xserver: Branch 'master' - 11 commits
Peter Hutterer
whot at kemper.freedesktop.org
Wed Sep 2 15:44:48 PDT 2009
Xi/exevents.c | 16 ++++++++---
Xi/xiallowev.h | 8 ++++-
Xi/xichangehierarchy.h | 2 -
Xi/xigrabdev.c | 9 +++++-
Xi/xigrabdev.h | 8 ++++-
Xi/xipassivegrab.c | 16 ++++-------
Xi/xipassivegrab.h | 8 ++++-
Xi/xiproperty.h | 6 +++-
Xi/xiselectev.c | 50 ++++++++++++++++++++++++++++---------
Xi/xiselectev.h | 5 +++
Xi/xisetdevfocus.h | 4 ++
dix/inpututils.c | 2 -
dix/window.c | 3 +-
include/exevents.h | 5 ++-
include/input.h | 2 -
test/Makefile.am | 2 -
test/xi2/protocol-common.h | 2 -
test/xi2/protocol-xiselectevents.c | 24 ++++++++++++++---
18 files changed, 126 insertions(+), 46 deletions(-)
New commits:
commit d481720c57f558c47273bf89854fc69254319772
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Wed Sep 2 15:28:28 2009 +1000
Xi: standardise XI2 headers.
Adding missing dix-config.h include, adding one missing header guard.
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/Xi/xiallowev.h b/Xi/xiallowev.h
index 97a0f25..3a417b9 100644
--- a/Xi/xiallowev.h
+++ b/Xi/xiallowev.h
@@ -23,10 +23,14 @@
* Author: Peter Hutterer
*/
+#ifdef HAVE_DIX_CONFIG_H
+#include <dix-config.h>
+#endif
+
#ifndef XIALLOWEV_H
-#define XIALLOWEV_H
+#define XIALLOWEV_H 1
int ProcXIAllowEvents(ClientPtr client);
int SProcXIAllowEvents(ClientPtr client);
-#endif
+#endif /* XIALLOWEV_H */
diff --git a/Xi/xichangehierarchy.h b/Xi/xichangehierarchy.h
index b46cfb4..483c6cd 100644
--- a/Xi/xichangehierarchy.h
+++ b/Xi/xichangehierarchy.h
@@ -41,4 +41,4 @@ int ProcXIChangeHierarchy(ClientPtr /* client */);
void XISendDeviceHierarchyEvent(int flags[]);
-#endif
+#endif /* CHDEVHIER_H */
diff --git a/Xi/xigrabdev.h b/Xi/xigrabdev.h
index 6136997..08309c9 100644
--- a/Xi/xigrabdev.h
+++ b/Xi/xigrabdev.h
@@ -23,8 +23,12 @@
* Author: Peter Hutterer
*/
+#ifdef HAVE_DIX_CONFIG_H
+#include <dix-config.h>
+#endif
+
#ifndef XIGRABDEV_H
-#define XIGRABDEV_H
+#define XIGRABDEV_H 1
int ProcXIGrabDevice(ClientPtr client);
int SProcXIGrabDevice(ClientPtr client);
@@ -34,4 +38,4 @@ int SProcXIUngrabDevice(ClientPtr client);
void SRepXIGrabDevice(ClientPtr client, int size, xXIGrabDeviceReply * rep);
-#endif
+#endif /* XIGRABDEV_H */
diff --git a/Xi/xipassivegrab.h b/Xi/xipassivegrab.h
index 84fb5eb..079e7c6 100644
--- a/Xi/xipassivegrab.h
+++ b/Xi/xipassivegrab.h
@@ -23,8 +23,12 @@
* Author: Peter Hutterer
*/
+#ifdef HAVE_DIX_CONFIG_H
+#include <dix-config.h>
+#endif
+
#ifndef XIPASSIVEGRAB_H
-#define XIPASSIVEGRAB_H
+#define XIPASSIVEGRAB_H 1
int SProcXIPassiveUngrabDevice(ClientPtr client);
int ProcXIPassiveUngrabDevice(ClientPtr client);
@@ -32,4 +36,4 @@ void SRepXIPassiveGrabDevice(ClientPtr client, int size, xXIPassiveGrabDeviceRep
int ProcXIPassiveGrabDevice(ClientPtr client);
int SProcXIPassiveGrabDevice(ClientPtr client);
-#endif
+#endif /* XIPASSIVEGRAB_H */
diff --git a/Xi/xiproperty.h b/Xi/xiproperty.h
index bc4bbae..69b41fa 100644
--- a/Xi/xiproperty.h
+++ b/Xi/xiproperty.h
@@ -23,8 +23,12 @@
* Author: Peter Hutterer
*/
+#ifdef HAVE_DIX_CONFIG_H
+#include <dix-config.h>
+#endif
+
#ifndef XIPROPERTY_H
-#define XIPROPERTY_H
+#define XIPROPERTY_H 1
int ProcXListDeviceProperties (ClientPtr client);
int ProcXChangeDeviceProperty (ClientPtr client);
