Fix memory leaks, undefined behaviour, and resource lifecycle bugs

src/wayland/meta-wayland-buffer.c

@@ -190,6 +190,9 @@ meta_wayland_buffer_realize (MetaWaylandBuffer *buffer)
     {
       buffer->single_pixel.single_pixel_buffer = single_pixel_buffer;
       buffer->type = META_WAYLAND_BUFFER_TYPE_SINGLE_PIXEL;
+      /* Ownership is transferred to the buffer GObject. Clear the wl_resource
+       * user data so that the resource destructor doesn't double-free it. */
+      wl_resource_set_user_data (buffer->resource, NULL);
       return TRUE;
     }
 

src/wayland/meta-wayland-pointer-warp.c

@@ -32,6 +32,7 @@
 struct _MetaWaylandPointerWarp
 {
   MetaWaylandSeat *seat;
+  struct wl_global *global;
   struct wl_list resource_list;
 };
 
@@ -121,17 +122,18 @@ meta_wayland_pointer_warp_new (MetaWaylandSeat *seat)
   pointer_warp->seat = seat;
   wl_list_init (&pointer_warp->resource_list);
 
-  wl_global_create (compositor->wayland_display,
-                    &wp_pointer_warp_v1_interface,
-                    META_WP_POINTER_WARP_VERSION,
-                    pointer_warp, bind_pointer_warp);
+  pointer_warp->global = wl_global_create (compositor->wayland_display,
+                                           &wp_pointer_warp_v1_interface,
+                                           META_WP_POINTER_WARP_VERSION,
+                                           pointer_warp, bind_pointer_warp);
 
   return pointer_warp;
 }
 
 void
 meta_wayland_pointer_warp_destroy (MetaWaylandPointerWarp *pointer_warp)
 {
+  g_clear_pointer (&pointer_warp->global, wl_global_destroy);
   wl_list_remove (&pointer_warp->resource_list);
   g_free (pointer_warp);
 }

src/wayland/meta-wayland-single-pixel-buffer.c

@@ -43,6 +43,16 @@ buffer_destroy (struct wl_client   *client,
   wl_resource_destroy (resource);
 }
 
+static void
+single_pixel_buffer_resource_destroy (struct wl_resource *resource)
+{
+  /* Free the MetaWaylandSinglePixelBuffer if no MetaWaylandBuffer GObject
+   * has taken ownership of it yet (i.e. the buffer was never committed to a
+   * surface).  When realize does take ownership it sets the user data to NULL
+   * so that g_free(NULL) here becomes a safe no-op. */
+  g_free (wl_resource_get_user_data (resource));
+}
+
 static const struct wl_buffer_interface single_pixel_buffer_implementation =
 {
   buffer_destroy,
@@ -77,7 +87,8 @@ single_pixel_buffer_manager_create_1px_rgba32_buffer (struct wl_client   *client
     wl_resource_create (client, &wl_buffer_interface, 1, buffer_id);
   wl_resource_set_implementation (buffer_resource,
                                   &single_pixel_buffer_implementation,
-                                  single_pixel_buffer, NULL);
+                                  single_pixel_buffer,
+                                  single_pixel_buffer_resource_destroy);
   meta_wayland_buffer_from_resource (buffer_resource);
 }
 
@@ -115,7 +126,7 @@ meta_wayland_single_pixel_buffer_attach (MetaWaylandBuffer  *buffer,
   CoglContext *cogl_context =
     clutter_backend_get_cogl_context (clutter_backend);
   MetaWaylandSinglePixelBuffer *single_pixel_buffer =
-    wl_resource_get_user_data (buffer->resource);
+    buffer->single_pixel.single_pixel_buffer;
   uint8_t data[4];
   CoglPixelFormat pixel_format;
   CoglTexture2D *tex_2d;
@@ -140,7 +151,8 @@ meta_wayland_single_pixel_buffer_attach (MetaWaylandBuffer  *buffer,
   tex_2d = cogl_texture_2d_new_from_data (cogl_context,
                                           1, 1,
                                           pixel_format,
-                                          4, data,
+                                          pixel_format == COGL_PIXEL_FORMAT_BGR_888 ? 3 : 4,
+                                          data,
                                           error);
   if (!tex_2d)
     return FALSE;

src/wayland/meta-wayland-touch.c

@@ -415,7 +415,7 @@ check_send_frame_event (MetaWaylandTouch   *touch,
     {
       sequence = clutter_event_get_event_sequence (event);
       slot = meta_event_native_sequence_get_slot (sequence);
-      touch->frame_slots &= ~(1 << slot);
+      touch->frame_slots &= ~((guint64) 1 << slot);
 
       if (touch->frame_slots == 0)
         send_frame_event = TRUE;
@@ -532,7 +532,7 @@ evdev_filter_func (struct libinput_event *event,
       /* XXX: Could theoretically overflow, 64 slots should be
        * enough for most hw/usecases though.
        */
-      touch->frame_slots |= (1 << slot);
+      touch->frame_slots |= ((guint64) 1 << slot);
       break;
     }
     case LIBINPUT_EVENT_TOUCH_CANCEL:

src/x11/meta-x11-display.c

@@ -1296,7 +1296,7 @@ meta_x11_display_new (MetaDisplay *display, GError **error)
                                               xroot,
                                               PropertyChangeMask);
 
-  sprintf (buf, "WM_S%d", number);
+  snprintf (buf, sizeof (buf), "WM_S%d", number);
 
   wm_sn_atom = XInternAtom (xdisplay, buf, False);
   new_wm_sn_owner = take_manager_selection (x11_display, xroot, wm_sn_atom, timestamp, replace_current_wm);