Sway accepts xdg_popup.grab with invalid serial values
bug
## Version
```text
Sway version 1.9
wlroots version 0.17.1
```
From `sway-debug.log`:
```text
Ubuntu 24.04
Sway 1.9
wlroots 0.17.1-2.1build1
libwayland-client 1.22.0
WLR_BACKENDS=headless
WLR_RENDERER=pixman
WLR_LOG=debug
```
## Debug Log
Attached: `sway-debug.log`
This was generated with `sway --debug` in the Docker reproducer. The reproduction is short and exits Sway after the test.
## Configuration File
Attached: `sway-config`
```text
xwayland disable
```
## Stack Trace
Not applicable. Sway did not crash.
## Description
I tested `xdg_popup.grab` with serial values that were not produced by any input event. Sway still configured the popup instead of rejecting the grab.
Steps:
1. Start Sway with the headless backend.
2. Create a normal `xdg_toplevel` parent surface.
3. Create an `xdg_popup` child surface.
4. Call `xdg_popup.grab(seat, serial)` with serials that did not come from any input event: `0`, `1`, and `0xDEADBEEF`.
5. Check whether Sway sends `xdg_popup.configure`, `popup_done`, or a protocol error.
Observed behavior:
- Sway sent `xdg_popup.configure` for each popup.
- The client did not receive a protocol error.
- The client did not receive `xdg_popup.popup_done`.
Expected behavior:
Sway should reject the popup grab, or the issue should be forwarded to wlroots if this is fully handled there.
Reproducer package:
Use the attached files, then run:
```bash
docker build -t poc-popup-serial .
docker run --rm poc-popup-serial
```
Also attached:
- `wayland-debug.log`: protocol trace showing invalid serials followed by `xdg_popup.configure`
- `sway-debug.log`: full Sway debug log
- `sway-config`: minimal config used by the reproducer
Relevant protocol trace:
```text
[3832664.699] -> xdg_popup@14.grab(wl_seat@7, 3735928559)
[3832664.792] xdg_popup@14.configure(0, 0, 100, 100)
[3834172.825] -> xdg_popup@14.grab(wl_seat@7, 0)
[3834172.921] xdg_popup@14.configure(0, 0, 100, 100)
[3835681.182] -> xdg_popup@14.grab(wl_seat@7, 1)
[3835681.298] xdg_popup@14.configure(0, 0, 100, 100)
```
Object ids and timestamps can change between runs. The relevant behavior is that each invalid `xdg_popup.grab(...)` request is followed by `xdg_popup.configure`.
[sway-debug.log](https://github.com/user-attachments/files/28455387/sway-debug.log)
[wayland-debug.log](https://github.com/user-attachments/files/28455386/wayland-debug.log)
[poc.c](https://github.com/user-attachments/files/28455389/poc.c)
[run_test.sh](https://github.com/user-attachments/files/28455388/run_test.sh)
0 条评论