAND_DEBUG output.Kyle Brenneman2025-09-151-0/+17
| | | | | | | | | | | | | | | | If WAYLAND_DEBUG contains the token "thread_id", and gettid() is available, then include the current thread ID in the output from wl_closure_print. If multiple threads are sending requests, then those requests can get interleaved. That's usually fine, but for wl_surface requests and commits, that can cause problems ranging from incorrect behavior to protocol errors. Being able to see which requests are sent by different threads would make such problems much easier to diagnose. Signed-off-by: Kyle Brenneman <kbrenneman@nvidia.com>
* connection: Add a function to parse WAYLAND_DEBUG tokensKyle Brenneman2025-09-154-2/+47
| | | | | | | | | | | | | | | Add a new function, wl_check_env_token, to scan for a token in a comma-separated string. Change wl_display_create in wayland-server.c and wl_display_connect_to_fd in wayland-client.c to use that instead of a simple substring search. This means that WAYLAND_DEBUG will accept a value like "client,server" but not "clientserver". But, this will make it easier to add other tokens without worrying about overlap between them. Signed-off-by: Kyle Brenneman <kbrenneman@nvidia.com>
* connection: Do not busy-loop if a message exceeds the buffer sizeDemi Marie Obenour2025-06-214-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the length of a message exceeds the maximum length of the buffer, the buffer size will reach its maximum value and stay there forever, with no message ever being successfully processed. Since libwayland uses level-triggered epoll, this will cause the compositor to loop forever and consume CPU time. In libwayland 1.22 and below, there was an explicit check that caused messages exceeding 4096 bytes to result in an EOVERFLOW error, preventing the loop. However, this check was removed between d074d5290263 ("connection: Dynamically resize connection buffers"). To prevent this problem, always limit the size of messages to 4096 bytes. Since the default and minimum buffer size is 4096 bytes, this ensures that a single message will always fit in the buffer. It would be possible to allow larger messages if the buffer size was larger, but the maximum size of a message should not depend on the buffer size chosen by the compositor. Rejecting messages that exceed 4092 bytes seems to have the advantage of reserving 4 bits, not 3, in the size field for future use. However, message sizes in the range [0x0, 0x7] are invalid, so one can obtain a fourth bit by negating the meaning of bit 12 if bits 0 through 11 (inclusive) are 0. Allowing 4096-byte messages provides the far more important advantage that regressions compared to 1.22 are impossible and regressions compared to 1.23 are extremely unlikely. The only case where a regression is possible is: - The receiving side is using libwayland 1.23. - The sending side is either using libwayland 1.23 or is not using libwayland. - The sender sends a message exceeding 4096 bytes. - If the sender of the large message is the client, the server has increased the buffer size from the default value. This combination is considered extremely unlikely, as libwayland 1.22 and below would disconnect upon receiving such a large message. 4096-byte messages, however, have always worked, so there was no reason to avoid sending them. Fixes: d074d5290263 ("connection: Dynamically resize connection buffers"). Fixes: #494 Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
* server: Document wl_display_add_socket_autoManuel Stoeckl2025-06-081-0/+18
| | | | | | The exact sequence of names tried has de facto become part of the API. Signed-off-by: Manuel Stoeckl <code@mstoeckl.com>
* client: fix conversion specifier in the discarded event log messageKirill Primak2025-06-011-1/+1
| | | | Signed-off-by: Kirill Primak <vyivel@eclair.cafe>
* debug: Colorize output for easier readingCaitlyn2025-06-014-18/+69
| | | | Signed-off-by: Caitlyn <caitlynrosestewart@gmail.com>
* connection: fix segfault in wl_closure_invoke()Caitlyn Stewart2025-05-271-0/+5
| | | | Signed-off-by: Caitlyn Stewart <caitlynrosestewart@gmail.com>
* Fix typosTobias Stoeckmann2025-05-201-1/+1
