[hackers] [PATCH] dwm: Fix getatomprop regression from heap overflow fix

From: Chris Down <chris_AT_chrisdown.name>
Date: Wed, 14 Jan 2026 14:58:05 +0800

Commit 244fa852fe27 ("dwm: Fix heap buffer overflow in getatomprop")
introduced a check for dl > 0 before dereferencing the property pointer.
However, I missed that the variable dl is passed to XGetWindowProperty
for both nitems_return and bytes_after_return parameters:

    XGetWindowProperty(..., &dl, &dl, &p)

The final value in dl is bytes_after_return, not nitems_return. For a
successfully read property, bytes_after is typically 0 (indicating all
data was retrieved), so the check `dl > 0` is always false and dwm never
reads any atom properties. So this is safe, but not very helpful :-)

dl is probably just a dummy variable anyway, so fix by using a separate
variable for nitems, and check nitems > 0 as originally intended.

---
 dwm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/dwm.c b/dwm.c
index 8f4fa75..53b393e 100644
--- a/dwm.c
+++ b/dwm.c
_AT_@ -864,13 +864,13 @@ Atom
 getatomprop(Client *c, Atom prop)
 {
 	int di;
-	unsigned long dl;
+	unsigned long nitems, dl;
 	unsigned char *p = NULL;
 	Atom da, atom = None;
 
 	if (XGetWindowProperty(dpy, c->win, prop, 0L, sizeof atom, False, XA_ATOM,
-		&da, &di, &dl, &dl, &p) == Success && p) {
-		if (dl > 0)
+		&da, &di, &nitems, &dl, &p) == Success && p) {
+		if (nitems > 0)
 			atom = *(Atom *)p;
 		XFree(p);
 	}
-- 
2.52.0

Received on Wed Jan 14 2026 - 07:58:05 CET