diff --git a/Xi/xiselectev.h b/Xi/xiselectev.h
index 5efc648..21ec937 100644
--- a/Xi/xiselectev.h
+++ b/Xi/xiselectev.h
@@ -27,9 +27,14 @@
#include <dix-config.h>
#endif
+#ifndef XISELECTEVENTS_H
+#define XISELECTEVENTS_H 1
+
int SProcXISelectEvents(ClientPtr client);
int ProcXISelectEvents(ClientPtr client);
int SProcXIGetSelectedEvents(ClientPtr client);
int ProcXIGetSelectedEvents(ClientPtr client);
void SRepXIGetSelectedEvents(ClientPtr client,
int len, xXIGetSelectedEventsReply *rep);
+
+#endif /* _XISELECTEVENTS_H_ */
diff --git a/Xi/xisetdevfocus.h b/Xi/xisetdevfocus.h
index eb584eb..2c3243d 100644
--- a/Xi/xisetdevfocus.h
+++ b/Xi/xisetdevfocus.h
@@ -23,6 +23,10 @@
* Author: Peter Hutterer
*/
+#ifdef HAVE_DIX_CONFIG_H
+#include <dix-config.h>
+#endif
+
#ifndef XISETDEVFOCUS_H
#define XISETDEVFOCUS_H 1
commit 377a5f655ca88cd836da24ab42361df9f3ff51a2
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Wed Sep 2 11:16:15 2009 +1000
Xi: if XISetEventMask fails, return this to the client.
The only failure point can be a BadAlloc.
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/Xi/exevents.c b/Xi/exevents.c
index b1412f0..7f77aa8 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -2128,7 +2128,7 @@ SendEventToAllWindows(DeviceIntPtr dev, Mask mask, xEvent * ev, int count)
* @param len Number of bytes in mask.
* @param mask Event mask in the form of (1 << eventtype)
*/
-void
+int
XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
unsigned int len, unsigned char* mask)
{
@@ -2152,7 +2152,8 @@ XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
if (len && !others)
{
- AddExtensionClient(win, client, 0, 0);
+ if (AddExtensionClient(win, client, 0, 0) != Success)
+ return BadAlloc;
others= wOtherInputMasks(win)->inputClients;
}
@@ -2163,4 +2164,6 @@ XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
memcpy(others->xi2mask[dev->id], mask, len);
RecalculateDeviceDeliverableEvents(win);
+
+ return Success;
}
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
index 16eada7..672edab 100644
--- a/Xi/xiselectev.c
+++ b/Xi/xiselectev.c
@@ -164,7 +164,9 @@ ProcXISelectEvents(ClientPtr client)
dev = &dummy;
} else
dixLookupDevice(&dev, evmask->deviceid, client, DixUseAccess);
- XISetEventMask(dev, win, client, evmask->mask_len * 4, (unsigned char*)&evmask[1]);
+ if (XISetEventMask(dev, win, client, evmask->mask_len * 4,
+ (unsigned char*)&evmask[1]) != Success)
+ return BadAlloc;
evmask = (xXIEventMask*)(((unsigned char*)evmask) + evmask->mask_len * 4);
evmask++;
}
diff --git a/include/exevents.h b/include/exevents.h
index ebe8ab5..39e1c70 100644
--- a/include/exevents.h
+++ b/include/exevents.h
@@ -305,7 +305,7 @@ extern void
XISendDeviceChangedEvent(DeviceIntPtr device, DeviceIntPtr master,
DeviceChangedEvent *dce);
-extern void
+extern int
XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
unsigned int len, unsigned char* mask);
diff --git a/test/xi2/protocol-common.h b/test/xi2/protocol-common.h
index bf8b875..1ab35c9 100644
--- a/test/xi2/protocol-common.h
+++ b/test/xi2/protocol-common.h
@@ -131,7 +131,7 @@ void init_simple(void);
/* Declarations for various overrides in the test files. */
void __wrap_WriteToClient(ClientPtr client, int len, void *data);
