Update access.c with potential fix for Type Confusion alert no. 1893

.github/SECURITY.md

@@ -0,0 +1,50 @@
+# Super Sonic X Security Policy
+
+The Super Sonic X project takes security seriously. If you discover any vulnerabilities, please bring them to our attention right away!
+
+### How to Report a Security Vulnerability
+
+Please **DO NOT** file a public issue to report a security vulberability, instead send your report privately to **legendarydood@gmail.com**. This will help ensure that any vulnerabilities that are found can be [disclosed responsibly](https://en.wikipedia.org/wiki/Responsible_disclosure) to any affected parties.
+
+Include the following information:
+
+1. **Vulnerability description**
+   - What did you observe, and why is it a concern?
+
+2. **Steps to reproduce**
+   - Clear, step-by-step instructions
+   - Include specific configurations or inputs required
+
+3. **System and environment details**
+   - OS version
+   - ssX version or commit hash
+   - Display manager, drivers, or hardware specifics
+
+4. **Supporting data**
+   - Logs (in plain text)
+   - Core dumps (if available and safe to share)
+
+5. **Impact analysis (if known)**
+   - Potential for remote or local exploitation
+   - Possible consequences (e.g. data exposure, privilege escalation, denial-of-service)
+
+Please allow us ample time to validate and patch the issue before disclosing it publicly.
+
+Feel free to privately message HaplessIdiot if the issue is of extreme importance.
+
+We will get back to you as soon as possible.
+
+##  Supported Versions
+
+| Version         | Status                                           |
+| --------------- | ------------------------------------------------ |
+| `master` branch |  Supported and maintained                        |
+| Tagged Releases |  Recieves security updates, resources permitting |
+
+Project versions that are currently being supported with security updates vary per project.
+Please see specific project repositories for details.
+If nothing is specified, only the latest major versions are supported.
+
+---
+
+We appreciate your help in keeping ssX safe for everyone. Let’s build something resilient, secure, and sonic.

.github/workflows/clang.yaml

@@ -0,0 +1,74 @@
+name: Clang-Tidy on Clang + LLVM (OpenMandriva)
+on:
+  push:
+  pull_request:
+
+jobs:
+  clang-tidy:
+    runs-on: ubuntu-latest
+    container:
+      image: openmandriva/cooker
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          echo "max_parallel_downloads=10" >> /etc/dnf/dnf.conf
+          dnf install -y --setopt=protected_packages=bash,glibc,dnf \
+            task-c-devel clang clang-tools llvm lld meson ninja pkgconfig bison flex python3-mako \
+            xkbcomp xkbcomp-devel x11-font-util lib64udev-devel \
+            lib64xau-devel lib64xdmcp-devel gawk \
+            mesa-common-devel lib64gbm-devel lib64GL-devel lib64EGL_mesa-devel \
+            'pkgconfig(xproto)' 'pkgconfig(xtrans)' 'pkgconfig(xkbfile)' \
+            'pkgconfig(xfont2)' 'pkgconfig(nettle)' 'pkgconfig(libbsd)' \
+            'pkgconfig(dbus-1)' 'pkgconfig(xkbcommon)' 'pkgconfig(pixman-1)' \
+            'pkgconfig(epoxy)' 'pkgconfig(pciaccess)' 'pkgconfig(libdrm)' \
+            'pkgconfig(xshmfence)' 'pkgconfig(resourceproto)'
+
+      - name: Create .clang-tidy configuration
+        run: |
+          cat <<EOF > .clang-tidy
+          ---
+          Checks: >
+            -*,
+            bugprone-*,
+            clang-analyzer-*,
+            performance-*,
+            portability-*,
+            -bugprone-reserved-identifier,
+            -bugprone-exception-escape,
+            readability-braces-around-statements,
+            readability-redundant-address-of,
+            readability-redundant-control-flow
+          WarningsAsErrors: 'bugprone-*,clang-analyzer-core.*'
+          ...
+          EOF
+
+      - name: Configure with Meson
+        run: |
+          export CC=clang
+          export CXX=clang++
+
+          rm -rf builddir
+          meson setup builddir --buildtype=debug \
+            -Dxorg=true \
+            -Dglamor=true \
+            -Ddri3=true \
+            -Dhal=false \
+            -Dsecure-rpc=false \
+            -Dxephyr=false \
+            -Dxnest=false \
+            -Dxwin=false \
+            -Ddmx=false || (cat builddir/meson-logs/meson-log.txt && exit 1)
+
+      - name: Run clang-tidy
+        run: |
+          # The -p builddir uses the compile_commands.json Meson just made
+          run-clang-tidy -p builddir -header-filter='.*' -export-fixes=clang-tidy-fixes.yaml || true
+
+      - name: Upload clang-tidy results
+        uses: actions/upload-artifact@v4
+        with:
+          name: clang-tidy-report
+          path: clang-tidy-fixes.yaml

