From 813ac037761fe7caf342fab95fa8da41b1a168a7 Mon Sep 17 00:00:00 2001
From: Matthias Clasen <mclasen@redhat.com>
Date: Mon, 4 May 2026 17:23:25 -0400
Subject: [PATCH] Fix a crash in gdk_drag_finish

Resolves: RHEL-151642
---
 0005-socket-sanity-check.patch | 27 ++++++++++++++
 0006-drag-finish-crash.patch   | 66 ++++++++++++++++++++++++++++++++++
 gtk3.spec                      |  4 +++
 3 files changed, 97 insertions(+)
 create mode 100644 0005-socket-sanity-check.patch
 create mode 100644 0006-drag-finish-crash.patch

diff --git a/0005-socket-sanity-check.patch b/0005-socket-sanity-check.patch
new file mode 100644
index 0000000..2c06497
--- /dev/null
+++ b/0005-socket-sanity-check.patch
@@ -0,0 +1,27 @@
+From 1d29335cbfbd4a6d3c39664c68145a7966fdbd14 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ga=C3=ABl=20Bonithon?= <gael@xfce.org>
+Date: Sat, 3 Feb 2024 22:33:57 +0100
+Subject: [PATCH] gtksocket: Fix wrong sanity check
+
+This avoids a critical warning from gtk_widget_get_parent() if
+focus_widget == NULL.
+---
+ gtk/gtksocket.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gtk/gtksocket.c b/gtk/gtksocket.c
+index ffdaf8bee4..7b87b4d806 100644
+--- a/gtk/gtksocket.c
++++ b/gtk/gtksocket.c
+@@ -1260,7 +1260,7 @@ gtk_socket_advance_toplevel_focus (GtkSocket        *socket,
+     }
+ 
+   focus_widget = gtk_window_get_focus (window);
+-  if (window)
++  if (focus_widget)
+     {
+       /* Wrapped off the end, clear the focus setting for the toplevel */
+       parent = gtk_widget_get_parent (focus_widget);
+-- 
+2.53.0
+
diff --git a/0006-drag-finish-crash.patch b/0006-drag-finish-crash.patch
new file mode 100644
index 0000000..9efc3b9
--- /dev/null
+++ b/0006-drag-finish-crash.patch
@@ -0,0 +1,66 @@
+From 34c12e4885dcb712272c441941234187cb131bc3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ga=C3=ABl=20Bonithon?= <gael@xfce.org>
+Date: Sun, 10 Dec 2023 10:17:00 +0100
+Subject: [PATCH] gtkdnd: Keep a reference on destination drag context
+
+If we don't keep a reference on it, it is released somewhere before
+gtk_drag_abort_timeout is called. This can cause a crash e.g. when the
+dnd takes place in the GtkSocket/GtkPlug framework.
+
+Fixes: #7128
+---
+ gtk/gtkdnd.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/gtk/gtkdnd.c b/gtk/gtkdnd.c
+index a660f4db21..d2bc74f26c 100644
+--- a/gtk/gtkdnd.c
++++ b/gtk/gtkdnd.c
+@@ -2666,6 +2666,8 @@ gtk_drag_drop (GtkDragSourceInfo *info,
+     {
+       if (info->icon_window)
+         gtk_widget_hide (info->icon_window);
++      if (info->proxy_dest)
++        g_object_ref (info->proxy_dest->context);
+ 
+       gdk_drag_drop (info->context, time);
+       info->drop_timeout = gdk_threads_add_timeout (DROP_ABORT_TIME,
+@@ -2814,7 +2816,11 @@ gtk_drag_source_info_destroy (GtkDragSourceInfo *info)
+   gtk_target_list_unref (info->target_list);
+ 
+   if (info->drop_timeout)
+-    g_source_remove (info->drop_timeout);
++    {
++      g_source_remove (info->drop_timeout);
++      if (info->proxy_dest)
++        g_object_unref (info->proxy_dest->context);
++    }
+ 
+   if (info->update_idle)
+     g_source_remove (info->update_idle);
+@@ -3260,14 +3266,20 @@ static gboolean
+ gtk_drag_abort_timeout (gpointer data)
+ {
+   GtkDragSourceInfo *info = data;
++  GdkDragContext *context = NULL;
+   guint32 time = GDK_CURRENT_TIME;
+ 
+   if (info->proxy_dest)
+-    time = info->proxy_dest->proxy_drop_time;
++    {
++      time = info->proxy_dest->proxy_drop_time;
++      context = info->proxy_dest->context;
++    }
+ 
+   info->drop_timeout = 0;
+   gtk_drag_drop_finished (info, GTK_DRAG_RESULT_TIMEOUT_EXPIRED, time);
+-  
++
++  g_clear_object (&context);
++
+   return FALSE;
+ }
+ 
+-- 
+2.53.0
+
diff --git a/gtk3.spec b/gtk3.spec
index 4a3b22f..d498e16 100644
--- a/gtk3.spec
+++ b/gtk3.spec
@@ -50,6 +50,9 @@ Patch10: 0003-shortcutwindow-Differentiate-keypad-better.patch
 Patch11: 0001-gdk-wayland-Switch-behavior-of-BTN_STYLUS-STYLUS2-as.patch
 # https://redhat.atlassian.net/browse/RHEL-85085
 Patch12: 0004-menu-scrolling.patch
+# https://redhat.atlassian.net/browse/RHEL-151642
+Patch13: 0005-socket-sanity-check.patch
+Patch14: 0006-drag-finish-crash.patch
 
 BuildRequires: pkgconfig(atk) >= %{atk_version}
 BuildRequires: pkgconfig(atk-bridge-2.0)
@@ -319,6 +322,7 @@ gtk-query-immodules-3.0-%{__isa_bits} --update-cache &>/dev/null || :
 %changelog
 * Mon May  4 2026 Matthias Clasen <mclasen@redhat.com> - 3.24.31-10
 - Resolves: RHEL-85085
+- Resolves: RHEL-151642
 
 * Mon Apr 20 2026 Carlos Garnacho <cgarnach@redhat.com> - 3.24.31-9
 - Switch stylus button order to match compositor