fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Skip to content

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT - #4754

Merged
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master
Feb 26, 2026
Merged

fix(linux/xdgportal): don't pass external_only argument to eglQueryDmaBufModifiersEXT#4754
ReenigneArcher merged 1 commit into
LizardByte:masterfrom
leenr:master

Conversation

@leenr

Copy link
Copy Markdown
Contributor

Description

eglQueryDmaBufModifiersEXT function accepts an array of booleans in an external_only argument, not a single boolean, as documented here.

Passing a single boolean may lead to buffer overflow and some local variables of being overridden - e.g. an i variable:

(gdb) watch i
Hardware watchpoint 2: i
(gdb) c
Continuing.
Thread 1"test_sunshine" hit Hardware watchpoint 2: i
Old value = 21
New value = 00x00007ffff049eb06 in ?? () from /usr/lib/libEGL_nvidia.so.0
(gdb) bt
#0 0x00007ffff049eb06 in ??? () at /usr/lib/libEGL_nvidia.so.0#1 0x00007ffff047dd3d in ??? () at /usr/lib/libEGL_nvidia.so.0#2 0x00005555565ae1e5 in portal::portal_t::query_dmabuf_formats (this=0x555558e8e040, egl_display=0x555558bd96b0) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1217#3 0x00005555565af49e in portal::portal_t::get_dmabuf_modifiers (this=0x555558e8e040) at /data/cache-yay/leenr/sunshine-git/src/sunshine/src/platform/linux/portalgrab.cpp:1273

This, in turn, leads to for loop not stopping as it eventually should, and after some time - to an assertion while trying to write to dmabuf_infos[n_dmabuf_infos]:

/usr/include/c++/15.2.1/array:210: constexpr std::array<_Tp, _Nm>::value_type& std::array<_Tp, _Nm>::operator[](size_type) [with _Tp = portal::dmabuf_format_info_t; long unsigned int _Nm = 200; reference = portal::dmabuf_format_info_t&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.

due to n_dmabuf_infos reaching MAX_DMABUF_FORMATS.

Because external_only value is actually not used, it should be safe to just not pass the address at all.
Alternatively, this patch works too:

- EGLBoolean external_only;- eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), &external_only, &num_modifiers);+ std::array<EGLBoolean, MAX_DMABUF_MODIFIERS> external_only;+ eglQueryDmaBufModifiersEXT(egl_display, dmabuf_formats[i], MAX_DMABUF_MODIFIERS, mods.data(), external_only.data(), &num_modifiers);

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

  • feat: New feature (non-breaking change which adds functionality)
  • fix: Bug fix (non-breaking change which fixes an issue)
  • docs: Documentation only changes
  • style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
  • refactor: Code change that neither fixes a bug nor adds a feature
  • perf: Code change that improves performance
  • test: Adding missing tests or correcting existing tests
  • build: Changes that affect the build system or external dependencies
  • ci: Changes to CI configuration files and scripts
  • chore: Other changes that don't modify src or test files
  • revert: Reverts a previous commit
  • BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

  • Code follows the style guidelines of this project
  • Code has been self-reviewed
  • Code has been commented, particularly in hard-to-understand areas
  • Code docstring/documentation-blocks for new or existing methods/components have been added or updated
  • Unit tests have been added or updated for any new or modified functionality

AI Usage

  • None: No AI tools were used in creating this PR
  • Light: AI provided minor assistance (formatting, simple suggestions)
  • Moderate: AI helped with code generation or debugging specific parts
  • Heavy: AI generated most or all of the code changes

@ReenigneArcherReenigneArcher added this to the xdg portal grab milestone Feb 21, 2026
@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 FYI

@psyke83

Copy link
Copy Markdown
Contributor

That change looks reasonable. I'm guessing the proper way to do it would be to call eglQueryDmaBufModifiersEXT twice; the first time to get num_modifiers, and then a second call if num_modifiers is > 0 using external_only initialized as:

EGLBoolean external_only[num_modifiers];

@ReenigneArcher

Copy link
Copy Markdown
Member

@psyke83 could you clarify your comment? Are you asking for an adjustment to this PR?

@leenr

Copy link
Copy Markdown
ContributorAuthor

I can make a PR to fix the capping for mods, but I think it should be made separately from this PR, after it's merge, because external_only will still be unused, and I see it is a completely different issue from what this PR fixes.

@psyke83

Copy link
Copy Markdown
Contributor

The PR is absolutely fine as-is now, since we don't need to check the value, as @leenr said. Apologies for the confusion.

@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@ReenigneArcher
ReenigneArcher merged commit 5395a9a into LizardByte:masterFeb 26, 2026
108 of 115 checks passed
@codecov

codecovBot commented Feb 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 15.37%. Comparing base (83e8fcf) to head (cfa719f).
⚠️ Report is 226 commits behind head on master.

Files with missing linesPatch %Lines
src/platform/linux/portalgrab.cpp0.00%1 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@## master #4754 +/- ##
==========================================
+ Coverage 15.35% 15.37% +0.01% 
==========================================
Files 97 97 Lines 20651 20650 -1 Branches 9419 9419 ==========================================
+ Hits 3171 3174 +3 + Misses 13822 12934 -888 - Partials 3658 4542 +884 
FlagCoverage Δ
Archlinux11.06% <0.00%> (+<0.01%)⬆️
FreeBSD-14.3-aarch64?
FreeBSD-14.3-amd6413.05% <0.00%> (-0.01%)⬇️
Homebrew-ubuntu-22.0413.27% <0.00%> (+<0.01%)⬆️
Windows-AMD6413.49% <ø> (ø)
Windows-ARM6412.35% <ø> (+<0.01%)⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing linesCoverage Δ
src/platform/linux/portalgrab.cpp3.14% <0.00%> (+<0.01%)⬆️

... and 35 files with indirect coverage changes

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@leenr@ReenigneArcher@psyke83