From 815d71a3aa24cfb87870741319cae99ba1726b8f Mon Sep 17 00:00:00 2001
From: Tony Crisci <tony@dubstepdish.com>
Date: Wed, 27 Dec 2017 08:04:01 -0500
Subject: [PATCH] validate grab serial for shell events

---
 include/wlr/types/wlr_seat.h |  6 ++++++
 rootston/wl_shell.c          |  1 -
 types/wlr_seat.c             |  5 +++++
 types/wlr_wl_shell.c         | 10 ++++++++++
 types/wlr_xdg_shell_v6.c     | 15 +++++++++++++++
 5 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/include/wlr/types/wlr_seat.h b/include/wlr/types/wlr_seat.h
index 28e9a615..f7dea52f 100644
--- a/include/wlr/types/wlr_seat.h
+++ b/include/wlr/types/wlr_seat.h
@@ -509,4 +509,10 @@ int wlr_seat_touch_num_points(struct wlr_seat *seat);
  */
 bool wlr_seat_touch_has_grab(struct wlr_seat *seat);
 
+/**
+ * Check whether this serial is valid to start a grab action such as an
+ * interactive move or resize.
+ */
+bool wlr_seat_validate_grab_serial(struct wlr_seat *seat, uint32_t serial);
+
 #endif
diff --git a/rootston/wl_shell.c b/rootston/wl_shell.c
index 7f70acae..65067920 100644
--- a/rootston/wl_shell.c
+++ b/rootston/wl_shell.c
@@ -43,7 +43,6 @@ static void handle_request_resize(struct wl_listener *listener, void *data) {
 	struct roots_input *input = view->desktop->server->input;
 	struct wlr_wl_shell_surface_resize_event *e = data;
 	struct roots_seat *seat = input_seat_from_wlr_seat(input, e->seat->seat);
-	// TODO verify input event
 	if (!seat || seat->cursor->mode != ROOTS_CURSOR_PASSTHROUGH) {
 		return;
 	}
diff --git a/types/wlr_seat.c b/types/wlr_seat.c
index c1401b4a..b69e666b 100644
--- a/types/wlr_seat.c
+++ b/types/wlr_seat.c
@@ -1216,3 +1216,8 @@ int wlr_seat_touch_num_points(struct wlr_seat *seat) {
 bool wlr_seat_touch_has_grab(struct wlr_seat *seat) {
 	return seat->touch_state.grab->interface != &default_touch_grab_impl;
 }
+
+bool wlr_seat_validate_grab_serial(struct wlr_seat *seat, uint32_t serial) {
+	return serial == seat->pointer_state.grab_serial ||
+		serial == seat->touch_state.grab_serial;
+}
diff --git a/types/wlr_wl_shell.c b/types/wlr_wl_shell.c
index a13717c1..03ce2c20 100644
--- a/types/wlr_wl_shell.c
+++ b/types/wlr_wl_shell.c
@@ -112,6 +112,11 @@ static void shell_surface_protocol_move(struct wl_client *client,
 	struct wlr_seat_client *seat =
 		wl_resource_get_user_data(seat_resource);
 
+	if (!wlr_seat_validate_grab_serial(seat->seat, serial)) {
+		wlr_log(L_DEBUG, "invalid serial for grab");
+		return;
+	}
+
 	struct wlr_wl_shell_surface_move_event event = {
 		.surface = surface,
 		.seat = seat,
@@ -170,6 +175,11 @@ static void shell_surface_protocol_resize(struct wl_client *client,
 	struct wlr_seat_client *seat =
 		wl_resource_get_user_data(seat_resource);
 
+	if (!wlr_seat_validate_grab_serial(seat->seat, serial)) {
+		wlr_log(L_DEBUG, "invalid serial for grab");
+		return;
+	}
+
 	struct wlr_wl_shell_surface_resize_event event = {
 		.surface = surface,
 		.seat = seat,
diff --git a/types/wlr_xdg_shell_v6.c b/types/wlr_xdg_shell_v6.c
index 09675a7b..3d9dc404 100644
--- a/types/wlr_xdg_shell_v6.c
+++ b/types/wlr_xdg_shell_v6.c
@@ -565,6 +565,11 @@ static void xdg_toplevel_protocol_show_window_menu(struct wl_client *client,
 		return;
 	}
 
+	if (!wlr_seat_validate_grab_serial(seat->seat, serial)) {
+		wlr_log(L_DEBUG, "invalid serial for grab");
+		return;
+	}
+
 	struct wlr_xdg_toplevel_v6_show_window_menu_event event = {
 		.surface = surface,
 		.seat = seat,
@@ -590,6 +595,11 @@ static void xdg_toplevel_protocol_move(struct wl_client *client,
 		return;
 	}
 
+	if (!wlr_seat_validate_grab_serial(seat->seat, serial)) {
+		wlr_log(L_DEBUG, "invalid serial for grab");
+		return;
+	}
+
 	struct wlr_xdg_toplevel_v6_move_event event = {
 		.surface = surface,
 		.seat = seat,
@@ -613,6 +623,11 @@ static void xdg_toplevel_protocol_resize(struct wl_client *client,
 		return;
 	}
 
+	if (!wlr_seat_validate_grab_serial(seat->seat, serial)) {
+		wlr_log(L_DEBUG, "invalid serial for grab");
+		return;
+	}
+
 	struct wlr_xdg_toplevel_v6_resize_event event = {
 		.surface = surface,
 		.seat = seat,