xserver: Branch 'master' - 5 commits
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Wed Feb 26 13:23:51 UTC 2025
xkb/XKBAlloc.c | 4 +-
xkb/XKBMAlloc.c | 2 -
xkb/xkbtext.c | 102 ++++++++++++++++++++++++++++++++------------------------
3 files changed, 64 insertions(+), 44 deletions(-)
New commits:
commit 42a1f25faff612641dffb95a77f9ec3661111875
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date: Sun Oct 8 13:22:13 2023 -0700
xkb: Add tbGetBufferString helper function
Handles common case of allocating & copying string to temporary buffer
(cherry picked from xorg/lib/libxkbfile at 8a91517ca6ea77633476595b0eb5b213357c60e5)
Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
index 188c9ffb1..5d8caf4fb 100644
--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
@@ -70,6 +70,20 @@ tbGetBuffer(unsigned size)
/***====================================================================***/
+static inline char *
+tbGetBufferString(const char *str)
+{
+ size_t size = strlen(str) + 1;
+ char *rtrn = tbGetBuffer((unsigned) size);
+
+ if (rtrn != NULL)
+ memcpy(rtrn, str, size);
+
+ return rtrn;
+}
+
+/***====================================================================***/
+
char *
XkbAtomText(Atom atm, unsigned format)
{
@@ -78,11 +92,7 @@ XkbAtomText(Atom atm, unsigned format)
atmstr = NameForAtom(atm);
if (atmstr != NULL) {
- int len;
-
- len = strlen(atmstr) + 1;
- rtrn = tbGetBuffer(len);
- strlcpy(rtrn, atmstr, len);
+ rtrn = tbGetBufferString(atmstr);
}
else {
rtrn = tbGetBuffer(1);
@@ -232,7 +242,6 @@ static const char *modNames[XkbNumModifiers] = {
char *
XkbModIndexText(unsigned ndx, unsigned format)
{
- char *rtrn;
char buf[100];
if (format == XkbCFile) {
@@ -251,9 +260,7 @@ XkbModIndexText(unsigned ndx, unsigned format)
else
snprintf(buf, sizeof(buf), "ILLEGAL_%02x", ndx);
}
- rtrn = tbGetBuffer(strlen(buf) + 1);
- strcpy(rtrn, buf);
- return rtrn;
+ return tbGetBufferString(buf);
}
char *
@@ -295,8 +302,7 @@ XkbModMaskText(unsigned mask, unsigned format)
}
}
}
- rtrn = tbGetBuffer(strlen(buf) + 1);
- strcpy(rtrn, buf);
+ rtrn = tbGetBufferString(buf);
return rtrn;
}
@@ -1228,7 +1234,7 @@ static actionCopy copyActionArgs[XkbSA_NumActions] = {
char *
XkbActionText(XkbDescPtr xkb, XkbAction *action, unsigned format)
{
- char buf[ACTION_SZ], *tmp;
+ char buf[ACTION_SZ];
int sz;
if (format == XkbCFile) {
@@ -1249,16 +1255,13 @@ XkbActionText(XkbDescPtr xkb, XkbAction *action, unsigned format)
CopyOtherArgs(xkb, action, buf, &sz);
TryCopyStr(buf, ")", &sz);
}
- tmp = tbGetBuffer(strlen(buf) + 1);
- if (tmp != NULL)
- strcpy(tmp, buf);
- return tmp;
+ return tbGetBufferString(buf);
}
char *
XkbBehaviorText(XkbDescPtr xkb, XkbBehavior * behavior, unsigned format)
{
- char buf[256], *tmp;
+ char buf[256];
if (format == XkbCFile) {
if (behavior->type == XkbKB_Default)
@@ -1279,6 +1282,7 @@ XkbBehaviorText(XkbDescPtr xkb, XkbBehavior * behavior, unsigned format)
}
else if (type == XkbKB_RadioGroup) {
int g;
+ char *tmp;
size_t tmpsize;
g = ((behavior->data) & (~XkbKB_RGAllowNone)) + 1;
@@ -1314,10 +1318,7 @@ XkbBehaviorText(XkbDescPtr xkb, XkbBehavior * behavior, unsigned format)
snprintf(buf, sizeof(buf), "overlay%d= %s", ndx, kn);
}
}
- tmp = tbGetBuffer(strlen(buf) + 1);
- if (tmp != NULL)
- strcpy(tmp, buf);
- return tmp;
+ return tbGetBufferString(buf);
}
/***====================================================================***/
commit 7a23010232312c24cde6070a50dbb5433ce52a59
Author: Martin Burggraf <TSO at gmx.net>
Date: Thu Aug 13 21:16:40 2015 +0200
xkb: correcting mathematical nonsense in XkbGeomFPText
Fixes formatting of negative numbers, so they don't show minus sign
after the decimal point.
