From 1f5b30aeb34ab259b225839f04806c9865a2fb84 Mon Sep 17 00:00:00 2001
From: dvh <vinnyhorgan@gmail.com>
Date: Wed, 11 Nov 2026 10:07:16 +0100
Subject: [PATCH] don't return a freed client for a surface whose toplevel is
 gone

A client can destroy its xdg_toplevel and keep the xdg_surface. wlroots
keeps the role but sets toplevel to NULL, and xdg_surface->data still
points to the Client freed by destroynotify(), so e.g. a popup created on
that surface made toplevel_from_wlr_surface() read freed memory.
---
 client.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client.h b/client.h
index bea7a97..123a584 100644
--- a/client.h
+++ b/client.h
@@ -98,6 +98,8 @@ toplevel_from_wlr_surface(struct wlr_surface *s, Client **pc, LayerSurface **pl)
 			xdg_surface = tmp_xdg_surface;
 			break;
 		case WLR_XDG_SURFACE_ROLE_TOPLEVEL:
+			if (!xdg_surface->toplevel)
+				return -1;
 			c = xdg_surface->data;
 			type = c->type;
 			goto end;