From 4e90fdd5c7562db26f017509c063aa14222ffd19 Mon Sep 17 00:00:00 2001
From: Hojun-Cho <ghwns6743@gmail.com>
Date: Wed, 12 Aug 2026 17:34:34 +0900
Subject: [PATCH] fix: harden caret and IBus dispatch

---
 dat.h               |  1 -
 ibus.c              |  7 ++++---
 popup_layout.c      | 16 ++++++++++------
 tests/engine_test.c |  2 --
 tests/popup_test.c  |  7 +++++++
 5 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/dat.h b/dat.h
index d904969..e4a61b4 100644
--- a/dat.h
+++ b/dat.h
@@ -135,7 +135,6 @@ struct Caret
 	int	valid;
 	int	x;
 	int	y;
-	int	w;
 	int	h;
 };
 
diff --git a/ibus.c b/ibus.c
index 36e4cff..63d4353 100644
--- a/ibus.c
+++ b/ibus.c
@@ -558,7 +558,6 @@ handlecursor(DBusConnection *c, DBusMessage *m, Ictx *ctx)
 	ctx->caret.valid = 1;
 	ctx->caret.x = x;
 	ctx->caret.y = y;
-	ctx->caret.w = w;
 	ctx->caret.h = h;
 	if(ctx->focused)
 		sendrequest(ctx, Keycaret, 0, 0, &res);
@@ -743,6 +742,7 @@ void
 ibusthread(void *_)
 {
 	struct pollfd pfds[Maxwatches];
+	DBusWatch *polled[Maxwatches];
 	int wi[Maxwatches];
 	int i, n, rv;
 	unsigned int f;
@@ -765,6 +765,7 @@ ibusthread(void *_)
 			if(f & DBUS_WATCH_READABLE) pfds[n].events |= POLLIN;
 			if(f & DBUS_WATCH_WRITABLE) pfds[n].events |= POLLOUT;
 			wi[n] = i;
+			polled[n] = watches[i].w;
 			n++;
 		}
 		rv = poll(pfds, n, 200);
@@ -773,14 +774,14 @@ ibusthread(void *_)
 		for(i = 0; i < n; i++){
 			if(pfds[i].revents == 0)
 				continue;
-			if(watches[wi[i]].w == nil)
+			if(watches[wi[i]].w != polled[i])
 				continue;
 			f = 0;
 			if(pfds[i].revents & POLLIN) f |= DBUS_WATCH_READABLE;
 			if(pfds[i].revents & POLLOUT) f |= DBUS_WATCH_WRITABLE;
 			if(pfds[i].revents & POLLHUP) f |= DBUS_WATCH_HANGUP;
 			if(pfds[i].revents & POLLERR) f |= DBUS_WATCH_ERROR;
-			dbus_watch_handle(watches[wi[i]].w, f);
+			dbus_watch_handle(polled[i], f);
 		}
 		for(i = 0; i < nconns; i++)
 			while(dbus_connection_dispatch(conns[i]) == DBUS_DISPATCH_DATA_REMAINS)
diff --git a/popup_layout.c b/popup_layout.c
index c4d6d4b..bedf6e7 100644
--- a/popup_layout.c
+++ b/popup_layout.c
@@ -17,13 +17,17 @@ void
 popupposition(Caret *caret, int pointerx, int pointery, int screenw,
 	int screenh, int w, int h, int *x, int *y)
 {
+	vlong px, py, xmax, ymax;
+
 	if(caret->valid){
-		*x = caret->x;
-		*y = caret->y + max(caret->h, 0);
+		px = caret->x;
+		py = (vlong)caret->y + max(caret->h, 0);
 	}else{
-		*x = pointerx + 10;
-		*y = pointery + 10;
+		px = (vlong)pointerx + 10;
+		py = (vlong)pointery + 10;
 	}
-	*x = max(0, min(*x, screenw - w));
-	*y = max(0, min(*y, screenh - h));
+	xmax = max((vlong)screenw - w, 0);
+	ymax = max((vlong)screenh - h, 0);
+	*x = max(0, min(px, xmax));
+	*y = max(0, min(py, ymax));
 }
diff --git a/tests/engine_test.c b/tests/engine_test.c
index 42fbf23..cd7e040 100644
--- a/tests/engine_test.c
+++ b/tests/engine_test.c
@@ -249,7 +249,6 @@ engine_active_owner_caret(struct ct *t)
 	a.valid = 1;
 	a.x = 10;
 	a.y = 20;
-	a.w = 3;
 	a.h = 14;
 	moved = a;
 	moved.x = 80;
@@ -1221,7 +1220,6 @@ engine_randomized_stress(struct ct *t)
 		pos.valid = (rnd >> 25) & 1;
 		pos.x = (rnd >> 3) & 0x3ff;
 		pos.y = (rnd >> 13) & 0x3ff;
-		pos.w = 1 + ((rnd >> 23) & 0x1f);
 		pos.h = 1 + ((rnd >> 18) & 0x1f);
 		if(op < 13)
 			res = ownerrequestat(owner, Keypress,
diff --git a/tests/popup_test.c b/tests/popup_test.c
index a343dd0..6c413af 100644
--- a/tests/popup_test.c
+++ b/tests/popup_test.c
@@ -1,4 +1,5 @@
 #include "test.h"
+#include <limits.h>
 
 void
 popup_layout(struct ct *t)
@@ -24,4 +25,10 @@ popup_layout(struct ct *t)
 	popupposition(&caret, 0, 0, 800, 600, 100, 60, &x, &y);
 	CT_EQ_INT(t, 700, x);
 	CT_EQ_INT(t, 540, y);
+	caret.x = INT_MIN;
+	caret.y = INT_MAX;
+	caret.h = INT_MAX;
+	popupposition(&caret, 0, 0, 800, 600, 100, 60, &x, &y);
+	CT_EQ_INT(t, 0, x);
+	CT_EQ_INT(t, 540, y);
 }