xserver: Branch 'master' - 2 commits

[GitLab Mirror]

 mi/mipointer.c |   27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

New commits:
commit 68c17477d29937e081c482a343a942d5bd41c4ee
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Mon Feb 10 10:49:24 2025 +1000

    mi: guard miPointer functions against NULL dereferences
    
    Already in place for some functions, let's add it to most others.
    The only function missing is miPointerSetPosition() which needs to
    return the ScreenPtr and that one is unclear if we don't have a screen -
    returning NULL will crash the caller(s) so let's wait for something to
    trigger this bug before we try to fix it wrongly.
    
    Related to #1782
    
    Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1771>

diff --git a/mi/mipointer.c b/mi/mipointer.c
index c9fda954f..ae5fa6fad 100644
--- a/mi/mipointer.c
+++ b/mi/mipointer.c
@@ -208,6 +208,8 @@ miPointerDisplayCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
         return FALSE;
 
     pPointer = MIPOINTER(pDev);
+    if (!pPointer)
+        return FALSE;
 
     pPointer->pCursor = pCursor;
     pPointer->pScreen = pScreen;
@@ -230,6 +232,8 @@ miPointerConstrainCursor(DeviceIntPtr pDev, ScreenPtr pScreen, BoxPtr pBox)
     miPointerPtr pPointer;
 
     pPointer = MIPOINTER(pDev);
+    if (!pPointer)
+        return;
 
     pPointer->limits = *pBox;
     pPointer->confined = PointerConfinedToScreen(pDev);
@@ -281,6 +285,9 @@ miPointerSetCursorPosition(DeviceIntPtr pDev, ScreenPtr pScreen,
     SetupScreen(pScreen);
     miPointerPtr pPointer = MIPOINTER(pDev);
 
+    if (!pPointer)
+        return TRUE;
+
     pPointer->generateEvent = generateEvent;
 
     if (pScreen->ConstrainCursorHarder)
@@ -387,6 +394,8 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y)
     BOOL changedScreen = FALSE;
 
     pPointer = MIPOINTER(pDev);
+    if (!pPointer)
+        return;
 
     if (pPointer->pScreen != pScreen) {
         mieqSwitchScreen(pDev, pScreen, TRUE);
@@ -512,6 +521,9 @@ miPointerInvalidateSprite(DeviceIntPtr pDev)
     miPointerPtr pPointer;
 
     pPointer = MIPOINTER(pDev);
+    if (!pPointer)
+        return;
+
     pPointer->pSpriteCursor = (CursorPtr) 1;
 }
 
@@ -530,6 +542,8 @@ miPointerSetScreen(DeviceIntPtr pDev, int screen_no, int x, int y)
     miPointerPtr pPointer;
 
     pPointer = MIPOINTER(pDev);
+    if (!pPointer)
+        return;
 
     pScreen = screenInfo.screens[screen_no];
     mieqSwitchScreen(pDev, pScreen, FALSE);
@@ -574,6 +588,8 @@ miPointerMoveNoEvent(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y)
     SetupScreen(pScreen);
 
     pPointer = MIPOINTER(pDev);
+    if (!pPointer)
+        return;
 
     /* Hack: We mustn't call into ->MoveCursor for anything but the
      * VCP, as this may cause a non-HW rendered cursor to be rendered while
commit acbdd0ecddc18d9fa7fc1634d4daf868ee0cd755
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Fri Feb 7 18:14:55 2025 +1000

    mi: don't crash on miPointerGetPosition for disabled devices
    
    If a device is disabled, its master device is forcibly reset to NULL but
    unlike a floating device it doesn't have a sprite allocated. Calling
    miPointerGetPosition for a disabled device thus crashes.
    
    Avoid this by returning 0/0 for any device without a miPointer.
    This is a quick fix only, a proper fix for this issue is rather more
    involved.
    
    Closes #1782
    
    Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1771>

diff --git a/mi/mipointer.c b/mi/mipointer.c
index 53bd9327c..c9fda954f 100644
--- a/mi/mipointer.c
+++ b/mi/mipointer.c
@@ -726,8 +726,15 @@ miPointerSetPosition(DeviceIntPtr pDev, int mode, double *screenx,
 void
 miPointerGetPosition(DeviceIntPtr pDev, int *x, int *y)
 {
-    *x = MIPOINTER(pDev)->x;
-    *y = MIPOINTER(pDev)->y;
+    miPointerPtr pPointer = MIPOINTER(pDev);
+    if (pPointer) {
+        *x = pPointer->x;
+        *y = pPointer->y;
+    }
+    else {
+        *x = 0;
+        *y = 0;
+    }
 }
 
 /**