-void __wrap_XISetEventMask(DeviceIntPtr dev, WindowPtr win, int len, unsigned char* mask);
+int __wrap_XISetEventMask(DeviceIntPtr dev, WindowPtr win, int len, unsigned char* mask);
int __wrap_dixLookupWindow(WindowPtr *win, XID id, ClientPtr client, Mask access);
int __real_dixLookupWindow(WindowPtr *win, XID id, ClientPtr client, Mask access);
Bool __wrap_AddResource(XID id, RESTYPE type, pointer value);
diff --git a/test/xi2/protocol-xiselectevents.c b/test/xi2/protocol-xiselectevents.c
index 9782cff..f314462 100644
--- a/test/xi2/protocol-xiselectevents.c
+++ b/test/xi2/protocol-xiselectevents.c
@@ -62,8 +62,9 @@
static unsigned char *data[4096 * 16]; /* the request data buffer */
-void __wrap_XISetEventMask(DeviceIntPtr dev, WindowPtr win, int len, unsigned char* mask)
+int __wrap_XISetEventMask(DeviceIntPtr dev, WindowPtr win, int len, unsigned char* mask)
{
+ return Success;
}
/* dixLookupWindow requires a lot of setup not necessary for this test.
commit 993ca5acbdccef9e43cd6580e7cc22cfda1a2578
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Wed Sep 2 10:53:40 2009 +1000
dix: when unsetting a cursor, update the sprite immediately (#23608)
Removing the device cursor while the cursor was within the window did not
update the visible sprite until the next enter/leave event.
X.Org Bug 23608 <http://bugs.freedesktop.org/show_bug.cgi?id=23608>
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/dix/window.c b/dix/window.c
index 9663578..caff1cb 100644
--- a/dix/window.c
+++ b/dix/window.c
@@ -3541,7 +3541,7 @@ ChangeWindowDeviceCursor(WindowPtr pWin,
pWin->optional->deviceCursors = pNode->next;
xfree(pNode);
- return Success;
+ goto out;
}
} else
@@ -3586,6 +3586,7 @@ ChangeWindowDeviceCursor(WindowPtr pWin,
}
}
+out:
if (pWin->realized)
WindowHasNewCursor(pWin);
commit b41db8fe460fc0956922b79261752d1bb104684f
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Wed Sep 2 08:57:40 2009 +1000
Xi: fix broken swap code in XISelectEvents request processing.
The pointer advanced 12 bytes too short. Rather unfortunate if both the code
and the test have the same bug.
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
index d4f5faa..16eada7 100644
--- a/Xi/xiselectev.c
+++ b/Xi/xiselectev.c
@@ -73,7 +73,7 @@ SProcXISelectEvents(ClientPtr client)
{
swaps(&evmask->deviceid, n);
swaps(&evmask->mask_len, n);
- evmask = (xXIEventMask*)(((char*)evmask) + evmask->mask_len * 4);
+ evmask = (xXIEventMask*)(((char*)&evmask[1]) + evmask->mask_len * 4);
}
return (ProcXISelectEvents(client));
diff --git a/test/xi2/protocol-xiselectevents.c b/test/xi2/protocol-xiselectevents.c
index ac38c53..9782cff 100644
--- a/test/xi2/protocol-xiselectevents.c
+++ b/test/xi2/protocol-xiselectevents.c
@@ -113,7 +113,7 @@ static void request_XISelectEvent(xXISelectEventsReq *req, int error)
mask = (xXIEventMask*)&req[1];
for (i = 0; i < req->num_masks; i++)
{
- next = (xXIEventMask*)((char*)mask) + mask->mask_len;
+ next = (xXIEventMask*)((char*)&mask[1] + mask->mask_len * 4);
swaps(&mask->deviceid, n);
swaps(&mask->mask_len, n);
mask = next;
commit 727de7c90de4198222e0dc58d7503b4a1672f642
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Tue Sep 1 16:33:56 2009 +1000
Xi: Unify checking for invalid bits in grab masks.
