ITADN

Sway accepts xdg_popup.grab with invalid serial values

#9173OpenAPEvul-cyber 创建于 2026-06-01
bug
A
APEvul-cybercommented
## Version ```text Sway version 1.9 wlroots version 0.17.1 ``` From `sway-debug.log`: ```text Ubuntu 24.04 Sway 1.9 wlroots 0.17.1-2.1build1 libwayland-client 1.22.0 WLR_BACKENDS=headless WLR_RENDERER=pixman WLR_LOG=debug ``` ## Debug Log Attached: `sway-debug.log` This was generated with `sway --debug` in the Docker reproducer. The reproduction is short and exits Sway after the test. ## Configuration File Attached: `sway-config` ```text xwayland disable ``` ## Stack Trace Not applicable. Sway did not crash. ## Description I tested `xdg_popup.grab` with serial values that were not produced by any input event. Sway still configured the popup instead of rejecting the grab. Steps: 1. Start Sway with the headless backend. 2. Create a normal `xdg_toplevel` parent surface. 3. Create an `xdg_popup` child surface. 4. Call `xdg_popup.grab(seat, serial)` with serials that did not come from any input event: `0`, `1`, and `0xDEADBEEF`. 5. Check whether Sway sends `xdg_popup.configure`, `popup_done`, or a protocol error. Observed behavior: - Sway sent `xdg_popup.configure` for each popup. - The client did not receive a protocol error. - The client did not receive `xdg_popup.popup_done`. Expected behavior: Sway should reject the popup grab, or the issue should be forwarded to wlroots if this is fully handled there. Reproducer package: Use the attached files, then run: ```bash docker build -t poc-popup-serial . docker run --rm poc-popup-serial ``` Also attached: - `wayland-debug.log`: protocol trace showing invalid serials followed by `xdg_popup.configure` - `sway-debug.log`: full Sway debug log - `sway-config`: minimal config used by the reproducer Relevant protocol trace: ```text [3832664.699] -> xdg_popup@14.grab(wl_seat@7, 3735928559) [3832664.792] xdg_popup@14.configure(0, 0, 100, 100) [3834172.825] -> xdg_popup@14.grab(wl_seat@7, 0) [3834172.921] xdg_popup@14.configure(0, 0, 100, 100) [3835681.182] -> xdg_popup@14.grab(wl_seat@7, 1) [3835681.298] xdg_popup@14.configure(0, 0, 100, 100) ``` Object ids and timestamps can change between runs. The relevant behavior is that each invalid `xdg_popup.grab(...)` request is followed by `xdg_popup.configure`. [sway-debug.log](https://github.com/user-attachments/files/28455387/sway-debug.log) [wayland-debug.log](https://github.com/user-attachments/files/28455386/wayland-debug.log) [poc.c](https://github.com/user-attachments/files/28455389/poc.c) [run_test.sh](https://github.com/user-attachments/files/28455388/run_test.sh)
0 条评论