[fix] validate macOS input display state before injecting events

[fix] guard macOS speaker capture callbacks against invalid buffers
[fix] harden macOS screen capture lifecycle against late callbacks
2026-06-30 11:01:50 +08:00 · 2026-05-28 04:22:14 +08:00 · 2026-05-28 04:22:07 +08:00 · 2026-05-28 04:21:59 +08:00 · 2026-05-28 04:21:52 +08:00 · 2026-05-28 01:34:02 +08:00
12 changed files with 673 additions and 270 deletions
@@ -15,6 +15,7 @@ APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
+INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"

 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +74,82 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF

+xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
+find "${APP_BUNDLE}" -name '._*' -delete
+
 echo ".app created successfully."

+mkdir -p build_pkg_scripts
+cp scripts/macosx/tcc_postinstall.sh build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
+mkdir -p build_pkg_resources
+cat > build_pkg_resources/welcome.html <<EOF
+<!doctype html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
+            font-size: 13px;
+            line-height: 1.5;
+            color: #222;
+            margin: 0;
+            padding: 0;
+        }
+        h1 {
+            font-size: 20px;
+            font-weight: 600;
+            margin: 0 0 12px;
+        }
+        p {
+            margin: 0 0 10px;
+        }
+    </style>
+</head>
+<body>
+    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
+    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
+    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
+    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
+</body>
+</html>
+EOF
+
 echo "building pkg..."
 pkgbuild \
  --identifier "${IDENTIFIER}" \
  --version "${APP_VERSION}" \
  --install-location "/Applications" \
  --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
  build_pkg_temp/${APP_NAME}-component.pkg

-mkdir -p build_pkg_scripts
-
-cat > build_pkg_scripts/postinstall <<'EOF'
-#!/bin/bash
-set -e
-
-IDENTIFIER="cn.crossdesk.app"
-
-# 获取当前登录用户
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
-
-# 清除应用的权限授权，以便重新授权
-# 使用 tccutil 重置录屏权限和辅助功能权限
-if command -v tccutil >/dev/null 2>&1; then
-    # 重置录屏权限
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
-    # 重置辅助功能权限
-    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
-    # 重置摄像头权限（如果需要）
-    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
-    # 重置麦克风权限（如果需要）
-    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
-fi
-
-# 为所有用户清除权限（可选，如果需要）
-# 遍历所有用户目录并清除权限
-for USER_DIR in /Users/*; do
-    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
-        USER_NAME=$(basename "$USER_DIR")
-        # 跳过系统用户
-        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
-            # 删除 TCC 数据库中的相关条目（需要管理员权限）
-            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
-            if [ -f "$TCC_DB" ]; then
-                # 使用 sqlite3 删除相关权限记录（如果可用）
-                if command -v sqlite3 >/dev/null 2>&1; then
-                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
-                fi
-            fi
-        fi
-    fi
-done
-
-exit 0
+cat > build_pkg_temp/Distribution <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="1">
+    <title>${INSTALLER_TITLE}</title>
+    <welcome file="welcome.html" mime-type="text/html"/>
+    <options customize="never" require-scripts="false" hostArchitectures="arm64"/>
+    <choices-outline>
+        <line choice="default">
+            <line choice="${IDENTIFIER}"/>
+        </line>
+    </choices-outline>
+    <choice id="default" title="${INSTALLER_TITLE}"/>
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
+        <pkg-ref id="${IDENTIFIER}"/>
+    </choice>
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
+</installer-gui-script>
 EOF

-chmod +x build_pkg_scripts/postinstall
-
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
+  --package-path build_pkg_temp \
+  --resources build_pkg_resources \
  "${PKG_NAME}"

 echo "PKG package created: ${PKG_NAME}"
@@ -171,8 +187,8 @@ APPLESCRIPT
 fi
 echo "Set icon finished"

-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}

 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
-echo "installer ${PKG_NAME}"
+echo "installer ${PKG_NAME}"
@@ -15,6 +15,7 @@ APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
+INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"

 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +74,82 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF

+xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
+find "${APP_BUNDLE}" -name '._*' -delete
+
 echo ".app created successfully."

+mkdir -p build_pkg_scripts
+cp scripts/macosx/tcc_postinstall.sh build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
+mkdir -p build_pkg_resources
+cat > build_pkg_resources/welcome.html <<EOF
+<!doctype html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
+            font-size: 13px;
+            line-height: 1.5;
+            color: #222;
+            margin: 0;
+            padding: 0;
+        }
+        h1 {
+            font-size: 20px;
+            font-weight: 600;
+            margin: 0 0 12px;
+        }
+        p {
+            margin: 0 0 10px;
+        }
+    </style>
+</head>
+<body>
+    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
+    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
+    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
+    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
+</body>
+</html>
+EOF
+
 echo "building pkg..."
 pkgbuild \
  --identifier "${IDENTIFIER}" \
  --version "${APP_VERSION}" \
  --install-location "/Applications" \
  --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
  build_pkg_temp/${APP_NAME}-component.pkg

-mkdir -p build_pkg_scripts
-
-cat > build_pkg_scripts/postinstall <<'EOF'
-#!/bin/bash
-set -e
-
-IDENTIFIER="cn.crossdesk.app"
-
-# 获取当前登录用户
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
-
-# 清除应用的权限授权，以便重新授权
-# 使用 tccutil 重置录屏权限和辅助功能权限
-if command -v tccutil >/dev/null 2>&1; then
-    # 重置录屏权限
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
-    # 重置辅助功能权限
-    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
-    # 重置摄像头权限（如果需要）
-    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
-    # 重置麦克风权限（如果需要）
-    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
-fi
-
-# 为所有用户清除权限（可选，如果需要）
-# 遍历所有用户目录并清除权限
-for USER_DIR in /Users/*; do
-    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
-        USER_NAME=$(basename "$USER_DIR")
-        # 跳过系统用户
-        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
-            # 删除 TCC 数据库中的相关条目（需要管理员权限）
-            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
-            if [ -f "$TCC_DB" ]; then
-                # 使用 sqlite3 删除相关权限记录（如果可用）
-                if command -v sqlite3 >/dev/null 2>&1; then
-                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
-                fi
-            fi
-        fi
-    fi
-done
-
-exit 0
+cat > build_pkg_temp/Distribution <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="1">
+    <title>${INSTALLER_TITLE}</title>
+    <welcome file="welcome.html" mime-type="text/html"/>
+    <options customize="never" require-scripts="false" hostArchitectures="x86_64"/>
+    <choices-outline>
+        <line choice="default">
+            <line choice="${IDENTIFIER}"/>
+        </line>
+    </choices-outline>
+    <choice id="default" title="${INSTALLER_TITLE}"/>
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
+        <pkg-ref id="${IDENTIFIER}"/>
+    </choice>
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
+</installer-gui-script>
 EOF

