RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 15:47:44 +00:00
Code Issues Activity Actions

WindowServer: Validate cursor type in SetWindowCursor message handler

Browse source 
Fixes #4536.
This commit is contained in:
Linus Groh 2020-12-25 22:45:47 +01:00 • committed by Andreas Kling
parent 82f86e35d6
commit d8899ea65b
3 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Libraries/LibGfx/StandardCursor.h
View file

@ -45,6 +45,7 @@ enum class StandardCursor {
Drag, Drag,
Move, Move,
Wait, Wait,
__Count,
}; };
} }

5
Services/WindowServer/ClientConnection.cpp
View file

@ -27,6 +27,7 @@
#include <AK/Badge.h> #include <AK/Badge.h>
#include <AK/SharedBuffer.h> #include <AK/SharedBuffer.h>
#include <LibGfx/Bitmap.h> #include <LibGfx/Bitmap.h>
#include <LibGfx/StandardCursor.h>
#include <LibGfx/SystemTheme.h> #include <LibGfx/SystemTheme.h>
#include <WindowServer/AppletManager.h> #include <WindowServer/AppletManager.h>
#include <WindowServer/ClientConnection.h> #include <WindowServer/ClientConnection.h>
@ -609,6 +610,10 @@ OwnPtr<Messages::WindowServer::SetWindowCursorResponse> ClientConnection::handle
return nullptr; return nullptr;
} }
auto& window = *(*it).value; auto& window = *(*it).value;
if (message.cursor_type() < 0 || message.cursor_type() >= (i32)Gfx::StandardCursor::__Count) {
did_misbehave("SetWindowCursor: Bad cursor type");
return nullptr;
}
window.set_cursor(Cursor::create((Gfx::StandardCursor)message.cursor_type())); window.set_cursor(Cursor::create((Gfx::StandardCursor)message.cursor_type()));
Compositor::the().invalidate_cursor(); Compositor::the().invalidate_cursor();
return make<Messages::WindowServer::SetWindowCursorResponse>(); return make<Messages::WindowServer::SetWindowCursorResponse>();

3
Services/WindowServer/Cursor.cpp
View file

@ -177,8 +177,9 @@ RefPtr<Cursor> Cursor::create(Gfx::StandardCursor standard_cursor)
return WindowManager::the().move_cursor(); return WindowManager::the().move_cursor();
case Gfx::StandardCursor::Wait: case Gfx::StandardCursor::Wait:
return WindowManager::the().wait_cursor(); return WindowManager::the().wait_cursor();
default:
ASSERT_NOT_REACHED();
} }
ASSERT_NOT_REACHED();
} }
} }