| | | | | | Typos found with codespell and during code audit. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
* server: add wl_resource_get_interface()Isaac Freund2025-05-202-0/+17
| | | | | | | This is useful for the wayland bindings/scanner I'm working on for a dynamically typed language. Signed-off-by: Isaac Freund <mail@isaacfreund.com>
* client: add wl_proxy_get_interface()Isaac Freund2025-05-202-0/+17
| | | | | | | This is useful for the wayland bindings/scanner I'm working on for a dynamically typed language. Signed-off-by: Isaac Freund <mail@isaacfreund.com>
* shm: linkify function references in docsSimon Ser2025-05-201-8/+8
| | | | | | | Parentheses make it so the generated HTML documentation contains links, which makes navigation easier. Signed-off-by: Simon Ser <contact@emersion.fr>
* shm: fix comment about wl_shm_buffer_begin_access() safetySimon Ser2025-05-201-1/+1
| | | | | | | The paragraph later says that accessing different buffers is allowed. The function checks whether the same pool is accessed. Signed-off-by: Simon Ser <contact@emersion.fr>
* shm: Generate an error when shm access failed even without a resourceSebastian Wick2025-05-201-0/+26
| | | | Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* shm: Add wl_shm_buffer ref and unref functionsSebastian Wick2025-05-202-5/+79
| | | | | | | | | | | | | | | Shared memory buffers are currently tied to the lifetime of their underlying wl_buffer resource. This becomes problematic when the client destroys the resource after committing new state which references the wl_buffer because a compositor might have to defer applying the commit. This commit adds methods to keep the wl_shm_buffer alive longer than the underlying resource. This implicitly also keeps the buffer pool alive and because the wl_shm_buffer uses offsets into the pool, it even works when the underlying storage gets remapped somewhere else, which can happen when the client resizes the pool. Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* shm: Remove refcount check which cannot be triggeredSebastian Wick2025-05-201-7/+2
| | | | | | | | | If the pool refcount reaches zero, it is freed, so accessing its members is UB which ASan would catch. Also simplify check for negative refcounts. Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* shm: Linkify wl_shm_pool_unref in the ref_pool documentationSebastian Wick2025-05-201-1/+1
| | | | Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* client: document get_listener behavior for dispatchersJulian Orth2025-03-151-0/+3
| | | | | | | | | | | This seems to have been the case since 2013. This is useful for wrappers that need two pointers to identify proxies. One pointer (stored in the user data) pointing to a singleton object to identify that the proxy has a known structure. And one pointer (stored in the dispatcher data) pointing to per-proxy data. Signed-off-by: Julian Orth <ju.orth@gmail.com>
* scanner: use separate guards for validator functionsSimon Ser2025-02-231-3/+11
| | | | | | | | | | | | | | Generated XXX_is_valid() functions for enums are guarded behind the same #define as the enum itself. This worked fine until recently, but since fbd7460737c9 ("scanner: add new enum-header mode") we're also generating enum-only headers. When including the enum-only header first, and then the server header, the validator functions are missing. Define a separate guard to fix this. Signed-off-by: Simon Ser <contact@emersion.fr>
* Forward declarate timespec structVlad Zahorodnii2025-02-061-1/+2
| | | | | | | The `timespec` struct is defined in `time.h` header but only if `_POSIX_C_SOURCE` is set or when using the C11 standard. Signed-off-by: Vlad Zahorodnii <vlad.zahorodnii@kde.org>
* Also use [[deprecated]] when compiling with at least C++14David Redondo2025-02-051-1/+1
| | | | Signed-off-by: David Redondo <kde@david-redondo.de>
* Make wayland-util.h -Wundef safe when compiled by a C++ compilerDavid Redondo2025-02-051-2/+2
| | | | | Fixes #522 Signed-off-by: David Redondo <kde@david-redondo.de>
* build: Add -lm to pkg-config dependenciesDaniel Stone2025-02-051-0/+2