-chmod +x build_pkg_scripts/postinstall
-
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
+  --package-path build_pkg_temp \
+  --resources build_pkg_resources \
  "${PKG_NAME}"

 echo "PKG package created: ${PKG_NAME}"
@@ -171,8 +187,8 @@ APPLESCRIPT
 fi
 echo "Set icon finished"

-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}

 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
-echo "installer ${PKG_NAME}"
+echo "installer ${PKG_NAME}"
@@ -0,0 +1,112 @@
+#!/bin/bash
+set -e
+
+APP_IDENTIFIER="cn.crossdesk.app"
+
+# Keep known historical identifiers here. tccutil only resets identifiers that
+# Launch Services can currently resolve, so path/db cleanup below remains a
+# best-effort fallback for stale entries from unsigned or removed builds.
+BUNDLE_IDENTIFIERS=(
+    "cn.crossdesk.app"
+    "cn.crossdesk.CrossDesk"
+    "com.crossdesk.app"
+    "com.crossdesk.CrossDesk"
+    "com.kunkundi.crossdesk"
+    "com.kunkundi.CrossDesk"
+)
+
+TCC_SERVICES=(
+    "ScreenCapture"
+    "Accessibility"
+    "Microphone"
+    "AudioCapture"
+)
+
+run_tccutil() {
+    local user_name="$1"
+    local user_id="$2"
+    local service="$3"
+    local bundle_id="$4"
+
+    if [ -n "$user_name" ] && [ -n "$user_id" ]; then
+        /bin/launchctl asuser "$user_id" \
+            /usr/bin/sudo -u "$user_name" \
+            /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    else
+        /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    fi
+}
+
+reset_bundle_tcc() {
+    local user_name="$1"
+    local user_id="$2"
+    local bundle_id
+    local service
+
+    for bundle_id in "${BUNDLE_IDENTIFIERS[@]}"; do
+        if run_tccutil "$user_name" "$user_id" "All" "$bundle_id"; then
+            continue
+        fi
+
+        for service in "${TCC_SERVICES[@]}"; do
+            run_tccutil "$user_name" "$user_id" "$service" "$bundle_id" || true
+        done
+    done
+}
+
+cleanup_tcc_db() {
+    local db_path="$1"
+
+    if [ ! -f "$db_path" ] || ! command -v sqlite3 >/dev/null 2>&1; then
+        return
+    fi
+
+    /usr/bin/sqlite3 "$db_path" <<'SQL' >/dev/null 2>&1 || true
+DELETE FROM access
+WHERE service IN (
+  'kTCCServiceScreenCapture',
+  'kTCCServiceAccessibility',
+  'kTCCServiceMicrophone',
+  'kTCCServiceAudioCapture'
+)
+AND (
+  client IN (
+    'cn.crossdesk.app',
+    'cn.crossdesk.CrossDesk',
+    'com.crossdesk.app',
+    'com.crossdesk.CrossDesk',
+    'com.kunkundi.crossdesk',
+    'com.kunkundi.CrossDesk'
+  )
+  OR lower(client) LIKE '%crossdesk%'
+);
+SQL
+}
+
+cleanup_user_tcc_db() {
+    local user_name="$1"
+    local home_dir
+
+    home_dir=$(/usr/bin/dscl . -read "/Users/${user_name}" NFSHomeDirectory 2>/dev/null |
+        /usr/bin/awk '{print $2}')
+    if [ -z "$home_dir" ]; then
+        return
+    fi
+
+    cleanup_tcc_db "${home_dir}/Library/Application Support/com.apple.TCC/TCC.db"
+}
+
+CONSOLE_USER=$(/usr/bin/stat -f "%Su" /dev/console 2>/dev/null || true)
+if [ -n "$CONSOLE_USER" ] &&
+   [ "$CONSOLE_USER" != "root" ] &&
+   [ "$CONSOLE_USER" != "loginwindow" ]; then
+    CONSOLE_UID=$(/usr/bin/id -u "$CONSOLE_USER" 2>/dev/null || true)
+    reset_bundle_tcc "$CONSOLE_USER" "$CONSOLE_UID"
+    cleanup_user_tcc_db "$CONSOLE_USER"
+fi
+
+# Also clear any system/root-scoped decisions as a harmless fallback.
+reset_bundle_tcc "" ""
+cleanup_tcc_db "/Library/Application Support/com.apple.TCC/TCC.db"
+
+exit 0
@@ -310,6 +310,10 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
    if (IsFunctionKey(cg_key_code) && !is_down) {
      CGEventRef fn_release_event =
          CGEventCreateKeyboardEvent(NULL, fn_key_code_, false);
+      if (!fn_release_event) {
+        LOG_ERROR("CGEventCreateKeyboardEvent failed for fn release");
+        return -1;
+      }
      CGEventPost(kCGHIDEventTap, fn_release_event);
      CFRelease(fn_release_event);
    }
@@ -1,6 +1,7 @@
 #include "mouse_controller.h"

 #include <ApplicationServices/ApplicationServices.h>
+#include <algorithm>

 #include "rd_log.h"

@@ -20,85 +21,101 @@ int MouseController::Destroy() { return 0; }

 int MouseController::SendMouseCommand(RemoteAction remote_action,
                                      int display_index) {
+  if (remote_action.type != ControlType::mouse) {
+    return 0;
+  }
+
+  if (display_index < 0 ||
+      display_index >= static_cast<int>(display_info_list_.size())) {
+    LOG_WARN("Mouse command skipped, invalid display_index={}, displays={}",
+             display_index, display_info_list_.size());
+    return -1;
+  }
+
+  const DisplayInfo& display_info = display_info_list_[display_index];
+  if (display_info.width <= 0 || display_info.height <= 0) {
+    LOG_WARN("Mouse command skipped, invalid display geometry: {}x{}",
+             display_info.width, display_info.height);
+    return -1;
+  }
+
+  const float normalized_x = std::clamp(remote_action.m.x, 0.0f, 1.0f);
+  const float normalized_y = std::clamp(remote_action.m.y, 0.0f, 1.0f);
  int mouse_pos_x =
-      remote_action.m.x * display_info_list_[display_index].width +
-      display_info_list_[display_index].left;
+      normalized_x * display_info.width + display_info.left;
  int mouse_pos_y =
-      remote_action.m.y * display_info_list_[display_index].height +
-      display_info_list_[display_index].top;
+      normalized_y * display_info.height + display_info.top;

