xinput test crashes server when touchpad clicked

[Magnus Kessler]

With the latest server and synaptics driver from git I can reliably crash 
the server by starting

xinput test "SynPS2/2 Synaptics Touchpad"

and then clicking the any of the physical buttons or tapping the pad to 
simulate a click.


Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f808f66b6f0 (LWP 22831)]
XkbFilterEvents (pClient=0x46d2e80, nEvents=1, xE=0x45b5580) at 
xkbEvents.c:822
/usr/src/debug/x11-base/xorg-server-9999/xorg-
server-9999/xkb/xkbEvents.c:822:23919:beg:0x554d35
(gdb) backtrace
#0  XkbFilterEvents (pClient=0x46d2e80, nEvents=1, xE=0x45b5580) at 
xkbEvents.c:822
#1  0x00000000004505ad in WriteEventsToClient (pClient=0x46d2e80, count=1, 
events=0x45b5580) at events.c:5938
#2  0x00000000004546c5 in TryClientEvents (client=0x46d2e80, dev=<value 
optimized out>, pEvents=0x45b5580, count=1, mask=2540292784, 
filter=41155024, grab=0x0) at events.c:1985
#3  0x000000000045532c in DeliverEventsToWindow (pDev=0x2ac7d40, 
pWin=0x27b42f0, pEvents=0x45b5580, count=1, filter=4, grab=0x0, mskidx=2) at 
events.c:2122
#4  0x0000000000456f25 in DeliverDeviceEvents (pWin=0x27b42f0, xE=0x45b5580, 
grab=0x0, stopAt=0x0, dev=0x2ac7d40, count=1) at events.c:2420
#5  0x0000000000537ecd in ProcessOtherEvent (xE=0x45b5580, device=0x2ac7d40, 
count=1) at exevents.c:1126
#6  0x00000000005603cd in ProcessKeyboardEvent (xE=0x45b5580, 
keybd=0x2ac7d40, count=1) at xkbPrKeyEv.c:208
#7  0x00000000004cd11c in mieqProcessInputEvents () at mieq.c:378
#8  0x0000000000490669 in ProcessInputEvents () at xf86Events.c:174
#9  0x000000000044ae21 in Dispatch () at dispatch.c:363
#10 0x0000000000430f3d in main (argc=9, argv=0x7fff9769d128, envp=<value 
optimized out>) at main.c:384


The server dies because of a null pointer in

Bool
XkbFilterEvents(ClientPtr pClient,int nEvents,xEvent *xE)
{
int     i, button_mask;
DeviceIntPtr pXDev = inputInfo.keyboard;
XkbSrvInfoPtr   xkbi;
    
    if (xE->u.u.type & EXTENSION_EVENT_BASE)
    {
        pXDev = XIGetDevice(xE);
        if (!pXDev)
            pXDev = inputInfo.keyboard;
    }
    
    xkbi= pXDev->key->xkbInfo;
                 ^
                 | key is NULL on crash

Why would a touchpad be treated as a keyboard here?

Regards,

Magnus Kessler

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.x.org/archives/xorg/attachments/20081119/5e23a5da/attachment.pgp>