Bits above XI2LASTEVENT are invalid and cause in BadValues. These checks
must be performed anywhere where a mask_len parameter is given.
This patch also adds the missing checks to grab masks.
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c
index 5394b19..24ededc 100644
--- a/Xi/xigrabdev.c
+++ b/Xi/xigrabdev.c
@@ -39,6 +39,7 @@
#include <X11/extensions/XI2proto.h>
#include "exglobals.h" /* BadDevice */
+#include "exevents.h"
#include "xigrabdev.h"
int
@@ -78,6 +79,10 @@ ProcXIGrabDevice(ClientPtr client)
if (!IsMaster(dev))
stuff->paired_device_mode = GrabModeAsync;
+ if (XICheckInvalidMaskBits((unsigned char*)&stuff[1],
+ stuff->mask_len * 4) != Success)
+ return BadValue;
+
mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4);
memset(mask.xi2mask, 0, sizeof(mask.xi2mask));
memcpy(mask.xi2mask, (char*)&stuff[1], mask_len);
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index 0cfdc1d..41a56b1 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -118,15 +118,9 @@ ProcXIPassiveGrabDevice(ClientPtr client)
return BadValue;
}
- if ((stuff->mask_len * 4) > XI2LASTEVENT)
- {
- unsigned char *bits = (unsigned char*)&stuff[1];
- for (i = XI2LASTEVENT; i < stuff->mask_len * 4; i++)
- {
- if (BitIsOn(bits, i))
- return BadValue;
- }
- }
+ if (XICheckInvalidMaskBits((unsigned char*)&stuff[1],
+ stuff->mask_len * 4) != Success)
+ return BadValue;
mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4);
memset(mask.xi2mask, 0, sizeof(mask.xi2mask));
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
index eac12c5..d4f5faa 100644
--- a/Xi/xiselectev.c
+++ b/Xi/xiselectev.c
@@ -36,6 +36,25 @@
#include "xiselectev.h"
+/**
+ * Check the given mask (in len bytes) for invalid mask bits.
+ * Invalid mask bits are any bits above XI2LastEvent.
+ *
+ * @return BadValue if at least one invalid bit is set or Success otherwise.
+ */
+int XICheckInvalidMaskBits(unsigned char *mask, int len)
+{
+ if (len >= XIMaskLen(XI2LASTEVENT))
+ {
+ int i;
+ for (i = XI2LASTEVENT + 1; i < len * 8; i++)
+ if (BitIsOn(mask, i))
+ return BadValue;
+ }
+
+ return Success;
+}
+
int
SProcXISelectEvents(ClientPtr client)
{
@@ -63,7 +82,7 @@ SProcXISelectEvents(ClientPtr client)
int
ProcXISelectEvents(ClientPtr client)
{
- int rc, num_masks, i;
+ int rc, num_masks;
WindowPtr win;
DeviceIntPtr dev;
DeviceIntRec dummy;
@@ -122,15 +141,9 @@ ProcXISelectEvents(ClientPtr client)
return BadValue;
}
- if ((evmask->mask_len * 4) >= (XI2LASTEVENT + 8)/8)
- {
- unsigned char *bits = (unsigned char*)&evmask[1];
- for (i = XI2LASTEVENT + 1; i < evmask->mask_len * 4; i++)
- {
- if (BitIsOn(bits, i))
- return BadValue;
- }
- }
+ if (XICheckInvalidMaskBits((unsigned char*)&evmask[1],
+ evmask->mask_len * 4) != Success)
+ return BadValue;
evmask = (xXIEventMask*)(((unsigned char*)evmask) + evmask->mask_len * 4);
evmask++;
diff --git a/include/exevents.h b/include/exevents.h
index ff39b28..ebe8ab5 100644
--- a/include/exevents.h
+++ b/include/exevents.h
@@ -309,4 +309,7 @@ extern void
XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
unsigned int len, unsigned char* mask);
+extern int
+XICheckInvalidMaskBits(unsigned char *mask, int len);
+
#endif /* EXEVENTS_H */
commit 59a6d7d478903a8bc9c5d4cc8b2e62e2ad102dba
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Tue Sep 1 16:30:52 2009 +1000
Xi: don't overrun memory for grab masks.
A grab mask provided in the request may be larger than the one used in the
server. Cut down to size before memcopying.