(cherry picked from xorg/lib/libxkbfile at d2ec504fec2550f4fd046e801b34317ef4a4bab9)
Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
index 55939aba7..188c9ffb1 100644
--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
@@ -622,7 +622,7 @@ XkbGeomFPText(int val, unsigned format)
{
int whole, frac;
char *buf;
- const int bufsize = 12;
+ const int bufsize = 13;
buf = tbGetBuffer(bufsize);
if (format == XkbCFile) {
@@ -630,9 +630,17 @@ XkbGeomFPText(int val, unsigned format)
}
else {
whole = val / XkbGeomPtsPerMM;
- frac = val % XkbGeomPtsPerMM;
- if (frac != 0)
- snprintf(buf, bufsize, "%d.%d", whole, frac);
+ frac = abs(val % XkbGeomPtsPerMM);
+ if (frac != 0) {
+ if (val < 0)
+ {
+ int wholeabs;
+ wholeabs = abs(whole);
+ snprintf(buf, bufsize, "-%d.%d", wholeabs, frac);
+ }
+ else
+ snprintf(buf, bufsize, "%d.%d", whole, frac);
+ }
else
snprintf(buf, bufsize, "%d", whole);
}
commit 60419d8e4a02dc2599351b65b3503f0bb0932eaa
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date: Sat Feb 22 16:15:01 2025 -0800
xkb: Convert more sprintf calls to snprintf in xkbtext.c
Based on xorg/lib/libxkbfile at 390acfe5bb88cdab509b5eaae4041f265e969d2b
Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
index 93262528b..55939aba7 100644
--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
@@ -150,11 +150,12 @@ XkbVModMaskText(XkbDescPtr xkb,
char *str, buf[VMOD_BUFFER_SIZE];
if ((modMask == 0) && (mask == 0)) {
- rtrn = tbGetBuffer(5);
+ const int rtrnsize = 5;
+ rtrn = tbGetBuffer(rtrnsize);
if (format == XkbCFile)
- sprintf(rtrn, "0");
+ snprintf(rtrn, rtrnsize, "0");
else
- sprintf(rtrn, "none");
+ snprintf(rtrn, rtrnsize, "none");
return rtrn;
}
if (modMask != 0)
@@ -305,8 +306,9 @@ XkbModMaskText(unsigned mask, unsigned format)
XkbConfigText(unsigned config, unsigned format)
{
static char *buf;
+ const int bufsize = 32;
- buf = tbGetBuffer(32);
+ buf = tbGetBuffer(bufsize);
switch (config) {
case XkmSemanticsFile:
strcpy(buf, "Semantics");
@@ -340,7 +342,7 @@ XkbConfigText(unsigned config, unsigned format)
strcpy(buf, "VirtualMods");
break;
default:
- sprintf(buf, "unknown(%d)", config);
+ snprintf(buf, bufsize, "unknown(%d)", config);
break;
}
return buf;
@@ -439,7 +441,7 @@ static const char *imWhichNames[] = {
char *
XkbIMWhichStateMaskText(unsigned use_which, unsigned format)
{
- int len;
+ int len, bufsize;
unsigned i, bit, tmp;
char *buf;
@@ -457,7 +459,8 @@ XkbIMWhichStateMaskText(unsigned use_which, unsigned format)
len += 9;
}
}
- buf = tbGetBuffer(len + 1);
+ bufsize = len + 1;
+ buf = tbGetBuffer(bufsize);
tmp = use_which & XkbIM_UseAnyMods;
for (len = i = 0, bit = 1; tmp != 0; i++, bit <<= 1) {
if (tmp & bit) {
@@ -465,13 +468,14 @@ XkbIMWhichStateMaskText(unsigned use_which, unsigned format)
if (format == XkbCFile) {
if (len != 0)
buf[len++] = '|';
