diff -Nru openbox-3.6.1/debian/changelog openbox-3.6.1/debian/changelog --- openbox-3.6.1/debian/changelog 2022-01-30 05:53:39.000000000 -0600 +++ openbox-3.6.1/debian/changelog 2023-03-19 20:36:07.000000000 -0500 @@ -1,3 +1,18 @@ +openbox (3.6.1-10ubuntu1) lunar; urgency=medium + + * Created "client_calc_layer_segfault_fix.patch". (LP: #2011751) + - The client_calc_layer function contains code that loops through a linked + list via a pointer into that list, while simultaneously modifying that + list within the loop. When the list is modified, the pointer into the list + points to invalid data, and attempting to move to the next list element + and then dereference it results in a segfault. To avoid this, a pointer to + the node immediately before the active node is stored before modifying the + list, and this previous node is then used to get a valid pointer into the + list that is in the expected location. + * Updated Maintainer field. + + -- Aaron Rainbolt Sun, 19 Mar 2023 20:36:07 -0500 + openbox (3.6.1-10) unstable; urgency=medium [ Debian Janitor ] diff -Nru openbox-3.6.1/debian/control openbox-3.6.1/debian/control --- openbox-3.6.1/debian/control 2022-01-30 05:51:24.000000000 -0600 +++ openbox-3.6.1/debian/control 2023-03-19 20:36:04.000000000 -0500 @@ -1,7 +1,8 @@ Source: openbox Section: x11 Priority: optional -Maintainer: Mateusz Łukasik +Maintainer: Lubuntu Developers +XSBC-Original-Maintainer: Mateusz Łukasik Build-Depends: debhelper-compat (= 13), gettext, libstartup-notification0-dev, libxrender-dev, pkg-config, libglib2.0-dev, libxml2-dev (>= 2.6.0), perl, libxt-dev, libxinerama-dev, libxrandr-dev, libpango1.0-dev, libx11-dev, diff -Nru openbox-3.6.1/debian/patches/client_calc_layer_segfault_fix.patch openbox-3.6.1/debian/patches/client_calc_layer_segfault_fix.patch --- openbox-3.6.1/debian/patches/client_calc_layer_segfault_fix.patch 1969-12-31 18:00:00.000000000 -0600 +++ openbox-3.6.1/debian/patches/client_calc_layer_segfault_fix.patch 2023-03-19 20:36:07.000000000 -0500 @@ -0,0 +1,47 @@ +Description: Work around invalid pointer shenanigans. + The client_calc_layer function contains code that loops through a linked + list via a pointer into that list, while simultaneously modifying that + list within the loop. When the list is modified, the pointer into the list + points to invalid data, and attempting to move to the next list element + and then dereference it results in a segfault. To avoid this, a pointer to + the node immediately before the active node is stored before modifying the + list, and this previous node is then used to get a valid pointer into the + list that is in the expected location. +Author: Aaron Rainbolt +Bug-Ubuntu: https://bugs.launchpad.net/bugs/2011751 +Bug: https://bugzilla.icculus.org/show_bug.cgi?id=6669 +Forwarded: https://bugzilla.icculus.org/attachment.cgi?id=3647&action=diff +Last-Update: 2023-03-20 +--- + +--- a/openbox/client.c ++++ b/openbox/client.c +@@ -2702,6 +2702,7 @@ static void client_calc_layer_internal(O + void client_calc_layer(ObClient *self) + { + GList *it; ++ GList *itPrev; + + /* skip over stuff above fullscreen layer */ + for (it = stacking_list; it; it = g_list_next(it)) +@@ -2725,8 +2726,19 @@ void client_calc_layer(ObClient *self) + for (; it; it = g_list_next(it)) { + if (window_layer(it->data) < OB_STACKING_LAYER_FULLSCREEN) break; + else if (WINDOW_IS_CLIENT(it->data) && +- !WINDOW_AS_CLIENT(it->data)->visited) ++ !WINDOW_AS_CLIENT(it->data)->visited) { ++ /* "it" becomes invalid when the stacking list is modified by ++ client_calc_layer_internal, so we get the node immediately ++ before "it" and use it to regenerate "it" after modifying the ++ list. */ ++ itPrev = g_list_previous(it); + client_calc_layer_internal(it->data); ++ if (itPrev == NULL) { ++ it = stacking_list; ++ } else { ++ it = g_list_next(itPrev); ++ } ++ } + } + } + diff -Nru openbox-3.6.1/debian/patches/series openbox-3.6.1/debian/patches/series --- openbox-3.6.1/debian/patches/series 2022-01-30 05:48:46.000000000 -0600 +++ openbox-3.6.1/debian/patches/series 2023-03-19 20:36:07.000000000 -0500 @@ -26,3 +26,4 @@ Add-class-hint-to-focus-cycle-popup.patch Fix-collision-between-iterator-and-throw-away-argume.patch 974180.patch +client_calc_layer_segfault_fix.patch