-  if (remote_action.type == ControlType::mouse) {
-    CGEventRef mouse_event = nullptr;
-    CGEventType mouse_type;
-    CGMouseButton mouse_button;
-    CGPoint mouse_point = CGPointMake(mouse_pos_x, mouse_pos_y);
+  CGEventRef mouse_event = nullptr;
+  CGEventType mouse_type;
+  CGMouseButton mouse_button;
+  CGPoint mouse_point = CGPointMake(mouse_pos_x, mouse_pos_y);

-    switch (remote_action.m.flag) {
-      case MouseFlag::left_down:
-        mouse_type = kCGEventLeftMouseDown;
-        left_dragging_ = true;
-        mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
-                                              kCGMouseButtonLeft);
-        break;
-      case MouseFlag::left_up:
-        mouse_type = kCGEventLeftMouseUp;
-        left_dragging_ = false;
-        mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
-                                              kCGMouseButtonLeft);
-        break;
-      case MouseFlag::right_down:
-        mouse_type = kCGEventRightMouseDown;
-        right_dragging_ = true;
-        mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
-                                              kCGMouseButtonRight);
-        break;
-      case MouseFlag::right_up:
-        mouse_type = kCGEventRightMouseUp;
-        right_dragging_ = false;
-        mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
-                                              kCGMouseButtonRight);
-        break;
-      case MouseFlag::middle_down:
-        mouse_type = kCGEventOtherMouseDown;
-        mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
-                                              kCGMouseButtonCenter);
-        break;
-      case MouseFlag::middle_up:
-        mouse_type = kCGEventOtherMouseUp;
-        mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
-                                              kCGMouseButtonCenter);
-        break;
-      case MouseFlag::wheel_vertical:
-        mouse_event = CGEventCreateScrollWheelEvent(
-            NULL, kCGScrollEventUnitLine, 2, remote_action.m.s, 0);
-        break;
-      case MouseFlag::wheel_horizontal:
-        mouse_event = CGEventCreateScrollWheelEvent(
-            NULL, kCGScrollEventUnitLine, 2, 0, remote_action.m.s);
-        break;
-      default:
-        if (left_dragging_) {
-          mouse_type = kCGEventLeftMouseDragged;
-          mouse_button = kCGMouseButtonLeft;
-        } else if (right_dragging_) {
-          mouse_type = kCGEventRightMouseDragged;
-          mouse_button = kCGMouseButtonRight;
-        } else {
-          mouse_type = kCGEventMouseMoved;
-          mouse_button = kCGMouseButtonLeft;
-        }
+  switch (remote_action.m.flag) {
+    case MouseFlag::left_down:
+      mouse_type = kCGEventLeftMouseDown;
+      left_dragging_ = true;
+      mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
+                                            kCGMouseButtonLeft);
+      break;
+    case MouseFlag::left_up:
+      mouse_type = kCGEventLeftMouseUp;
+      left_dragging_ = false;
+      mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
+                                            kCGMouseButtonLeft);
+      break;
+    case MouseFlag::right_down:
+      mouse_type = kCGEventRightMouseDown;
+      right_dragging_ = true;
+      mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
+                                            kCGMouseButtonRight);
+      break;
+    case MouseFlag::right_up:
+      mouse_type = kCGEventRightMouseUp;
+      right_dragging_ = false;
+      mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
+                                            kCGMouseButtonRight);
+      break;
+    case MouseFlag::middle_down:
+      mouse_type = kCGEventOtherMouseDown;
+      mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
+                                            kCGMouseButtonCenter);
+      break;
+    case MouseFlag::middle_up:
+      mouse_type = kCGEventOtherMouseUp;
+      mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
+                                            kCGMouseButtonCenter);
+      break;
+    case MouseFlag::wheel_vertical:
+      mouse_event = CGEventCreateScrollWheelEvent(
+          NULL, kCGScrollEventUnitLine, 2, remote_action.m.s, 0);
+      break;
+    case MouseFlag::wheel_horizontal:
+      mouse_event = CGEventCreateScrollWheelEvent(
+          NULL, kCGScrollEventUnitLine, 2, 0, remote_action.m.s);
+      break;
+    default:
+      if (left_dragging_) {
+        mouse_type = kCGEventLeftMouseDragged;
+        mouse_button = kCGMouseButtonLeft;
+      } else if (right_dragging_) {
+        mouse_type = kCGEventRightMouseDragged;
+        mouse_button = kCGMouseButtonRight;
+      } else {
+        mouse_type = kCGEventMouseMoved;
+        mouse_button = kCGMouseButtonLeft;
+      }

-        mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
-                                              mouse_button);
-        break;
-    }
+      mouse_event = CGEventCreateMouseEvent(NULL, mouse_type, mouse_point,
+                                            mouse_button);
+      break;
+  }

-    if (mouse_event) {
-      CGEventPost(kCGHIDEventTap, mouse_event);
-      CFRelease(mouse_event);
-    }
+  if (mouse_event) {
+    CGEventPost(kCGHIDEventTap, mouse_event);
+    CFRelease(mouse_event);
  }

  return 0;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -636,6 +636,12 @@ int Render::LoadSettingsFromCacheFile() {
 }

 int Render::ScreenCapturerInit() {
+#ifdef __APPLE__
+  if (!EnsureMacScreenRecordingPermission()) {
+    return -1;
+  }
+#endif
+
  if (!screen_capturer_) {
    screen_capturer_ = (ScreenCapturer*)screen_capturer_factory_->Create();
  }
@@ -705,6 +711,12 @@ int Render::ScreenCapturerInit() {
 }

 int Render::StartScreenCapturer() {
+#ifdef __APPLE__
+  if (!EnsureMacScreenRecordingPermission()) {
+    return -1;
+  }
+#endif
+
  if (!screen_capturer_) {
    LOG_INFO("Screen capturer instance missing, recreating before start");
    if (0 != ScreenCapturerInit()) {
@@ -752,11 +764,16 @@ int Render::StartSpeakerCapturer() {
  }

  if (speaker_capturer_) {
-    speaker_capturer_->Start();
+    const int ret = speaker_capturer_->Start();
+    if (ret != 0) {
+      LOG_ERROR("Start speaker capturer failed: {}", ret);
+      return ret;
+    }
    start_speaker_capturer_ = true;
+    return 0;
  }

-  return 0;
+  return -1;
 }

 int Render::StopSpeakerCapturer() {
@@ -769,6 +786,12 @@ int Render::StopSpeakerCapturer() {
 }

 int Render::StartMouseController() {
+#ifdef __APPLE__
+  if (!EnsureMacAccessibilityPermission()) {
+    return -1;
+  }
+#endif
+
  if (!device_controller_factory_) {
    LOG_INFO("Device controller factory is nullptr");
    return -1;
@@ -826,6 +849,13 @@ int Render::StopMouseController() {
 int Render::StartKeyboardCapturer() {
  keyboard_capturer_uses_sdl_events_ = false;

