From 9b093c53e90cd194c3da8fe89d4105042bb98fad Mon Sep 17 00:00:00 2001 From: Alex Date: Sun, 5 Jul 2026 10:19:51 +0200 Subject: [PATCH] fix(wireplumber): read gboolean into a gboolean, not a 1-byte bool (OOB write) g_variant_lookup with the "b" format writes a gboolean (gint, 4 bytes), but muted_ and source_muted_ are C++ bool members (1 byte). Passing their addresses caused a 3-byte out-of-bounds write past the member (undefined behavior). Read into a gboolean temporary and assign back to the bool, preserving the prior value when "mute" is absent. --- src/modules/wireplumber.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/modules/wireplumber.cpp b/src/modules/wireplumber.cpp index 8f9bd961..ddcdda6e 100644 --- a/src/modules/wireplumber.cpp +++ b/src/modules/wireplumber.cpp @@ -304,7 +304,12 @@ void waybar::modules::Wireplumber::updateVolume(waybar::modules::Wireplumber* se g_variant_lookup(variant, "volume", "d", &self->volume_); g_variant_lookup(variant, "step", "d", &self->min_step_); - g_variant_lookup(variant, "mute", "b", &self->muted_); + // GVariant "b" writes a gboolean (4 bytes); reading directly into the 1-byte bool member is an + // out-of-bounds write. Read into a gboolean temporary and assign back. + gboolean mute = FALSE; + if (g_variant_lookup(variant, "mute", "b", &mute)) { + self->muted_ = mute; + } g_clear_pointer(&variant, g_variant_unref); self->dp.emit(); @@ -329,7 +334,11 @@ void waybar::modules::Wireplumber::updateSourceVolume(waybar::modules::Wireplumb } g_variant_lookup(variant, "volume", "d", &self->source_volume_); - g_variant_lookup(variant, "mute", "b", &self->source_muted_); + // See updateVolume: GVariant "b" writes a gboolean (4 bytes), not a 1-byte bool. + gboolean mute = FALSE; + if (g_variant_lookup(variant, "mute", "b", &mute)) { + self->source_muted_ = mute; + } g_clear_pointer(&variant, g_variant_unref); self->dp.emit();