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c
index 95beb83..5394b19 100644
--- a/Xi/xigrabdev.c
+++ b/Xi/xigrabdev.c
@@ -66,6 +66,7 @@ ProcXIGrabDevice(ClientPtr client)
int ret = Success;
uint8_t status;
GrabMask mask;
+ int mask_len;
REQUEST(xXIGrabDeviceReq);
REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq);
@@ -77,8 +78,9 @@ ProcXIGrabDevice(ClientPtr client)
if (!IsMaster(dev))
stuff->paired_device_mode = GrabModeAsync;
+ mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4);
memset(mask.xi2mask, 0, sizeof(mask.xi2mask));
- memcpy(mask.xi2mask, (char*)&stuff[1], stuff->mask_len * 4);
+ memcpy(mask.xi2mask, (char*)&stuff[1], mask_len);
ret = GrabDevice(client, dev, stuff->grab_mode,
stuff->paired_device_mode,
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index 1d6200f..0cfdc1d 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -86,6 +86,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
GrabMask mask;
GrabParameters param;
void *tmp;
+ int mask_len;
REQUEST(xXIPassiveGrabDeviceReq);
REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
@@ -127,8 +128,9 @@ ProcXIPassiveGrabDevice(ClientPtr client)
}
}
+ mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4);
memset(mask.xi2mask, 0, sizeof(mask.xi2mask));
- memcpy(mask.xi2mask[stuff->deviceid], &stuff[1], stuff->mask_len * 4);
+ memcpy(mask.xi2mask[stuff->deviceid], &stuff[1], mask_len * 4);
rep.repType = X_Reply;
rep.RepType = X_XIPassiveGrabDevice;
commit 83db2b126e8623824e1303e74070375994984599
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Tue Sep 1 15:58:02 2009 +1000
Xi: don't try to set oversized or non-existing masks.
Fixes crash if the first XISelectEvents has a zero sized event mask.
Fixes crash if the mask provided is larger than others->xi2mask[].
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/Xi/exevents.c b/Xi/exevents.c
index 2173f35..b1412f0 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -2148,15 +2148,18 @@ XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
}
}
- if (!others && len)
+ len = min(len, sizeof(others->xi2mask[dev->id]));
+
+ if (len && !others)
{
AddExtensionClient(win, client, 0, 0);
others= wOtherInputMasks(win)->inputClients;
}
- if (!len)
+ if (others)
memset(others->xi2mask[dev->id], 0, sizeof(others->xi2mask[dev->id]));
- else
+
+ if (len)
memcpy(others->xi2mask[dev->id], mask, len);
RecalculateDeviceDeliverableEvents(win);
commit 6fe235d3635aaf995dfa198c60ded1a43fe9dd45
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Tue Sep 1 15:46:34 2009 +1000
test: fix request length calculation, add length tests for XISelectEvents
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/test/xi2/protocol-xiselectevents.c b/test/xi2/protocol-xiselectevents.c
index 825eeb6..ac38c53 100644
--- a/test/xi2/protocol-xiselectevents.c
+++ b/test/xi2/protocol-xiselectevents.c
@@ -95,7 +95,14 @@ static void request_XISelectEvent(xXISelectEventsReq *req, int error)
ClientRec client;
xXIEventMask *mask, *next;
- req->length = (sz_xXISelectEventsReq/4) + req->num_masks;
+ req->length = (sz_xXISelectEventsReq/4);
+ mask = (xXIEventMask*)&req[1];
+ for (i = 0; i < req->num_masks; i++)
+ {
+ req->length += sizeof(xXIEventMask)/4 + mask->mask_len;
+ mask = (xXIEventMask*)((char*)&mask[1] + mask->mask_len * 4);
+ }
+
client = init_client(req->length, req);
rc = ProcXISelectEvents(&client);
@@ -280,16 +287,24 @@ static void test_XISelectEvents(void)
req->num_masks = 0xFFFF;
request_XISelectEvent(req, BadLength);
- /* testing various device ids */
req->win = ROOT_WINDOW_ID;
req->num_masks = 1;
+ g_test_message("Triggering bogus mask length error");
+ mask = (xXIEventMask*)&req[1];
+ mask->deviceid = 0;
