XLibre/xf86-input-synaptics
1
0
Fork 0
mirror of https://github.com/X11Libre/xf86-input-synaptics.git synced 2026-03-24 01:34:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix stack smash in clickpad_guess_clickfingers()

Browse Source 
Apple Magic Trackpad can report 16 slots. In clickpad_guess_clickfingers()
the array allocated on the stack contains only 10 slots.
As (.num_mt_mask == .num_slots), the function writes out of the bounds
of close_point.

Use a size 32 bitmask instead and warn if we ever get past 32 touchpoints.

This fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=952221

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
This commit is contained in:
Peter Hutterer
2013-04-26 10:09:10 +10:00
parent ac47b4ea5b
commit 7cc0ebf085
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/synaptics.c
View File

@@ -2453,10 +2453,11 @@ clickpad_guess_clickfingers(SynapticsPrivate * priv,
struct SynapticsHwState *hw)
{
int nfingers = 0;
char close_point[SYNAPTICS_MAX_TOUCHES] = { 0 }; /* 1 for each point close
to another one */
uint32_t close_point = 0; /* 1 bit for each point close to another one */
int i, j;
BUG_RETURN_VAL(hw->num_mt_mask > sizeof(close_point) * 8, 0);
for (i = 0; i < hw->num_mt_mask - 1; i++) {
ValuatorMask *f1;
@@ -2488,14 +2489,16 @@ clickpad_guess_clickfingers(SynapticsPrivate * priv,
* size. Good luck. */
if (abs(x1 - x2) < (priv->maxx - priv->minx) * .3 &&
abs(y1 - y2) < (priv->maxy - priv->miny) * .3) {
close_point[j] = 1;
close_point[i] = 1;
close_point |= (1 << j);
close_point |= (1 << i);
}
}
}
for (i = 0; i < SYNAPTICS_MAX_TOUCHES; i++)
nfingers += close_point[i];
while (close_point > 0) {
nfingers += close_point & 0x1;
close_point >>= 1;
}
return nfingers;
}