bump version to 6.7

Put the maintainer at the top and bump years (time flies).
dwm: Fix heap buffer overflow in getatomprop
2026-01-10 11:31:44 +01:00 · 2026-01-10 11:27:23 +01:00 · 2025-09-29 18:48:27 +02:00 · 2025-09-27 12:10:17 +02:00 · 2025-08-12 19:17:20 +02:00
6 changed files with 36 additions and 9 deletions
--- a/2
+++ b/2
@@ -1,5 +1,6 @@
 MIT/X Consortium License

+© 2010-2026 Hiltjo Posthuma <hiltjo@codemadness.org>
 © 2006-2019 Anselm R Garbe <anselm@garbe.ca>
 © 2006-2009 Jukka Salmi <jukka at salmi dot ch>
 © 2006-2007 Sander van Dijk <a dot h dot vandijk at gmail dot com>
@@ -11,7 +12,6 @@ MIT/X Consortium License
 © 2008 Martin Hurton <martin dot hurton at gmail dot com>
 © 2008 Neale Pickett <neale dot woozle dot org>
 © 2009 Mate Nagy <mnagy at port70 dot net>
-© 2010-2016 Hiltjo Posthuma <hiltjo@codemadness.org>
 © 2010-2012 Connor Lane Smith <cls@lubutu.com>
 © 2011 Christoph Lohmann <20h@r-36.net>
 © 2015-2016 Quentin Rameau <quinq@fifth.space>
--- a/config.def.h
+++ b/config.def.h
@@ -36,6 +36,7 @@ static const float mfact     = 0.55; /* factor of master area size [0.05..0.95]
 static const int nmaster     = 1;    /* number of clients in master area */
 static const int resizehints = 1;    /* 1 means respect size hints in tiled resizals */
 static const int lockfullscreen = 1; /* 1 will force focus on the fullscreen window */
+static const int refreshrate = 120;  /* refresh rate (per second) for client move/resize */

 static const Layout layouts[] = {
 	/* symbol     arrange function */
--- a/config.mk
+++ b/config.mk
@@ -1,5 +1,5 @@
 # dwm version
-VERSION = 6.6
+VERSION = 6.7

 # Customize below to fit your system

--- a/drw.c
+++ b/drw.c
@@ -178,8 +178,7 @@ drw_clr_create(Drw *drw, Clr *dest, const char *clrname)
 		die("error, cannot allocate color '%s'", clrname);
 }

-/* Wrapper to create color schemes. The caller has to call free(3) on the
- * returned color scheme when done using it. */
+/* Create color schemes. */
 Clr *
 drw_scm_create(Drw *drw, const char *clrnames[], size_t clrcount)
 {
@@ -187,7 +186,7 @@ drw_scm_create(Drw *drw, const char *clrnames[], size_t clrcount)
 	Clr *ret;

 	/* need at least two colors for a scheme */
-	if (!drw || !clrnames || clrcount < 2 || !(ret = ecalloc(clrcount, sizeof(XftColor))))
+	if (!drw || !clrnames || clrcount < 2 || !(ret = ecalloc(clrcount, sizeof(Clr))))
 		return NULL;

 	for (i = 0; i < clrcount; i++)
@@ -195,6 +194,30 @@ drw_scm_create(Drw *drw, const char *clrnames[], size_t clrcount)
 	return ret;
 }

+void
+drw_clr_free(Drw *drw, Clr *c)
+{
+	if (!drw || !c)
+		return;
+
+	/* c is typedef XftColor Clr */
+	XftColorFree(drw->dpy, DefaultVisual(drw->dpy, drw->screen),
+	             DefaultColormap(drw->dpy, drw->screen), c);
+}
+
+void
+drw_scm_free(Drw *drw, Clr *scm, size_t clrcount)
+{
+	size_t i;
+
+	if (!drw || !scm)
+		return;
+
+	for (i = 0; i < clrcount; i++)
+		drw_clr_free(drw, &scm[i]);
+	free(scm);
+}
+
 void
 drw_setfontset(Drw *drw, Fnt *set)
 {
--- a/drw.h
+++ b/drw.h
@@ -40,7 +40,9 @@ void drw_font_getexts(Fnt *font, const char *text, unsigned int len, unsigned in