- sprintf(&buf[len], "XkbIM_Use%s", imWhichNames[i]);
+ snprintf(&buf[len], bufsize - len,
+ "XkbIM_Use%s", imWhichNames[i]);
buf[len + 9] = toupper((unsigned char)buf[len + 9]);
}
else {
if (len != 0)
buf[len++] = '+';
- sprintf(&buf[len], "%s", imWhichNames[i]);
+ snprintf(&buf[len], bufsize - len, "%s", imWhichNames[i]);
}
len += strlen(&buf[len]);
}
@@ -618,18 +622,19 @@ XkbGeomFPText(int val, unsigned format)
{
int whole, frac;
char *buf;
+ const int bufsize = 12;
- buf = tbGetBuffer(12);
+ buf = tbGetBuffer(bufsize);
if (format == XkbCFile) {
- sprintf(buf, "%d", val);
+ snprintf(buf, bufsize, "%d", val);
}
else {
whole = val / XkbGeomPtsPerMM;
frac = val % XkbGeomPtsPerMM;
if (frac != 0)
- sprintf(buf, "%d.%d", whole, frac);
+ snprintf(buf, bufsize, "%d.%d", whole, frac);
else
- sprintf(buf, "%d", whole);
+ snprintf(buf, bufsize, "%d", whole);
}
return buf;
}
@@ -640,7 +645,8 @@ XkbDoodadTypeText(unsigned type, unsigned format)
char *buf;
if (format == XkbCFile) {
- buf = tbGetBuffer(24);
+ const int bufsize = 24;
+ buf = tbGetBuffer(bufsize);
if (type == XkbOutlineDoodad)
strcpy(buf, "XkbOutlineDoodad");
else if (type == XkbSolidDoodad)
@@ -652,10 +658,11 @@ XkbDoodadTypeText(unsigned type, unsigned format)
else if (type == XkbLogoDoodad)
strcpy(buf, "XkbLogoDoodad");
else
- sprintf(buf, "UnknownDoodad%d", type);
+ snprintf(buf, bufsize, "UnknownDoodad%d", type);
}
else {
- buf = tbGetBuffer(12);
+ const int bufsize = 12;
+ buf = tbGetBuffer(bufsize);
if (type == XkbOutlineDoodad)
strcpy(buf, "outline");
else if (type == XkbSolidDoodad)
@@ -667,7 +674,7 @@ XkbDoodadTypeText(unsigned type, unsigned format)
else if (type == XkbLogoDoodad)
strcpy(buf, "logo");
else
- sprintf(buf, "unknown%d", type);
+ snprintf(buf, bufsize, "unknown%d", type);
}
return buf;
}
@@ -1264,6 +1271,7 @@ XkbBehaviorText(XkbDescPtr xkb, XkbBehavior * behavior, unsigned format)
}
else if (type == XkbKB_RadioGroup) {
int g;
+ size_t tmpsize;
g = ((behavior->data) & (~XkbKB_RGAllowNone)) + 1;
if (XkbKB_RGAllowNone & behavior->data) {
@@ -1272,10 +1280,11 @@ XkbBehaviorText(XkbDescPtr xkb, XkbBehavior * behavior, unsigned format)
}
else
tmp = buf;
+ tmpsize = sizeof(buf) - (tmp - buf);
if (permanent)
- sprintf(tmp, "permanentRadioGroup= %d", g);
+ snprintf(tmp, tmpsize, "permanentRadioGroup= %d", g);
else
- sprintf(tmp, "radioGroup= %d", g);
+ snprintf(tmp, tmpsize, "radioGroup= %d", g);
}
else if ((type == XkbKB_Overlay1) || (type == XkbKB_Overlay2)) {
int ndx, kc;
commit 6d3383418672dd87e6cd73931268fcbacdaae9c8
Author: José Expósito <jexposit at redhat.com>
Date: Tue Apr 30 17:37:39 2024 +0200
xkb: Check that needed is > 0 in XkbResizeKeyActions
Passing a negative value in `needed` to the `XkbResizeKeyActions()`
function can create a `newActs` array of an unespected size.
