Handle Wayland capture stream failures

unix/w0vncserver/pipewire/PipeWireStream.cxx

@@ -89,6 +89,7 @@ PipeWireStream::PipeWireStream(int pipeWireFd_, int nodeId)
 
 PipeWireStream::~PipeWireStream()
 {
+  active = false;
   pw_stream_disconnect(stream);
   // Iterate the loop once after disconnect to ensure proper cleanup.
   // Without this, we saw issues when re-initializing PipeWire
@@ -163,8 +164,9 @@ void PipeWireStream::handleStreamStateChanged(enum pw_stream_state old,
 
   switch (state) {
   case PW_STREAM_STATE_UNCONNECTED:
-    vlog.debug("PipeWire stream disconnected");
-    break;
+    vlog.info("PipeWire stream disconnected");
+    stopped();
+    return;
   case PW_STREAM_STATE_PAUSED:
     // This can happen if the compositor shuts down the session, e.g.
     // a user logs out.

unix/w0vncserver/wayland/objects/ImageCopyCaptureCursorSession.cxx

@@ -58,9 +58,7 @@ ImageCopyCaptureCursorSession::ImageCopyCaptureCursorSession(Display* display_,
                                                              std::function<void(int, int, const core::Point&, uint32_t, uint32_t, const uint8_t*)>
                                                                cursorFrameCb_,
                                                              std::function<void(const core::Point&)>
-                                                               cursorPosCb_,
-                                                             std::function<void()>
-                                                               stoppedCb_)
+                                                               cursorPosCb_)
   : session(session_), captureSession(nullptr),
     cursorFrameCb(cursorFrameCb_), cursorPosCb(cursorPosCb_),
     hotspot({0, 0})
@@ -87,7 +85,7 @@ ImageCopyCaptureCursorSession::ImageCopyCaptureCursorSession(Display* display_,
   captureSession = new ImageCopyCaptureSession(display_,
                                                captureSessionHandle,
                                                bufferEventCb,
-                                               stoppedCb_);
+                                               []() {});
 }
 
 ImageCopyCaptureCursorSession::~ImageCopyCaptureCursorSession()

unix/w0vncserver/wayland/objects/ImageCopyCaptureCursorSession.h

@@ -38,8 +38,7 @@ namespace wayland {
                                   ext_image_copy_capture_cursor_session_v1* session,
                                   std::function<void(int, int, const core::Point&, uint32_t, uint32_t, const uint8_t*)>
                                     cursorFrameCb,
-                                  std::function<void(const core::Point&)> cursorPosCb,
-                                  std::function<void()> stoppedCb);
+                                  std::function<void(const core::Point&)> cursorPosCb);
     ~ImageCopyCaptureCursorSession();
 
   private:

unix/w0vncserver/wayland/objects/ImageCopyCaptureManager.cxx

@@ -103,6 +103,5 @@ void ImageCopyCaptureManager::createSession()
   cursorSession = new ImageCopyCaptureCursorSession(display,
                                                     cursorSessionHandle,
                                                     cursorImageCb,
-                                                    cursorPosCb,
-                                                    stoppedCb);
+                                                    cursorPosCb);
 }

unix/w0vncserver/wayland/objects/ImageCopyCaptureSession.cxx

@@ -21,6 +21,7 @@
 #endif
 
 #include <assert.h>
+#include <stdint.h>
 #include <unistd.h>
 #include <sys/mman.h>
 #include <fcntl.h>
@@ -160,6 +161,7 @@ void ImageCopyCaptureSession::handleDmabufFormat(uint32_t /* format */,
 void ImageCopyCaptureSession::handleDone()
 {
   size_t size;
+  size_t stride;
   int fd;
 
   cleanupBuffers();
@@ -178,6 +180,24 @@ void ImageCopyCaptureSession::handleDone()
   formats = formatsPending;
   formatsPending.clear();
 
+  // wl_shm_create_pool() and wl_buffer use signed 32-bit sizes and strides.
+  // Validate before multiplying so compositor-provided dimensions cannot
+  // wrap the allocation size or produce invalid Wayland arguments.
+  if (width == 0 || height == 0 || width > INT32_MAX / 4 ||
+      height > INT32_MAX) {
+    vlog.error(_("Invalid Wayland buffer size: %u x %u"), width, height);
+    stoppedCb();
+    return;
+  }
+
+  stride = static_cast<size_t>(width) * 4;
+  if (stride > INT32_MAX || stride > INT32_MAX / height) {
+    vlog.error(_("Wayland buffer is too large: %u x %u"), width, height);
+    stoppedCb();
+    return;
+  }
+  size = stride * height;
+
   try {
     format = preferredFormat();
   } catch (std::exception& e) {
@@ -194,11 +214,11 @@ void ImageCopyCaptureSession::handleDone()
     return;
   }
 
-  size = width * height * 4;
   if (ftruncate(fd, size) < 0) {
     vlog.error(_("Failed to create shared memory pool: %s"),
                strerror(errno));
     close(fd);
+    stoppedCb();
     return;
   }
 
@@ -214,7 +234,7 @@ void ImageCopyCaptureSession::handleDone()
 
   close(fd);
 
-  buffer = pool->createBuffer(0, width, height, width * 4, format);
+  buffer = pool->createBuffer(0, width, height, stride, format);
   if (!buffer) {
     vlog.error(_("Failed to create Wayland buffer object"));
     stoppedCb();