+#ifdef __APPLE__
+  if (!EnsureMacAccessibilityPermission()) {
+    keyboard_capturer_uses_sdl_events_ = true;
+    return 0;
+  }
+#endif
+
 #if defined(__linux__) && !defined(__APPLE__)
  if (IsWaylandSession()) {
    keyboard_capturer_uses_sdl_events_ = true;
@@ -1124,8 +1154,9 @@ void Render::UpdateInteractions() {
  }

  if (start_speaker_capturer_ && !speaker_capturer_is_started_) {
-    StartSpeakerCapturer();
-    speaker_capturer_is_started_ = true;
+    if (0 == StartSpeakerCapturer()) {
+      speaker_capturer_is_started_ = true;
+    }
  } else if (!start_speaker_capturer_ && speaker_capturer_is_started_) {
    StopSpeakerCapturer();
    speaker_capturer_is_started_ = false;
@@ -296,6 +296,9 @@ class Render {
  void OpenScreenRecordingPreferences();
  void OpenAccessibilityPreferences();
  bool DrawToggleSwitch(const char* id, bool active, bool enabled);
+  void RefreshMacPermissionStatus(bool force);
+  bool EnsureMacScreenRecordingPermission();
+  bool EnsureMacAccessibilityPermission();
 #endif

 public:
@@ -550,8 +553,8 @@ class Render {
  std::string remote_client_id_ = "";
  std::unordered_set<int> pressed_keyboard_keys_;
  std::mutex pressed_keyboard_keys_mutex_;
-  SDL_Event last_mouse_event;
-  SDL_AudioStream* output_stream_;
+  SDL_Event last_mouse_event{};
+  SDL_AudioStream* output_stream_ = nullptr;
  uint32_t STREAM_REFRESH_EVENT = 0;
 #if _WIN32
  std::atomic<bool> pending_windows_service_sas_{false};
@@ -681,8 +684,8 @@ class Render {
  // Map file_id to FileTransferState for global file transfer (props == null)
  std::unordered_map<uint32_t, FileTransferState*> file_id_to_transfer_state_;
  std::shared_mutex file_id_to_transfer_state_mutex_;
-  SDL_AudioDeviceID input_dev_;
-  SDL_AudioDeviceID output_dev_;
+  SDL_AudioDeviceID input_dev_ = 0;
+  SDL_AudioDeviceID output_dev_ = 0;
  ScreenCapturerFactory* screen_capturer_factory_ = nullptr;
  ScreenCapturer* screen_capturer_ = nullptr;
  SpeakerCapturerFactory* speaker_capturer_factory_ = nullptr;
@@ -691,7 +694,7 @@ class Render {
  MouseController* mouse_controller_ = nullptr;
  KeyboardCapturer* keyboard_capturer_ = nullptr;
  std::vector<DisplayInfo> display_info_list_;
-  uint64_t last_frame_time_;
+  uint64_t last_frame_time_ = 0;
  std::string last_video_frame_stream_id_;
  bool show_new_version_icon_ = false;
  bool show_new_version_icon_in_menu_ = true;
@@ -699,6 +702,12 @@ class Render {
  double new_version_icon_render_start_time_ = 0.0;
 #ifdef __APPLE__
  bool show_request_permission_window_ = true;
+  bool mac_permission_status_initialized_ = false;
+  uint32_t mac_permission_last_check_tick_ = 0;
+  bool mac_screen_recording_permission_granted_ = false;
+  bool mac_accessibility_permission_granted_ = false;
+  bool mac_screen_recording_permission_requested_ = false;
+  bool mac_accessibility_permission_requested_ = false;
 #endif
  char client_id_[10] = "";
  char client_id_display_[12] = "";
@@ -1196,8 +1196,13 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
          remote_action.k.extended);
    } else if (remote_action.type == ControlType::display_id &&
               render->screen_capturer_) {
-      render->selected_display_ = remote_action.d;
-      render->screen_capturer_->SwitchTo(remote_action.d);
+      const int ret = render->screen_capturer_->SwitchTo(remote_action.d);
+      if (ret == 0) {
+        render->selected_display_ = remote_action.d;
+      } else {
+        LOG_WARN("Display switch skipped, invalid display_id={}",
+                 remote_action.d);
+      }
    }
  }
 }
@@ -6,11 +6,27 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <CoreGraphics/CoreGraphics.h>
 #import <Foundation/Foundation.h>
-#include <unistd.h>
 #include <cstdlib>
+#include <string>

 namespace crossdesk {

+namespace {
+constexpr uint32_t kPermissionRefreshIntervalVisibleMs = 500;
+
+void OpenPrivacyPreferences(const char* pane) {
+  if (pane == nullptr || pane[0] == '\0') {
+    return;
+  }
+
+  std::string command =
+      "open \"x-apple.systempreferences:com.apple.preference.security?";
+  command += pane;
+  command += "\"";
+  system(command.c_str());
+}
+}  // namespace
+
 bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {
  const float TRACK_HEIGHT = ImGui::GetFrameHeight();
  const float TRACK_WIDTH = TRACK_HEIGHT * 1.8f;
@@ -35,16 +51,19 @@ bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {
  bool hovered = ImGui::IsItemHovered();
  bool clicked = ImGui::IsItemClicked() && enabled;

-  ImVec4 track_color = active ? (hovered && enabled ? COLOR_ACTIVE_HOVER : COLOR_ACTIVE)
-                              : (hovered && enabled ? COLOR_INACTIVE_HOVER : COLOR_INACTIVE);
+  ImVec4 track_color =
+      active ? (hovered && enabled ? COLOR_ACTIVE_HOVER : COLOR_ACTIVE)
+             : (hovered && enabled ? COLOR_INACTIVE_HOVER : COLOR_INACTIVE);

  if (!enabled) {
    track_color.w *= DISABLED_ALPHA;
  }

  ImVec2 track_min = ImVec2(track_pos.x, track_pos.y + 0.5f);
-  ImVec2 track_max = ImVec2(track_pos.x + TRACK_WIDTH, track_pos.y + TRACK_HEIGHT - 0.5f);
-  draw_list->AddRectFilled(track_min, track_max, ImGui::GetColorU32(track_color), TRACK_RADIUS);
+  ImVec2 track_max = ImVec2(track_pos.x + TRACK_WIDTH,
+                            track_pos.y + TRACK_HEIGHT - 0.5f);
+  draw_list->AddRectFilled(track_min, track_max,
+                           ImGui::GetColorU32(track_color), TRACK_RADIUS);

  float knob_position = active ? 1.0f : 0.0f;
  float knob_min_x = track_pos.x + KNOB_PADDING;
@@ -59,7 +78,8 @@ bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {

