XLibre/xf86-input-evdev
1
0
Fork 0
mirror of https://github.com/X11Libre/xf86-input-evdev.git synced 2026-03-25 02:09:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Protect against zero-sized property values. #19882

Browse Source 
X.Org Bug 19882 <http://bugs.freedesktop.org/show_bug.cgi?id=19882>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
Peter Hutterer
2009-02-02 11:00:30 +10:00
parent e260993b6a
commit 07f40a04df
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/draglock.c
View File

@@ -243,7 +243,9 @@ EvdevDragLockSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val,
return BadValue;
}
if (val->size == 1)
if (val->size == 0)
return BadMatch;
else if (val->size == 1)
{
int meta = *((CARD8*)val->data);
if (meta > EVDEV_MAXBUTTONS)

12
src/emuWheel.c
View File

@@ -350,11 +350,13 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val,
}
else if (atom == prop_wheel_button)
{
int bt = *((CARD8*)val->data);
int bt;
if (val->format != 8 || val->size != 1 || val->type != XA_INTEGER)
return BadMatch;
bt = *((CARD8*)val->data);
if (bt < 0 || bt >= EVDEV_MAXBUTTONS)
return BadValue;
@@ -374,11 +376,13 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val,
}
} else if (atom == prop_wheel_inertia)
{
int inertia = *((CARD16*)val->data);
int inertia;
if (val->format != 16 || val->size != 1 || val->type != XA_INTEGER)
return BadMatch;
inertia = *((CARD16*)val->data);
if (inertia < 0)
return BadValue;
@@ -386,11 +390,13 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val,
pEvdev->emulateWheel.inertia = inertia;
} else if (atom == prop_wheel_timeout)
{
int timeout = *((CARD16*)val->data);
int timeout;
if (val->format != 16 || val->size != 1 || val->type != XA_INTEGER)
return BadMatch;
timeout = *((CARD16*)val->data);
if (timeout < 0)
return BadValue;