window: Disregard motion events outside our current surface dimensions

It is possible to receive a motion event that was generated by the
compositor based on a pick of a surface of old dimensions. This was
triggerable on toytoolkit clients when minimising. The new window
dimensions were propagated through the widget hierarchy before the event
was dispatched.

This issue was triggering a segfault due to the focussed widget being
lost as the client code tried to identify which widget should have the
focus using co-ordinates outside the dimensions of the surface.

https://bugs.freedesktop.org/show_bug.cgi?id=66795

1 files changed, 8 insertions, 0 deletions

diff --git a/clients/window.c b/clients/window.c
index 457479db..cbfe12fe 100644
--- a/clients/window.c
+++ b/clients/window.c
@@ -2796,6 +2796,14 @@ pointer_handle_motion(void *data, struct wl_pointer *pointer,
 	float sx = wl_fixed_to_double(sx_w);
 	float sy = wl_fixed_to_double(sy_w);
 
+	/* when making the window smaller - e.g. after a unmaximise we might
+	 * still have a pending motion event that the compositor has picked
+	 * based on the old surface dimensions
+	 */
+	if (sx > window->main_surface->allocation.width ||
+	    sy > window->main_surface->allocation.height)
+		return;
+
 	input->sx = sx;
 	input->sy = sy;