  ImVec2 knob_min = ImVec2(knob_x, knob_y);
  ImVec2 knob_max = ImVec2(knob_x + KNOB_WIDTH, knob_y + KNOB_HEIGHT);
-  draw_list->AddRectFilled(knob_min, knob_max, ImGui::GetColorU32(knob_color), KNOB_RADIUS);
+  draw_list->AddRectFilled(knob_min, knob_max,
+                           ImGui::GetColorU32(knob_color), KNOB_RADIUS);

  return clicked;
 }
@@ -81,29 +101,82 @@ bool Render::CheckAccessibilityPermission() {
 }

 void Render::OpenAccessibilityPreferences() {
-  NSDictionary* options = @{(__bridge id)kAXTrustedCheckOptionPrompt : @YES};
-  AXIsProcessTrustedWithOptions((__bridge CFDictionaryRef)options);
-
-  system("open "
-         "\"x-apple.systempreferences:com.apple.preference.security?Privacy_"
-         "Accessibility\"");
+  if (!mac_accessibility_permission_requested_) {
+    NSDictionary* options = @{(__bridge id)kAXTrustedCheckOptionPrompt : @YES};
+    AXIsProcessTrustedWithOptions((__bridge CFDictionaryRef)options);
+  } else {
+    OpenPrivacyPreferences("Privacy_Accessibility");
+  }
 }

 void Render::OpenScreenRecordingPreferences() {
  if (@available(macOS 10.15, *)) {
-    CGRequestScreenCaptureAccess();
+    if (!mac_screen_recording_permission_requested_) {
+      CGRequestScreenCaptureAccess();
+    } else {
+      OpenPrivacyPreferences("Privacy_ScreenCapture");
+    }
+  } else {
+    OpenPrivacyPreferences("Privacy_ScreenCapture");
+  }
+}
+
+void Render::RefreshMacPermissionStatus(bool force) {
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (!force && mac_permission_status_initialized_ &&
+      now - mac_permission_last_check_tick_ <
+          kPermissionRefreshIntervalVisibleMs) {
+    return;
  }

-  system("open "
-         "\"x-apple.systempreferences:com.apple.preference.security?Privacy_"
-         "ScreenCapture\"");
+  const bool old_screen_recording_granted =
+      mac_screen_recording_permission_granted_;
+  const bool old_accessibility_granted = mac_accessibility_permission_granted_;
+
+  mac_screen_recording_permission_granted_ =
+      CheckScreenRecordingPermission();
+  mac_accessibility_permission_granted_ = CheckAccessibilityPermission();
+  mac_permission_last_check_tick_ = now;
+  mac_permission_status_initialized_ = true;
+
+  if (old_screen_recording_granted !=
+          mac_screen_recording_permission_granted_ ||
+      old_accessibility_granted != mac_accessibility_permission_granted_) {
+    LOG_INFO("macOS permission status: screen_recording={}, accessibility={}",
+             mac_screen_recording_permission_granted_,
+             mac_accessibility_permission_granted_);
+  }
+}
+
+bool Render::EnsureMacScreenRecordingPermission() {
+  RefreshMacPermissionStatus(false);
+  if (mac_screen_recording_permission_granted_) {
+    return true;
+  }
+
+  show_request_permission_window_ = true;
+  return false;
+}
+
+bool Render::EnsureMacAccessibilityPermission() {
+  RefreshMacPermissionStatus(false);
+  if (mac_accessibility_permission_granted_) {
+    return true;
+  }
+
+  show_request_permission_window_ = true;
+  return false;
 }

 int Render::RequestPermissionWindow() {
-  bool screen_recording_granted = CheckScreenRecordingPermission();
-  bool accessibility_granted = CheckAccessibilityPermission();
+  RefreshMacPermissionStatus(false);

-  show_request_permission_window_ = !screen_recording_granted || !accessibility_granted;
+  const bool screen_recording_granted =
+      mac_screen_recording_permission_granted_;
+  const bool accessibility_granted = mac_accessibility_permission_granted_;
+
+  show_request_permission_window_ =
+      !screen_recording_granted || !accessibility_granted;

  if (!show_request_permission_window_) {
    return 0;
@@ -162,8 +235,10 @@ int Render::RequestPermissionWindow() {
  if (accessibility_granted) {
    DrawToggleSwitch("accessibility_toggle_on", true, false);
  } else {
-    if (DrawToggleSwitch("accessibility_toggle", accessibility_granted, !accessibility_granted)) {
+    if (DrawToggleSwitch("accessibility_toggle", false, true)) {
      OpenAccessibilityPreferences();
+      mac_accessibility_permission_requested_ = true;
+      RefreshMacPermissionStatus(true);
    }
  }

@@ -178,12 +253,12 @@ int Render::RequestPermissionWindow() {
  ImGui::AlignTextToFramePadding();
  ImGui::SetCursorPosX(checkbox_padding);
  if (screen_recording_granted) {
-    ImGui::SetCursorPosX(ImGui::GetCursorPosX() + 10.0f);
    DrawToggleSwitch("screen_recording_toggle_on", true, false);
  } else {
-    if (DrawToggleSwitch("screen_recording_toggle", screen_recording_granted,
-                         !screen_recording_granted)) {
+    if (DrawToggleSwitch("screen_recording_toggle", false, true)) {
      OpenScreenRecordingPreferences();
+      mac_screen_recording_permission_requested_ = true;
+      RefreshMacPermissionStatus(true);
    }
  }

@@ -202,4 +277,4 @@ int Render::RequestPermissionWindow() {

  return 0;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -16,7 +16,11 @@ int ScreenCapturerSck::Init(const int fps, cb_desktop_data cb) {
  }

  screen_capturer_sck_impl_ = CreateScreenCapturerSck();
-  screen_capturer_sck_impl_->Init(fps, on_data_);
+  const int ret = screen_capturer_sck_impl_->Init(fps, on_data_);
+  if (ret != 0) {
+    screen_capturer_sck_impl_.reset();
+    return ret;
+  }

  return 0;
 }
@@ -29,8 +33,11 @@ int ScreenCapturerSck::Destroy() {
 }

 int ScreenCapturerSck::Start(bool show_cursor) {
-  screen_capturer_sck_impl_->Start(show_cursor);
-  return 0;
+  if (!screen_capturer_sck_impl_) {
+    return -1;
+  }
+
+  return screen_capturer_sck_impl_->Start(show_cursor);
 }

 int ScreenCapturerSck::Stop() {
@@ -80,4 +87,4 @@ std::vector<DisplayInfo> ScreenCapturerSck::GetDisplayInfoList() {
 void ScreenCapturerSck::OnFrame() {}

 void ScreenCapturerSck::CleanUp() {}
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -16,7 +16,12 @@
 #include <IOKit/graphics/IOGraphicsLib.h>
 #include <IOSurface/IOSurface.h>
 #include <ScreenCaptureKit/ScreenCaptureKit.h>
+#include <algorithm>
 #include <atomic>
+#include <cctype>
+#include <cstring>
+#include <limits>
+#include <map>
 #include <mutex>
 #include <vector>
 #include "display_info.h"
@@ -28,6 +33,15 @@ class ScreenCapturerSckImpl;

 static const int kFullDesktopScreenId = -1;