+ mask->mask_len = 0xFFFF;
+ request_XISelectEvent(req, BadLength);
+
+ /* testing various device ids */
g_test_message("Testing existing device ids.");
for (i = 0; i < 6; i++)
{
mask = (xXIEventMask*)&req[1];
mask->deviceid = i;
mask->mask_len = 1;
+ req->win = ROOT_WINDOW_ID;
+ req->num_masks = 1;
request_XISelectEvent(req, Success);
}
commit 7ab1b50c545ae1a62384bedee60168e227bb2a94
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Tue Sep 1 15:27:29 2009 +1000
test: fix build after changing libxf86config.la
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/test/Makefile.am b/test/Makefile.am
index 09932a5..d8d8985 100644
--- a/test/Makefile.am
+++ b/test/Makefile.am
@@ -18,7 +18,7 @@ libxservertest_la_LIBADD = \
$(top_builddir)/hw/xfree86/loader/libloader.la \
$(top_builddir)/hw/xfree86/os-support/libxorgos.la \
$(top_builddir)/hw/xfree86/common/libcommon.la \
- $(top_builddir)/hw/xfree86/parser/libxf86config.la \
+ $(top_builddir)/hw/xfree86/parser/libxf86config_internal.la \
$(top_builddir)/hw/xfree86/dixmods/libdixmods.la \
$(top_builddir)/hw/xfree86/modes/libxf86modes.la \
$(top_builddir)/hw/xfree86/ramdac/libramdac.la \
commit 58c298acc1045927e0d90be73b8dbc8837252589
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Tue Sep 1 15:16:17 2009 +1000
Xi: extra length checking for requests providing masks.
masks can be of arbitrary length. If the client did not initialize mask_len,
some sort of boundary check is needed to avoid running over memory.
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
index d7b1644..eac12c5 100644
--- a/Xi/xiselectev.c
+++ b/Xi/xiselectev.c
@@ -69,6 +69,7 @@ ProcXISelectEvents(ClientPtr client)
DeviceIntRec dummy;
xXIEventMask *evmask;
int *types = NULL;
+ int len;
REQUEST(xXISelectEventsReq);
REQUEST_AT_LEAST_SIZE(xXISelectEventsReq);
@@ -80,11 +81,18 @@ ProcXISelectEvents(ClientPtr client)
if (rc != Success)
return rc;
+ len = sz_xXISelectEventsReq;
+
/* check request validity */
evmask = (xXIEventMask*)&stuff[1];
num_masks = stuff->num_masks;
while(num_masks--)
{
+ len += sizeof(xXIEventMask) + evmask->mask_len * 4;
+
+ if (bytes_to_int32(len) > stuff->length)
+ return BadLength;
+
if (evmask->deviceid != XIAllDevices &&
evmask->deviceid != XIAllMasterDevices)
rc = dixLookupDevice(&dev, evmask->deviceid, client, DixUseAccess);
@@ -128,6 +136,9 @@ ProcXISelectEvents(ClientPtr client)
evmask++;
}
+ if (bytes_to_int32(len) != stuff->length)
+ return BadLength;
+
/* Set masks on window */
evmask = (xXIEventMask*)&stuff[1];
num_masks = stuff->num_masks;
commit 0e4dd3b2d28d3dbbfc152d6f5030901ec063a7ae
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date: Mon Aug 31 09:50:36 2009 +1000
Un-export ApplyPointerMapping. This is an in-server function.
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
diff --git a/dix/inpututils.c b/dix/inpututils.c
index 66936c9..4848c1b 100644
--- a/dix/inpututils.c
+++ b/dix/inpututils.c
@@ -107,7 +107,7 @@ do_butmap_change(DeviceIntPtr dev, CARD8 *map, int len, ClientPtr client)
* to the requested device, faithfully ignores any errors encountered while
* trying to apply the map to its master/slaves.
*/
-_X_EXPORT int
+int
ApplyPointerMapping(DeviceIntPtr dev, CARD8 *map, int len, ClientPtr client)
{
int ret;
diff --git a/include/input.h b/include/input.h
index 548e58c..7ab5e9d 100644
--- a/include/input.h
+++ b/include/input.h
@@ -365,7 +365,7 @@ extern _X_EXPORT Bool InitKeyboardDeviceStruct(
BellProcPtr /*bellProc*/,
KbdCtrlProcPtr /*controlProc*/);
-extern _X_EXPORT int ApplyPointerMapping(
+extern int ApplyPointerMapping(
DeviceIntPtr /* pDev */,
CARD8 * /* map */,
int /* len */,
More information about the xorg-commit
mailing list