<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>XI2's copyRawEvent() question</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>In trying to understand a heap corruption when I added XI2 RawMotion event handling to our Xinput-based application, I came across the following routine copyRawEvent() in libxi-1.3/src/XExtInt.c. My question is what is the purpose of computing "len" if it is not used? Should it have been used as an argument to malloc(). <BR>
<BR>
copyRawEvent(XGenericEventCookie *cookie_in,<BR>
XGenericEventCookie *cookie_out)<BR>
{<BR>
XIRawEvent *in, *out;<BR>
void *ptr;<BR>
int len;<BR>
int bits;<BR>
<BR>
in = cookie_in->data;<BR>
<BR>
bits = count_bits(in->valuators.mask, in->valuators.mask_len);<BR>
len = sizeof(XIRawEvent) + in->valuators.mask_len;<BR>
len += bits * sizeof(double) * 2;<BR>
<BR>
ptr = cookie_out->data = malloc(sizeof(XIRawEvent));<BR>
if (!ptr)<BR>
return False;<BR>
<BR>
out = next_block(&ptr, sizeof(XIRawEvent));<BR>
*out = *in;<BR>
out->valuators.mask = next_block(&ptr, out->valuators.mask_len);<BR>
memcpy(out->valuators.mask, in->valuators.mask, out->valuators.mask_len);<BR>
<BR>
out->valuators.values = next_block(&ptr, bits * sizeof(double));<BR>
memcpy(out->valuators.values, in->valuators.values, bits * sizeof(double));<BR>
<BR>
out->raw_values = next_block(&ptr, bits * sizeof(double));<BR>
memcpy(out->raw_values, in->raw_values, bits * sizeof(double));<BR>
<BR>
return True;<BR>
}<BR>
<BR>
When I use valgrind, I get the following output as the culprit for the crash<BR>
<BR>
==4166== Invalid write of size 1<BR>
==4166== at 0x4C29F04: memcpy (mc_replace_strmem.c:497)<BR>
==4166== by 0x8F39180: ??? (in /usr/lib/libXi.so.6.1.0)<BR>
==4166== by 0x7433D48: _XCopyEventCookie (in /usr/lib/libX11.so.6.3.0)<BR>
==4166== by 0x7425166: XPeekEvent (in /usr/lib/libX11.so.6.3.0)<BR>
==4166== by 0x49C3E3: process_key (x11_be.c:1065)<BR>
==4166== by 0x49EA5C: event_key_release (x11_be.c:2201)<BR>
==4166== by 0x49DD6E: x11_be_process_events (x11_be.c:1892)<BR>
==4166== by 0x4A38F4: x11_be_main_loop (x11_be.c:4353)<BR>
==4166== by 0x4A39E1: x11_be_thread_main (x11_be.c:4385)<BR>
==4166== by 0x87549C9: start_thread (pthread_create.c:300)<BR>
==4166== by 0x8A516FC: clone (clone.S:112)<BR>
==4166== Address 0x168afe80 is 0 bytes after a block of size 96 alloc'd<BR>
==4166== at 0x4C284A8: malloc (vg_replace_malloc.c:236)<BR>
==4166== by 0x8F390BD: ??? (in /usr/lib/libXi.so.6.1.0)<BR>
==4166== by 0x7433D48: _XCopyEventCookie (in /usr/lib/libX11.so.6.3.0)<BR>
==4166== by 0x7425166: XPeekEvent (in /usr/lib/libX11.so.6.3.0)<BR>
==4166== by 0x49C3E3: process_key (x11_be.c:1065)<BR>
==4166== by 0x49EA5C: event_key_release (x11_be.c:2201)<BR>
==4166== by 0x49DD6E: x11_be_process_events (x11_be.c:1892)<BR>
==4166== by 0x4A38F4: x11_be_main_loop (x11_be.c:4353)<BR>
==4166== by 0x4A39E1: x11_be_thread_main (x11_be.c:4385)<BR>
==4166== by 0x87549C9: start_thread (pthread_create.c:300)<BR>
<BR>
Thanks in advance,<BR>
<BR>
Roger R. Cruz</FONT>
</P>
</BODY>
</HTML>