[yeager]

Summary

• Treat a PipeWire stream entering UNCONNECTED as a failed capture session, log it at error level, and stop serving clients with stale frames.
• Preserve the last advertised Wayland shm formats when a session sends another done without repeating the format events.
• Keep failure of the optional pointer cursor capture from closing the main desktop session.
• Reject invalid or oversized compositor-provided buffer dimensions before allocation, and stop the capture session if resizing the shared memory file fails.

Fixes #2144 and addresses the silent freeze in #2154 by surfacing the disconnect and closing connected clients.

Verification

• git diff --check
• Built w0vncserver on Ubuntu 24.04 against this branch; build completed and --version ran successfully.
• GitHub Linux build and unit tests passed on the previous commit; the updated commit's workflow is running.

[CendioHalim]

Sorry for taking so long before looking at this.

I'll see if I can do a test-run on the setup I had where this failed later today.

While I was looking, I noticed that we missed a null check in ~ImageCopyCaptureSession() when session is destroyed. Would you mind adding that while you're at it?

And thank you for the fixes, much appreciated!

[CendioHalim]

Confirmed that this fixes the issue in #2144.

Could you rebase this branch so that the last commit with the fixes are part of their respective commit?

[yeager]

Rebased onto current master and force-pushed the two commits.

The destructor null check has already landed in master as a55e073, so it now comes from the base branch rather than being duplicated in this PR. The buffer-size validation remains in the second commit.

Validation: the rebased w0vncserver build completed on a Linux Wayland/PipeWire host. I also started it as the active GDM Wayland-session user with localhost-only RFB and completed the protocol path through desktop startup. That host has only the GDM greeter session, not an accessible user desktop, so RemoteDesktop correctly refused to capture a session and no framebuffer was read.

Gitleaks found no leaks in the rebased two-commit range.