screencopy/toplevelexport: sanitize pointers in ::copyFrame

oopsie~~ >///<

4 files changed, 24 insertions, 0 deletions

diff --git a/src/Compositor.cpp b/src/Compositor.cpp
index 422dfa22..69812482 100644
--- a/src/Compositor.cpp
+++ b/src/Compositor.cpp
@@ -688,6 +688,15 @@ bool CCompositor::windowExists(CWindow* pWindow) {
     return false;
 }
 
+bool CCompositor::monitorExists(CMonitor* pMonitor) {
+    for (auto& m : m_vRealMonitors) {
+        if (m.get() == pMonitor)
+            return true;
+    }
+
+    return false;
+}
+
 CWindow* CCompositor::vectorToWindowUnified(const Vector2D& pos, uint8_t properties, CWindow* pIgnoreWindow) {
     const auto         PMONITOR          = getMonitorFromVector(pos);
     static auto* const PRESIZEONBORDER   = &g_pConfigManager->getConfigValuePtr("general:resize_on_border")->intValue;
diff --git a/src/Compositor.hpp b/src/Compositor.hpp
index 3fe5a730..7d154735 100644
--- a/src/Compositor.hpp
+++ b/src/Compositor.hpp
@@ -135,6 +135,7 @@ class CCompositor {
     void           focusSurface(wlr_surface*, CWindow* pWindowOwner = nullptr);
     bool           windowExists(CWindow*);
     bool           windowValidMapped(CWindow*);
+    bool           monitorExists(CMonitor*);
     CWindow*       vectorToWindowUnified(const Vector2D&, uint8_t properties, CWindow* pIgnoreWindow = nullptr);
     wlr_surface*   vectorToLayerSurface(const Vector2D&, std::vector<std::unique_ptr<SLayerSurface>>*, Vector2D*, SLayerSurface**);
     SIMEPopup*     vectorToIMEPopup(const Vector2D& pos, std::list<SIMEPopup>& popups);
diff --git a/src/protocols/Screencopy.cpp b/src/protocols/Screencopy.cpp
index 18fe09f4..5f8c00d4 100644
--- a/src/protocols/Screencopy.cpp
+++ b/src/protocols/Screencopy.cpp
@@ -191,6 +191,13 @@ void CScreencopyProtocolManager::captureOutput(wl_client* client, wl_resource* r
     PFRAME->resource      = wl_resource_create(client, &zwlr_screencopy_frame_v1_interface, wl_resource_get_version(resource), frame);
     PFRAME->pMonitor      = g_pCompositor->getMonitorFromOutput(wlr_output_from_resource(output));
 
+    if (!g_pCompositor->monitorExists(PFRAME->pMonitor)) {
+        Debug::log(ERR, "client requested sharing of a monitor that is gone");
+        zwlr_screencopy_frame_v1_send_failed(PFRAME->resource);
+        removeFrame(PFRAME);
+        return;
+    }
+
     if (!PFRAME->pMonitor) {
         Debug::log(ERR, "client requested sharing of a monitor that doesnt exist");
         zwlr_screencopy_frame_v1_send_failed(PFRAME->resource);
diff --git a/src/protocols/ToplevelExport.cpp b/src/protocols/ToplevelExport.cpp
index 425572eb..25bab2ef 100644
--- a/src/protocols/ToplevelExport.cpp
+++ b/src/protocols/ToplevelExport.cpp
@@ -224,6 +224,13 @@ void CToplevelExportProtocolManager::copyFrame(wl_client* client, wl_resource* r
         return;
     }
 
+    if (!g_pCompositor->windowValidMapped(PFRAME->pWindow)) {
+        Debug::log(ERR, "Client requested sharing of window handle {:x} which is gone!", (uintptr_t)PFRAME->pWindow);
+        hyprland_toplevel_export_frame_v1_send_failed(PFRAME->resource);
+        removeFrame(PFRAME);
+        return;
+    }
+
     if (!PFRAME->pWindow->m_bIsMapped || PFRAME->pWindow->isHidden()) {
         Debug::log(ERR, "Client requested sharing of window handle {:x} which is not shareable (2)!", PFRAME->pWindow);
         hyprland_toplevel_export_frame_v1_send_failed(PFRAME->resource);