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: "CodeQL Advanced (Display Server Optimized)"
+
+on:
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze C/C++
+    runs-on: self-hosted  # Use my 5800X3D rig instead of the slow GitHub VM
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: c-cpp
+        # Use 'none' if you want a fast scan of all source files
+        # Use 'autobuild' if you want to ensure it compiles (more accurate but slower)
+        build-mode: none 
+
+        # This is the "Magic Sauce" for ssX to prevent the 10MB SARIF error:
+        paths-ignore: |
+          - 'extras/**'
+          - 'fonts/**'
+          - 'doc/**'
+          - 'man/**'
+          - '**/test/**'
+          - '**/testing/**'
+          - '**/examples/**'
+
+        # We use security-extended rather than security-and-quality.
+        # Quality queries add thousands of "style" alerts that bloat the SARIF file.
+        queries: security-extended
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:c-cpp"
+        # If the file is STILL too large, this flag can help compress diagnostics
+        upload: true

.github/workflows/gcc.yml

@@ -0,0 +1,74 @@
+name: Clang-Tidy on GCC + LLD (OpenMandriva)
+on:
+  push:
+  pull_request:
+
+jobs:
+  clang-tidy:
+    runs-on: ubuntu-latest
+    container:
+      image: openmandriva/cooker
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install build dependencies (GCC Edition)
+        run: |
+          echo "max_parallel_downloads=10" >> /etc/dnf/dnf.conf
+          dnf install -y --setopt=protected_packages=bash,glibc,dnf \
+            task-c-devel gcc gcc-c++ binutils meson ninja pkgconfig \
+            bison flex python3-mako xkbcomp xkbcomp-devel x11-font-util \
+            lib64udev-devel lib64xau-devel lib64xdmcp-devel gawk \
+            mesa-common-devel lib64gbm-devel lib64GL-devel lib64EGL_mesa-devel \
+            'pkgconfig(xproto)' 'pkgconfig(xtrans)' 'pkgconfig(xkbfile)' \
+            'pkgconfig(xfont2)' 'pkgconfig(nettle)' 'pkgconfig(libbsd)' \
+            'pkgconfig(dbus-1)' 'pkgconfig(xkbcommon)' 'pkgconfig(pixman-1)' \
+            'pkgconfig(epoxy)' 'pkgconfig(pciaccess)' 'pkgconfig(libdrm)' \
+            'pkgconfig(xshmfence)' 'pkgconfig(resourceproto)'
+
+      - name: Create .clang-tidy configuration
+        run: |
+          cat <<EOF > .clang-tidy
+          ---
+          Checks: >
+            -*,
+            bugprone-*,
+            clang-analyzer-*,
+            performance-*,
+            portability-*,
+            -bugprone-reserved-identifier,
+            -bugprone-exception-escape,
+            readability-braces-around-statements,
+            readability-redundant-address-of,
+            readability-redundant-control-flow
+          WarningsAsErrors: 'bugprone-*,clang-analyzer-core.*'
+          ...
+          EOF
+
+      - name: Configure with Meson (GCC)
+        run: |
+          export CC=gcc
+          export CXX=g++
+
+          rm -rf builddir
+          meson setup builddir --buildtype=debug \
+            -Dxorg=true \
+            -Dglamor=true \
+            -Ddri3=true \
+            -Dhal=false \
+            -Dsecure-rpc=false \
+            -Dxephyr=false \
+            -Dxnest=false \
+            -Dxwin=false \
+            -Ddmx=false || (cat builddir/meson-logs/meson-log.txt && exit 1)
+
+      - name: Run clang-tidy
+        run: |
+          # The -p builddir uses the compile_commands.json Meson just made
+          run-clang-tidy -p builddir -header-filter='.*' -export-fixes=clang-tidy-fixes.yaml || true
+
+      - name: Upload clang-tidy results
+        uses: actions/upload-artifact@v4
+        with:
+          name: clang-tidy-report
+          path: clang-tidy-fixes.yaml

.github/workflows/release.yaml

@@ -0,0 +1,92 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+
+jobs:
+  create-tag:
+    name: Create Tag
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      tag_created: ${{ steps.tag.outputs.tag_created }}
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        fetch-depth: 0
+
+    - name: Fetch all tags
+      run: git fetch --tags --force
+
+    - name: Calculate version
+      id: version
+      run: |
+        NEW_VERSION=$(make -s version)
+        echo "New version: $NEW_VERSION"
+        echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+
+    - name: Create and push tag
+      id: tag
+      run: |
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"
+        git tag -a "${{ steps.version.outputs.version }}" -m "Release ${{ steps.version.outputs.version }}"
+        git push origin "${{ steps.version.outputs.version }}"
+        echo "tag_created=true" >> "$GITHUB_OUTPUT"
+      env:
+        GH_TOKEN: ${{ github.token }}
+
+  goreleaser:
+    name: GoReleaser
+    needs: [create-tag]
+    environment: production
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        fetch-depth: 0
+        ref: ${{ needs.create-tag.outputs.version }}
+
+    - name: Set up Go
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      with:
+        go-version-file: 'go.mod'
+        cache: true
+
+    - name: Run GoReleaser
+      uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
+      with:
+        version: '~> v2'
+        args: release --clean
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  cleanup-on-failure:
+    name: Cleanup on Failure
+    needs: [create-tag, goreleaser]
+    if: failure() && needs.create-tag.outputs.tag_created == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+    - name: Delete release and tag
+      run: |
+        echo "Cleaning up failed release ${{ needs.create-tag.outputs.version }}"
+        gh release delete "${{ needs.create-tag.outputs.version }}" --yes || true
+        git push --delete origin "${{ needs.create-tag.outputs.version }}" || true
+      env:
+        GH_TOKEN: ${{ github.token }}