XLibre/xf86-input-evdev
1
0
Fork 0
mirror of https://github.com/X11Libre/xf86-input-evdev.git synced 2026-04-14 11:44:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overrun when populating axis label property array

Browse Source 
The axis label property array currently only has enough elements for the
non-multitouch axes. This change allocates enough space for all axes,
which prevents an array overrun write. This may manifest as stack
corruption on some platforms.

Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
Chase Douglas
2012-06-06 12:07:12 -07:00
committed by Peter Hutterer
parent 9ce068e760
commit 4145fe1c08
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/evdev.c
View File

@@ -1304,6 +1304,7 @@ EvdevAddAbsValuatorClass(DeviceIntPtr device)
}
#ifdef MULTITOUCH
if (num_mt_axes_total > 0) {
pEvdev->num_mt_vals = num_mt_axes_total;
pEvdev->mt_mask = valuator_mask_new(num_mt_axes_total);
if (!pEvdev->mt_mask) {
xf86Msg(X_ERROR, "%s: failed to allocate MT valuator mask.\n",
@@ -2879,7 +2880,8 @@ EvdevInitProperty(DeviceIntPtr dev)
if ((pEvdev->num_vals > 0) && (prop_axis_label = XIGetKnownProperty(AXIS_LABEL_PROP)))
{
int mode;
Atom atoms[pEvdev->num_vals];
int num_axes = pEvdev->num_vals + pEvdev->num_mt_vals;
Atom atoms[num_axes];
if (pEvdev->flags & EVDEV_ABSOLUTE_EVENTS)
mode = Absolute;
@@ -2890,9 +2892,9 @@ EvdevInitProperty(DeviceIntPtr dev)
mode = Absolute;
}
EvdevInitAxesLabels(pEvdev, mode, pEvdev->num_vals, atoms);
EvdevInitAxesLabels(pEvdev, mode, num_axes, atoms);
XIChangeDeviceProperty(dev, prop_axis_label, XA_ATOM, 32,
PropModeReplace, pEvdev->num_vals, atoms, FALSE);
PropModeReplace, num_axes, atoms, FALSE);
XISetDevicePropertyDeletable(dev, prop_axis_label, FALSE);
}
/* Button labelling */

1
src/evdev.h
View File

@@ -153,6 +153,7 @@ typedef struct {
int grabDevice; /* grab the event device? */
int num_vals; /* number of valuators */
int num_mt_vals; /* number of multitouch valuators */
int axis_map[max(ABS_CNT, REL_CNT)]; /* Map evdev <axis> to index */
ValuatorMask *vals; /* new values coming in */
ValuatorMask *old_vals; /* old values for calculating relative motion */