Selecting system theme settings from an INI file which does not contain the expected entries, or from a file which does not exist, replaces the window session with a vaporwave album cover.

As malformed theme settings are saved to the /etc/WindowServer/WindowServer.ini configuration file successfully, rebooting the system will not restore the theme. The session must be restored by blindly selecting a theme from the system menu.

This is caused by a combination of issues:

• No validation is performed on the theme name specified in the /etc/WindowServer/WindowServer.ini configuration file.
• No validation is performed on theme paths used to load theme data to set the system theme to ensure that the file exists.
• No validation is performed on the contents of theme files before loading and parsing this data to create a Gfx::SystemTheme object.
• No validation is performed on the contents of the Gfx::SystemTheme theme data before accessing this buffer in WindowServer.

Historically, this may not have been much of an issue, as the theme colors appear to fall back to black by default. However, themes now contain more than colors, such as metrics and paths to resources (icons). Presumably the metrics are causing the Network menu applet to be duplicated and float in the screenshot above.

The process for setting a theme involves WindowManager::update_theme calling Gfx::load_system_theme(path) from LibGfx::SystemTheme, which returns a shared buffer containing the theme object, then calling Gfx::set_system_theme(buffer) with the newly created theme data.

Reproducing this issue can be achieved by any of the following:

• Creating an empty .ini file in /res/themes/ then selecting the theme using the system menu; or
• Setting Name=invalid-theme-name under [Themes] in /etc/WindowServer/WindowServer.ini then rebooting the system; or
• Any GUI program with permission to interact with the WindowServer IPC can use WindowServer::SetSystemTheme.

#include <AK/StringBuilder.h>
#include <LibGUI/Action.h>
#include <LibGUI/Application.h>
#include <LibGUI/BoxLayout.h>
#include <LibGUI/Button.h>
#include <LibGUI/Event.h>
#include <LibGUI/Icon.h>
#include <LibGUI/Label.h>
#include <LibGUI/MessageBox.h>
#include <LibGUI/Menu.h>
#include <LibGUI/Widget.h>
#include <LibGUI/Window.h>
#include <LibGUI/WindowServerConnection.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <unistd.h>

int main(int argc, char** argv)
{
    auto app = GUI::Application::construct(argc, argv);
    auto window = GUI::Window::construct();
    window->set_title("TestWindowServer");
    window->set_resizable(true);
    window->set_icon(Gfx::Bitmap::load_from_file("/res/icons/16x16/close-tab.png"));

    window->set_window_type(GUI::WindowType::Normal);
    window->set_fullscreen(false);

    auto& main_widget = window->set_main_widget<GUI::Widget>();
    main_widget.set_fill_with_background_color(true);
    main_widget.set_background_color(Color::White);

    auto& layout = main_widget.set_layout<GUI::VerticalBoxLayout>();
    layout.set_margins({ 4, 4, 4, 4 });

    auto& label = main_widget.add<GUI::Label>();
    label.set_text("Hello friends");

    window->show();

    auto result = GUI::WindowServerConnection::the().send_sync<Messages::WindowServer::SetSystemTheme>("/does/not/exist", "lolol");

    return app->exec();
}