+static std::string NSErrorToString(NSError *error) {
+  if (!error) {
+    return "";
+  }
+
+  const char *description = [error.localizedDescription UTF8String];
+  return description ? description : "";
+}
+
 // The ScreenCaptureKit API was available in macOS 12.3, but full-screen capture
 // was reported to be broken before macOS 13 - see http://crbug.com/40234870.
 // Also, the `SCContentFilter` fields `contentRect` and `pointPixelScale` were
@@ -78,6 +92,7 @@ class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
  std::map<CGDirectDisplayID, int> display_id_map_reverse_;
  std::map<CGDirectDisplayID, std::string> display_id_name_map_;
  unsigned char *nv12_frame_ = nullptr;
+  size_t nv12_frame_size_ = 0;
  int width_ = 0;
  int height_ = 0;
  int fps_ = 60;
@@ -100,7 +115,7 @@ class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
  // Helper object to receive Objective-C callbacks from ScreenCaptureKit and call into this C++
  // object. The helper may outlive this C++ instance, if a completion-handler is passed to
  // ScreenCaptureKit APIs and the C++ object is deleted before the handler executes.
-  SckHelper *__strong helper_;
+  SckHelper *__strong helper_ = nil;
  // Callback for returning captured frames, or errors, to the caller. Only used on the caller's
  // thread.
  cb_desktop_data _on_data = nullptr;
@@ -110,7 +125,7 @@ class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
  // Guards some variables that may be accessed on different threads.
  std::mutex lock_;
  // Provides captured desktop frames.
-  SCStream *__strong stream_;
+  SCStream *__strong stream_ = nil;
  // Currently selected display, or 0 if the full desktop is selected. This capturer does not
  // support full-desktop capture, and will fall back to the first display.
  CGDirectDisplayID current_display_ = 0;
@@ -182,6 +197,19 @@ ScreenCapturerSckImpl::ScreenCapturerSckImpl() {
 }

 ScreenCapturerSckImpl::~ScreenCapturerSckImpl() {
+  SckHelper *helper_to_release = nil;
+  {
+    std::lock_guard<std::mutex> lock(lock_);
+    if (stream_) {
+      [stream_ stopCaptureWithCompletionHandler:nil];
+      stream_ = nil;
+    }
+    _on_data = nullptr;
+    helper_to_release = helper_;
+    helper_ = nil;
+  }
+  [helper_to_release releaseCapturer];
+
  display_info_list_.clear();
  display_id_map_.clear();
  display_id_map_reverse_.clear();
@@ -190,15 +218,22 @@ ScreenCapturerSckImpl::~ScreenCapturerSckImpl() {
  if (nv12_frame_) {
    delete[] nv12_frame_;
    nv12_frame_ = nullptr;
+    nv12_frame_size_ = 0;
  }
-
-  [stream_ stopCaptureWithCompletionHandler:nil];
-  [helper_ releaseCapturer];
 }

 int ScreenCapturerSckImpl::Init(const int fps, cb_desktop_data cb) {
+  if (!cb) {
+    LOG_ERROR("Screen capturer callback is null");
+    return -1;
+  }
+
  _on_data = cb;
-  fps_ = fps;
+  fps_ = fps > 0 ? fps : 60;
+  display_info_list_.clear();
+  display_id_map_.clear();
+  display_id_map_reverse_.clear();
+  display_id_name_map_.clear();

  if (@available(macOS 10.15, *)) {
    bool has_permission = CGPreflightScreenCaptureAccess();
@@ -216,8 +251,7 @@ int ScreenCapturerSckImpl::Init(const int fps, cb_desktop_data cb) {
      getShareableContentWithCompletionHandler:^(SCShareableContent *result, NSError *error) {
        if (error) {
          capture_error = error;
-          LOG_ERROR("Failed to get shareable content: {}",
-                    std::string([error.localizedDescription UTF8String]));
+          LOG_ERROR("Failed to get shareable content: {}", NSErrorToString(error));
        } else {
          content = result;
        }
@@ -227,7 +261,7 @@ int ScreenCapturerSckImpl::Init(const int fps, cb_desktop_data cb) {

  if (capture_error || !content || content.displays.count == 0) {
    LOG_ERROR("Failed to get display info, error: {}",
-              std::string([capture_error.localizedDescription UTF8String]));
+              NSErrorToString(capture_error));
    return -1;
  }

@@ -284,51 +318,58 @@ int ScreenCapturerSckImpl::Start(bool show_cursor) {
 }

 int ScreenCapturerSckImpl::SwitchTo(int monitor_index) {
-  if (stream_) {
-    [stream_ stopCaptureWithCompletionHandler:^(NSError *error) {
-      std::lock_guard<std::mutex> lock(lock_);
-      stream_ = nil;
-      current_display_ = display_id_map_[monitor_index];
-      StartOrReconfigureCapturer();
-    }];
-  } else {
-    current_display_ = display_id_map_[monitor_index];
-    StartOrReconfigureCapturer();
+  auto display_it = display_id_map_.find(monitor_index);
+  if (display_it == display_id_map_.end()) {
+    LOG_WARN("SwitchTo skipped, invalid monitor_index={}, displays={}",
+             monitor_index, display_id_map_.size());
+    return -1;
  }
+
+  const CGDirectDisplayID target_display = display_it->second;
+  {
+    std::lock_guard<std::mutex> lock(lock_);
+    current_display_ = target_display;
+  }
+  StartOrReconfigureCapturer();
  return 0;
 }