 /* Colorscheme abstraction */
 void drw_clr_create(Drw *drw, Clr *dest, const char *clrname);
+void drw_clr_free(Drw *drw, Clr *c);
 Clr *drw_scm_create(Drw *drw, const char *clrnames[], size_t clrcount);
+void drw_scm_free(Drw *drw, Clr *scm, size_t clrcount);

 /* Cursor abstraction */
 Cur *drw_cur_create(Drw *drw, int shape);
--- a/dwm.c
+++ b/dwm.c
@@ -486,7 +486,7 @@ cleanup(void)
 	for (i = 0; i < CurLast; i++)
 		drw_cur_free(drw, cursor[i]);
 	for (i = 0; i < LENGTH(colors); i++)
-		free(scheme[i]);
+		drw_scm_free(drw, scheme[i], 3);
 	free(scheme);
 	XDestroyWindow(dpy, wmcheckwin);
 	drw_free(drw);
@@ -870,7 +870,8 @@ getatomprop(Client *c, Atom prop)

 	if (XGetWindowProperty(dpy, c->win, prop, 0L, sizeof atom, False, XA_ATOM,
 		&da, &di, &dl, &dl, &p) == Success && p) {
-		atom = *(Atom *)p;
+		if (dl > 0)
+			atom = *(Atom *)p;
 		XFree(p);
 	}
 	return atom;
@@ -1171,7 +1172,7 @@ movemouse(const Arg *arg)
 			handler[ev.type](&ev);
 			break;
 		case MotionNotify:
-			if ((ev.xmotion.time - lasttime) <= (1000 / 60))
+			if ((ev.xmotion.time - lasttime) <= (1000 / refreshrate))
 				continue;
 			lasttime = ev.xmotion.time;

@@ -1325,7 +1326,7 @@ resizemouse(const Arg *arg)
 			handler[ev.type](&ev);
 			break;
 		case MotionNotify:
-			if ((ev.xmotion.time - lasttime) <= (1000 / 60))
+			if ((ev.xmotion.time - lasttime) <= (1000 / refreshrate))
 				continue;
 			lasttime = ev.xmotion.time;
Author	SHA1	Message	Date
Hiltjo Posthuma	85fe518c1a	bump version to 6.7 Put the maintainer at the top and bump years (time flies).	2026-01-10 11:31:44 +01:00
Chris Down	244fa852fe	dwm: Fix heap buffer overflow in getatomprop When getatomprop() is called, it invokes XGetWindowProperty() to retrieve an Atom. If the property exists but has zero elements (length 0), Xlib returns Success and sets p to a valid, non-NULL memory address containing a single null byte. However, dl (that is, the number of items) is 0. dwm blindly casts p to Atom* and dereferences it. While Xlib guarantees that p is safe to read as a string (that is, it is null-terminated), it does _not_ guarantee it is safe to read as an Atom (an unsigned long). The Atom type is a typedef for unsigned long. Reading an Atom (which thus will either likely be 4 or 8 bytes) from a 1-byte allocated buffer results in a heap buffer overflow. Since property content is user controlled, this allows any client to trigger an out of bounds read simply by setting a property with format 32 and length 0. An example client which reliably crashes dwm under ASAN: #include <X11/Xlib.h> #include <X11/Xatom.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> int main(void) { Display *d; Window root, w; Atom net_wm_state; d = XOpenDisplay(NULL); if (!d) return 1; root = DefaultRootWindow(d); w = XCreateSimpleWindow(d, root, 10, 10, 200, 200, 1, 0, 0); net_wm_state = XInternAtom(d, "_NET_WM_STATE", False); if (net_wm_state == None) return 1; XChangeProperty(d, w, net_wm_state, XA_ATOM, 32, PropModeReplace, NULL, 0); XMapWindow(d, w); XSync(d, False); sleep(1); XCloseDisplay(d); return 0; } In order to avoid this, check that the number of items returned is greater than zero before dereferencing the pointer.	2026-01-10 11:27:23 +01:00
Hiltjo Posthuma	7c3abae4e6	drw.c: drw_scm_free: call free inside Because drw_scm_create() allocates it.	2025-09-29 18:48:27 +02:00
Hiltjo Posthuma	93f26863d1	cleanup schemes and colors	2025-09-27 12:10:17 +02:00
Hiltjo Posthuma	74edc27caa	config: make refreshrate for mouse move/resize a config option Bump the default from 60 to 120.	2025-08-12 19:17:20 +02:00