Check the value and return if it is invalid.
This error has been found by a static analysis tool. This is the report:
Error: OVERRUN (CWE-119):
libX11-1.8.7/src/xkb/XKBMAlloc.c:811: cond_const:
Checking "xkb->server->size_acts == 0" implies that
"xkb->server->size_acts" is 0 on the true branch.
libX11-1.8.7/src/xkb/XKBMAlloc.c:811: buffer_alloc:
"calloc" allocates 8 bytes dictated by parameters
"(size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts)"
and "8UL".
libX11-1.8.7/src/xkb/XKBMAlloc.c:811: var_assign:
Assigning: "newActs" = "calloc((size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts), 8UL)".
libX11-1.8.7/src/xkb/XKBMAlloc.c:815: assignment:
Assigning: "nActs" = "1".
libX11-1.8.7/src/xkb/XKBMAlloc.c:829: cond_at_least:
Checking "nCopy > 0" implies that "nCopy" is at least 1 on the
true branch.
libX11-1.8.7/src/xkb/XKBMAlloc.c:830: overrun-buffer-arg:
Overrunning buffer pointed to by "&newActs[nActs]" of 8 bytes by
passing it to a function which accesses it at byte offset 15
using argument "nCopy * 8UL" (which evaluates to 8).
# 828|
# 829| if (nCopy > 0)
# 830|-> memcpy(&newActs[nActs], XkbKeyActionsPtr(xkb, i),
# 831| nCopy * sizeof(XkbAction));
# 832| if (nCopy < nKeyActs)
(cherry picked from xorg/lib/libx11 at af1312d2873d2ce49b18708a5029895aed477392)
Signed-off-by: José Expósito <jexposit at redhat.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
diff --git a/xkb/XKBMAlloc.c b/xkb/XKBMAlloc.c
index c442eb566..fa8f5527e 100644
--- a/xkb/XKBMAlloc.c
+++ b/xkb/XKBMAlloc.c
@@ -731,7 +731,7 @@ XkbResizeKeyActions(XkbDescPtr xkb, int key, int needed)
register int i, nActs;
XkbAction *newActs;
- if (needed == 0) {
+ if (needed <= 0) {
xkb->server->key_acts[key] = 0;
return NULL;
}
commit 09c6f09eb77a306f44490a9af0751e77cc9d1530
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date: Sat Feb 22 10:02:20 2025 -0800
xkb: ensure XkbAllocNames sets num_rg to 0 on allocation failure
If there was a previous radio_groups array which we failed to realloc
and freed instead, clear the array size in the XkbNamesRec.
Taken from xorg/lib/libx11 at 258a8ced681dc1bc50396be7439fce23f9807e2a
Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1821>
diff --git a/xkb/XKBAlloc.c b/xkb/XKBAlloc.c
index 504687ce5..c8bf82d2f 100644
--- a/xkb/XKBAlloc.c
+++ b/xkb/XKBAlloc.c
@@ -192,8 +192,10 @@ XkbAllocNames(XkbDescPtr xkb, unsigned which, int nTotalRG, int nTotalAliases)
free(prev_radio_groups);
}
}
- if (names->radio_groups == NULL)
+ if (names->radio_groups == NULL) {
+ names->num_rg = 0;
return BadAlloc;
+ }
names->num_rg = nTotalRG;
}
return Success;
More information about the xorg-commit
mailing list