 int ScreenCapturerSckImpl::ResetToInitialMonitor() {
  int target = initial_monitor_index_;
  if (display_info_list_.empty()) return -1;
-  CGDirectDisplayID target_display = display_id_map_[target];
-  if (current_display_ == target_display) return 0;
-  if (stream_) {
-    [stream_ stopCaptureWithCompletionHandler:^(NSError *error) {
-      std::lock_guard<std::mutex> lock(lock_);
-      stream_ = nil;
-      current_display_ = target_display;
-      StartOrReconfigureCapturer();
-    }];
-  } else {
-    current_display_ = target_display;
-    StartOrReconfigureCapturer();
+  auto display_it = display_id_map_.find(target);
+  if (display_it == display_id_map_.end()) {
+    LOG_WARN("ResetToInitialMonitor skipped, invalid monitor_index={}", target);
+    return -1;
  }
+
+  CGDirectDisplayID target_display = display_it->second;
+  if (current_display_ == target_display) return 0;
+  {
+    std::lock_guard<std::mutex> lock(lock_);
+    current_display_ = target_display;
+  }
+  StartOrReconfigureCapturer();
  return 0;
 }

 int ScreenCapturerSckImpl::Destroy() {
-  std::lock_guard<std::mutex> lock(lock_);
-  if (stream_) {
-    LOG_INFO("Destroying stream");
-    [stream_ stopCaptureWithCompletionHandler:nil];
-    stream_ = nil;
+  SckHelper *helper_to_release = nil;
+  {
+    std::lock_guard<std::mutex> lock(lock_);
+    if (stream_) {
+      LOG_INFO("Destroying stream");
+      [stream_ stopCaptureWithCompletionHandler:nil];
+      stream_ = nil;
+    }
+    current_display_ = 0;
+    permanent_error_ = false;
+    _on_data = nullptr;
+    helper_to_release = helper_;
+    helper_ = nil;
  }
-  current_display_ = 0;
-  permanent_error_ = false;
-  _on_data = nullptr;
-  [helper_ releaseCapturer];
-  helper_ = nil;
+
+  [helper_to_release releaseCapturer];

  return 0;
 }
@@ -416,7 +457,7 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten

    // TODO: crbug.com/327458809 - Choose an appropriate sampleHandlerQueue for
    // best performance.
-    NSError *add_stream_output_error;
+    NSError *add_stream_output_error = nil;
    dispatch_queue_t queue = dispatch_queue_create("ScreenCaptureKit.Queue", DISPATCH_QUEUE_SERIAL);
    bool add_stream_output_result = [stream_ addStreamOutput:helper_
                                                        type:SCStreamOutputTypeScreen
@@ -425,7 +466,7 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten

    if (!add_stream_output_result) {
      stream_ = nil;
-      LOG_ERROR("addStreamOutput failed");
+      LOG_ERROR("addStreamOutput failed: {}", NSErrorToString(add_stream_output_error));
      permanent_error_ = true;
      return;
    }
@@ -436,7 +477,7 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
        // calls stopCaptureWithCompletionHandler on the stream, which cancels
        // this handler.
        permanent_error_ = true;
-        LOG_ERROR("startCaptureWithCompletionHandler failed");
+        LOG_ERROR("startCaptureWithCompletionHandler failed: {}", NSErrorToString(error));
      } else {
        LOG_INFO("Capture started");
      }
@@ -448,8 +489,18 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten

 void ScreenCapturerSckImpl::OnNewCVPixelBuffer(CVPixelBufferRef pixelBuffer,
                                               CFDictionaryRef attachment) {
+  (void)attachment;
+  if (!pixelBuffer) {
+    return;
+  }
+
  size_t width = CVPixelBufferGetWidth(pixelBuffer);
  size_t height = CVPixelBufferGetHeight(pixelBuffer);
+  if (width == 0 || height == 0 || CVPixelBufferGetPlaneCount(pixelBuffer) < 2) {
+    LOG_ERROR("Invalid CVPixelBuffer: width={}, height={}, planes={}", width, height,
+              CVPixelBufferGetPlaneCount(pixelBuffer));
+    return;
+  }

  CVReturn status = CVPixelBufferLockBaseAddress(pixelBuffer, kCVPixelBufferLock_ReadOnly);
  if (status != kCVReturnSuccess) {
@@ -458,18 +509,37 @@ void ScreenCapturerSckImpl::OnNewCVPixelBuffer(CVPixelBufferRef pixelBuffer,
  }

  size_t required_size = width * height * 3 / 2;
-  if (!nv12_frame_ || (width_ * height_ * 3 / 2 < required_size)) {
+  if (required_size > static_cast<size_t>((std::numeric_limits<int>::max)())) {
+    LOG_ERROR("Captured frame is too large: {} bytes", required_size);
+    CVPixelBufferUnlockBaseAddress(pixelBuffer, kCVPixelBufferLock_ReadOnly);
+    return;
+  }
+
+  std::lock_guard<std::mutex> lock(lock_);
+  if (!_on_data) {
+    CVPixelBufferUnlockBaseAddress(pixelBuffer, kCVPixelBufferLock_ReadOnly);
+    return;
+  }
+
+  if (!nv12_frame_ || nv12_frame_size_ < required_size) {
    delete[] nv12_frame_;
    nv12_frame_ = new unsigned char[required_size];
-    width_ = width;
-    height_ = height;
+    nv12_frame_size_ = required_size;
  }
+  width_ = static_cast<int>(width);
+  height_ = static_cast<int>(height);

  void *base_y = CVPixelBufferGetBaseAddressOfPlane(pixelBuffer, 0);
  size_t stride_y = CVPixelBufferGetBytesPerRowOfPlane(pixelBuffer, 0);

  void *base_uv = CVPixelBufferGetBaseAddressOfPlane(pixelBuffer, 1);
  size_t stride_uv = CVPixelBufferGetBytesPerRowOfPlane(pixelBuffer, 1);
+  if (!base_y || !base_uv || stride_y < width || stride_uv < width) {
+    LOG_ERROR("Invalid CVPixelBuffer planes: base_y={}, base_uv={}, stride_y={}, stride_uv={}",
+              base_y != nullptr, base_uv != nullptr, stride_y, stride_uv);
+    CVPixelBufferUnlockBaseAddress(pixelBuffer, kCVPixelBufferLock_ReadOnly);
+    return;
+  }

  unsigned char *dst_y = nv12_frame_;
  for (size_t row = 0; row < height; ++row) {
@@ -481,7 +551,8 @@ void ScreenCapturerSckImpl::OnNewCVPixelBuffer(CVPixelBufferRef pixelBuffer,
    memcpy(dst_uv + row * width, static_cast<unsigned char *>(base_uv) + row * stride_uv, width);
  }

-  _on_data(nv12_frame_, width * height * 3 / 2, width, height,
+  _on_data(nv12_frame_, static_cast<int>(required_size), static_cast<int>(width),
+           static_cast<int>(height),
           display_id_name_map_[current_display_].c_str());

