From a168e96cbcf88f8b858b8d9f0c73819010634583 Mon Sep 17 00:00:00 2001
From: Mason Remaley <[EMAIL REDACTED]>
Date: Mon, 29 Jun 2026 17:36:47 -0700
Subject: [PATCH] Fixes invalid dereference in animated cursor sort
`Wayland_CreateAnimatedCursor` calls `SDL_qsort` on an array of
type `**SDL_Surface`, not on an array of `*SDL_Surface`. As such the void
pointers in the callback need to be casted to `SDL_Surface **` not
`SDL_Surface *`.
This was likely not caught since it's very unlikely that reading a few
bytes past the end of this array results in reading unreadable memory,
so the only side effect was invalid sort results, which is a bit subtle.
I caught this because I build SDL with UBSAN enabled in my debug builds,
and it trapped when the multiplication of the garbage `SDL_Surface*`
width and heights overflowed. I validated that the change is correct by
adding logs (that have then since been removed) demonstrating that it
was previously comparing garbage, and is now comparing the actual cursor
surfaces.
---
src/video/wayland/SDL_waylandmouse.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/video/wayland/SDL_waylandmouse.c b/src/video/wayland/SDL_waylandmouse.c
index 861a0c0f215e7..fbc00e5258b38 100644
--- a/src/video/wayland/SDL_waylandmouse.c
+++ b/src/video/wayland/SDL_waylandmouse.c
@@ -720,8 +720,8 @@ static bool Wayland_GetSystemCursor(SDL_CursorData *cdata, SDL_WaylandCursorStat
static int surface_sort_callback(const void *a, const void *b)
{
- SDL_Surface *s1 = (SDL_Surface *)a;
- SDL_Surface *s2 = (SDL_Surface *)b;
+ SDL_Surface *s1 = *(SDL_Surface **)a;
+ SDL_Surface *s2 = *(SDL_Surface **)b;
return (s1->w * s1->h) <= (s2->w * s2->h) ? -1 : 1;
}