| | | | | | | | | Now that wl_fixed_from_double() calls round() from a function declared in a header, our users need to explicitly pick that dependency up in order to avoid build errors. Signed-off-by: Daniel Stone <daniels@collabora.com> Closes: wayland/weston#991
* client: Add wl_display_dispatch_timeoutSebastian Wick2025-02-042-0/+13
| | | | | | A variant of wl_display_dispatch_queue_timeout for the default queue. Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* client: Add wl_display_dispatch_queue_timeoutSebastian Wick2025-02-042-34/+127
| | | | | | | | | | | For dispatching messages on a queue with a timeout. This slightly changes the samantics of wl_display_dispatch. Previously it was possible for it to return even though there wasn't a single dispatched event. The function correctly returned 0 in this case but it is now used to indicate a timeout. Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* event-loop: Use timespec utils instead of hand-rolling our ownSebastian Wick2025-02-041-54/+7
| | | | Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* timespec: Implement saturating timespec substractionSebastian Wick2025-02-041-0/+18
| | | | Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* timespec: Pull in timespec_after and timespec_add from mesaSebastian Wick2025-02-041-0/+34
| | | | Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* timespec: Pull in timespec.h from westonSebastian Wick2025-02-041-0/+259
| | | | Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* server: add const qualifier to function arguments where possibleSebastian Wick2025-01-223-18/+19
| | | | | | | Makes it possible to e.g. `call wl_client_get_credentials` with a `const struct wl_client *` from a global filter callback. Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
* util: reduce error of wl_fixed_from_double()Haihua Hu2025-01-091-1/+1
| | | | | | | | when cast double to fixed pointer, there will be big error, eg 1919.9998 to 1919. Call round before cast to get nearest value 1920 of 1919.9998 Signed-off-by: Haihua Hu <jared.hu@nxp.com>
* connection: Fix wrong format stringDemi Marie Obenour2024-11-301-1/+1
| | | | | | | Prevents undefined behavior if there is not enough space in the buffer for a queued message. Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
* connection: Avoid undefined pointer arithmeticDemi Marie Obenour2024-11-291-4/+4
| | | | | | | | | | Creating a pointer that is more than one element past the end of an array is undefined behavior, even if the pointer is not dereferenced. Avoid this undefined behavior by using `p >= end` instead of `p + 1 > end` and `SOMETHING > end - p` instead of `p + SOMETHING > end`. Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
* connection: Reject strings containing NUL bytesDemi Marie Obenour2024-08-181-1/+9
| | | | | | | | | | | | libwayland cannot construct these messages as it uses strlen() to determine string lengths. libwayland is also guaranteed to misinterpret these messages, since message handlers only get a pointer and no length. Therefore, reject strings containing NUL bytes. Also remove a redundant check from the unmarshalling code. The zero-length case has already been checked for. Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
* client: Log the object and methods when marshalling or sending failsFangzhou Ge2024-08-121-2/+6
| | | | | | | | | The log that appears before a display_error can be captured as crash signature. Useful to know what it is. This is cherry-picked from chromium https://crrev.com/c/4697877 Signed-off-by: Fangzhou Ge <fangzhoug@chromium.org>
* src: Finish assert() clean-upDerek Foreman2024-08-095-6/+2
| | | | | | | | | | | | | From cleanup commit 0cecde304: assert()s can be compiled away by #defining NDEBUG. Some build systems do this. Using wl_abort gives a human readable error message and it isn't compiled away. That commit missed one final assert, presumably due to missing it with grep because of a coding style issue. Fix that up, and remove inclusion of <assert.h> as appropriate. Signed-off-by: Derek Foreman <derek.foreman@collabora.com>
* server: expose wl_resource_post_error_vargs()Kirill Primak2024-08-092-2/+14
| | | | Signed-off-by: Kirill Primak <vyivel@eclair.cafe>
generated by cgit v1.3 (git 2.53.0) at 2026-04-04 07:23:26 +0000