From 25e2ec0407b1e6061437bfb864c8d361fc289083 Mon Sep 17 00:00:00 2001
From: Mason Remaley <[EMAIL REDACTED]>
Date: Mon, 29 Jun 2026 17:36:47 -0700
Subject: [PATCH] Fixes invalid dereference in animated cursor sort
`Wayland_CreateAnimatedCursor` calls `SDL_qsort` on an array of
type `**SDL_Surface`, not on an array of `*SDL_Surface`. As such the void
pointers in the callback need to be casted to `SDL_Surface **` not
`SDL_Surface *`.
This was likely not caught since it's very unlikely that reading a few
bytes past the end of this array results in reading unreadable memory,
so the only side effect was invalid sort results, which is a bit subtle.
I caught this because I build SDL with UBSAN enabled in my debug builds,
and it trapped when the multiplication of the garbage `SDL_Surface*`
width and heights overflowed. I validated that the change is correct by
adding logs (that have then since been removed) demonstrating that it
was previously comparing garbage, and is now comparing the actual cursor
surfaces.
(cherry picked from commit a168e96cbcf88f8b858b8d9f0c73819010634583)
---
src/video/wayland/SDL_waylandmouse.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/video/wayland/SDL_waylandmouse.c b/src/video/wayland/SDL_waylandmouse.c
index 3550a4fcdd514..de755100f24a0 100644
--- a/src/video/wayland/SDL_waylandmouse.c
+++ b/src/video/wayland/SDL_waylandmouse.c
@@ -717,8 +717,8 @@ static bool Wayland_GetSystemCursor(SDL_CursorData *cdata, SDL_WaylandCursorStat
static int surface_sort_callback(const void *a, const void *b)
{
- SDL_Surface *s1 = (SDL_Surface *)a;
- SDL_Surface *s2 = (SDL_Surface *)b;
+ SDL_Surface *s1 = *(SDL_Surface **)a;
+ SDL_Surface *s2 = *(SDL_Surface **)b;
return (s1->w * s1->h) <= (s2->w * s2->h) ? -1 : 1;
}