Fix use-after-free with block hotspots

Author: ddevault

common/pango.c

@@ -6,14 +6,21 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include "log.h"
 
 PangoLayout *get_pango_layout(cairo_t *cairo, const char *font,
 		const char *text, int32_t scale, bool markup) {
 	PangoLayout *layout = pango_cairo_create_layout(cairo);
 	PangoAttrList *attrs;
 	if (markup) {
 		char *buf;
-		pango_parse_markup(text, -1, 0, &attrs, &buf, NULL, NULL);
+		GError *error = NULL;
+		if (!sway_assert(pango_parse_markup(
+					text, -1, 0, &attrs, &buf, NULL, &error),
+				"pango_parse_markup '%s' -> error %s", text,
+				error ? error->message : NULL)) {
+			return NULL;
+		}
 		pango_layout_set_markup(layout, buf, -1);
 		free(buf);
 	} else {

sway/tree/layout.c

@@ -248,8 +248,8 @@ void arrange_windows(struct sway_container *container,
 			struct wlr_box *area = &output->sway_output->usable_area;
 			wlr_log(L_DEBUG, "Usable area for ws: %dx%d@%d,%d",
 					area->width, area->height, area->x, area->y);
-			container->width = area->width;
-			container->height = area->height;
+			container->width = width = area->width;
+			container->height = height = area->height;
 			container->x = x = area->x;
 			container->y = y = area->y;
 			wlr_log(L_DEBUG, "Arranging workspace '%s' at %f, %f",

swaybar/i3bar.c

@@ -30,9 +30,7 @@ static bool i3bar_parse_json(struct status_line *status, const char *text) {
 		status_error(status, "[failed to parse i3bar json]");
 		return false;
 	}
-	if (json_object_array_length(results) < 1) {
-		return true;
-	}
+	wlr_log(L_DEBUG, "Got i3bar json: '%s'", text);
 	for (size_t i = 0; i < json_object_array_length(results); ++i) {
 		json_object *full_text, *short_text, *color, *min_width, *align, *urgent;
 		json_object *name, *instance, *separator, *separator_block_width;

swaybar/render.c

@@ -153,7 +153,7 @@ static uint32_t render_status_block(cairo_t *cairo,
 	hotspot->width = width;
 	hotspot->height = height;
 	hotspot->callback = block_hotspot_callback;
-	hotspot->destroy = free;
+	hotspot->destroy = NULL;
 	hotspot->data = block;
 	wl_list_insert(&output->hotspots, &hotspot->link);
 
@@ -227,9 +227,9 @@ static uint32_t render_status_line_i3bar(cairo_t *cairo,
 		struct swaybar_config *config, struct swaybar_output *output,
 		struct status_line *status, bool focused,
 		double *x, uint32_t width, uint32_t height) {
-	struct i3bar_block *block;
 	uint32_t max_height = 0;
 	bool edge = true;
+	struct i3bar_block *block;
 	wl_list_for_each_reverse(block, &status->blocks, link) {
 		uint32_t h = render_status_block(cairo, config, output,
 				block, x, height, focused, edge);
@@ -376,6 +376,7 @@ static uint32_t render_workspace_button(cairo_t *cairo,
 static uint32_t render_to_cairo(cairo_t *cairo,
 		struct swaybar *bar, struct swaybar_output *output) {
 	struct swaybar_config *config = bar->config;
+	wlr_log(L_DEBUG, "output %p", output);
 
 	cairo_set_operator(cairo, CAIRO_OPERATOR_SOURCE);
 	if (output->focused) {