  CVPixelBufferUnlockBaseAddress(pixelBuffer, kCVPixelBufferLock_ReadOnly);
@@ -503,10 +574,14 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
  }

  SckHelper *local_helper = helper_;
+  if (!local_helper) {
+    LOG_ERROR("Cannot reconfigure capturer: helper is null");
+    return;
+  }
+
  auto handler = ^(SCShareableContent *content, NSError *error) {
    if (error) {
-      LOG_ERROR("getShareableContent failed: {}",
-                std::string([error.localizedDescription UTF8String]));
+      LOG_ERROR("getShareableContent failed: {}", NSErrorToString(error));
      [local_helper onShareableContentCreated:nil];
      return;
    }
@@ -576,4 +651,4 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {

 std::unique_ptr<ScreenCapturer> ScreenCapturerSck::CreateScreenCapturerSck() {
  return std::make_unique<ScreenCapturerSckImpl>();
-}
+}
@@ -9,6 +9,17 @@ namespace crossdesk {
 class SpeakerCapturerMacosx;
 }

+namespace {
+std::string NSErrorToString(NSError* error) {
+  if (!error) {
+    return "";
+  }
+
+  const char* description = [error.localizedDescription UTF8String];
+  return description ? description : "";
+}
+}  // namespace
+
@interface SpeakerCaptureDelegate : NSObject <SCStreamDelegate, SCStreamOutput>
@property(nonatomic, assign) crossdesk::SpeakerCapturerMacosx* owner;
 - (instancetype)initWithOwner:(crossdesk::SpeakerCapturerMacosx*)owner;
@@ -28,15 +39,36 @@ class SpeakerCapturerMacosx;
                   ofType:(SCStreamOutputType)type {
  if (type != SCStreamOutputTypeAudio) return;

+  crossdesk::SpeakerCapturerMacosx* owner = _owner;
+  if (!owner || !owner->cb_) {
+    return;
+  }
+
  CMBlockBufferRef blockBuffer = CMSampleBufferGetDataBuffer(sampleBuffer);
+  if (!blockBuffer) {
+    return;
+  }
+
  size_t length = CMBlockBufferGetDataLength(blockBuffer);
  char* dataPtr = NULL;
-  CMBlockBufferGetDataPointer(blockBuffer, 0, NULL, NULL, &dataPtr);
+  OSStatus dataStatus =
+      CMBlockBufferGetDataPointer(blockBuffer, 0, NULL, NULL, &dataPtr);
+  if (dataStatus != noErr || dataPtr == nullptr || length == 0) {
+    return;
+  }
+
  CMAudioFormatDescriptionRef formatDesc = CMSampleBufferGetFormatDescription(sampleBuffer);
+  if (!formatDesc) {
+    return;
+  }
+
  const AudioStreamBasicDescription* asbd =
      CMAudioFormatDescriptionGetStreamBasicDescription(formatDesc);
+  if (!asbd || asbd->mChannelsPerFrame == 0) {
+    return;
+  }

-  if (_owner->cb_ && dataPtr && length > 0 && asbd) {
+  if (owner->cb_) {
    std::vector<short> out_pcm16;
    if (asbd->mFormatFlags & kAudioFormatFlagIsFloat) {
      int channels = asbd->mChannelsPerFrame;
@@ -86,7 +118,10 @@ class SpeakerCapturerMacosx;
    size_t total_bytes = out_pcm16.size() * sizeof(short);
    unsigned char* p = (unsigned char*)out_pcm16.data();
    for (size_t offset = 0; offset + frame_bytes <= total_bytes; offset += frame_bytes) {
-      _owner->cb_(p + offset, frame_bytes, "audio");
+      if (!owner->cb_) {
+        return;
+      }
+      owner->cb_(p + offset, frame_bytes, "audio");
    }
  }
 }
@@ -155,7 +190,7 @@ int SpeakerCapturerMacosx::Init(speaker_data_cb cb) {

  if (error || !impl_->content) {
    LOG_ERROR("Failed to get shareable content: {}",
-              std::string([error.localizedDescription UTF8String]));
+              NSErrorToString(error));
    return -1;
  }

@@ -209,7 +244,7 @@ int SpeakerCapturerMacosx::Start() {
                                     error:&addOutputError];
  if (!ok || addOutputError) {
    LOG_ERROR("addStreamOutput error: {}",
-              std::string([addOutputError.localizedDescription UTF8String]));
+              NSErrorToString(addOutputError));
    impl_->stream = nil;
    impl_->delegate = nil;
    return -1;
@@ -220,7 +255,7 @@ int SpeakerCapturerMacosx::Start() {
  [impl_->stream startCaptureWithCompletionHandler:^(NSError* _Nullable error) {
    if (error) {
      LOG_ERROR("startCaptureWithCompletionHandler error: {}",
-                std::string([error.localizedDescription UTF8String]));
+                NSErrorToString(error));
      ret = -1;
    }
    dispatch_semaphore_signal(semaStart);
@@ -238,13 +273,14 @@ int SpeakerCapturerMacosx::Stop() {
  [impl_->stream stopCaptureWithCompletionHandler:^(NSError* error) {
    if (error) {
      LOG_ERROR("stopCaptureWithCompletionHandler error: {}",
-                std::string([error.localizedDescription UTF8String]));
+                NSErrorToString(error));
    }
    dispatch_semaphore_signal(sema);
  }];
  dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);

  impl_->stream = nil;
+  impl_->delegate.owner = nullptr;
  impl_->delegate = nil;

  return 0;
@@ -269,4 +305,4 @@ int SpeakerCapturerMacosx::Destroy() {
 int SpeakerCapturerMacosx::Pause() { return 0; }

 int SpeakerCapturerMacosx::Resume() { return Start(); }
-}  // namespace crossdesk
+}  // namespace crossdesk
Author	SHA1	Message	Date
dijunkun	32345f93bf	[fix] validate macOS input display state before injecting events	2026-05-28 04:22:14 +08:00
dijunkun	193e4bd5bf	[fix] guard macOS speaker capture callbacks against invalid buffers	2026-05-28 04:22:07 +08:00
dijunkun	53edf3d57e	[fix] harden macOS screen capture lifecycle against late callbacks	2026-05-28 04:21:59 +08:00
dijunkun	895e297771	[fix] initialize render runtime state to avoid invalid SDL handles	2026-05-28 04:21:52 +08:00
dijunkun	8f3959e6c6	[fix] reset stale macOS permissions during install	2026-05-28 01:34:02 +08:00
dijunkun	5ff6b601c7	[fix] improve macOS permission request flow	2026-05-28 01:33:50 +08:00