shm: Relax shm_pool_create_buffer() validity check

shm_pool_create_buffer() can raise a false WL_SHM_ERROR_INVALID_STRIDE
error under some circumstances because of integer division.

Fix this by using a strict comparison operator instead of lower or
equal.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Reviewed-by: Simon Ser <contact@emersion.fr>
Reviewed-by: Jonas Ådahl <jadahl@gmail.com>
Closes: https://gitlab.freedesktop.org/wayland/wayland/-/issues/235

diff --git a/src/wayland-shm.c b/src/wayland-shm.c
index 5ff794a..27d5b00 100644 (file)
--- a/src/wayland-shm.c
+++ b/src/wayland-shm.c
@@ -213,7 +213,7 @@ shm_pool_create_buffer(struct wl_client *client, struct wl_resource *resource,
        }
 
        if (offset < 0 || width <= 0 || height <= 0 || stride < width ||
-           INT32_MAX / stride <= height ||
+           INT32_MAX / stride < height ||
            offset > pool->size - stride * height) {
                wl_resource_post_error(resource,
                                       WL_SHM_ERROR_INVALID_STRIDE,