From 10617dc0fb7166ccd5b2e92fa708390c2d7d0d27 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter@cs.unisa.edu.au>
Date: Fri, 1 Feb 2008 14:24:04 +1030
Subject: [PATCH] xfree86: stick two more checks in for num_valuators <
 MAX_VALUATORS

---
 hw/xfree86/common/xf86Xinput.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c
index 3e9a4796e..eafc0e9a0 100644
--- a/hw/xfree86/common/xf86Xinput.c
+++ b/hw/xfree86/common/xf86Xinput.c
@@ -507,6 +507,12 @@ xf86PostMotionEventP(DeviceIntPtr	device,
     int index;
     int flags = 0;
 
+    if (num_valuators > MAX_VALUATORS) {
+	xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+	    " is greater than MAX_VALUATORS\n", num_valuators);
+	return;
+    }
+
     if (is_absolute)
         flags = POINTER_ABSOLUTE;
     else
@@ -644,6 +650,12 @@ xf86PostKeyEvent(DeviceIntPtr	device,
            "badly south after this message, then xf86PostKeyEvent is "
            "broken.\n");
 
+    if (num_valuators > MAX_VALUATORS) {
+	xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+	    " is greater than MAX_VALUATORS\n", num_valuators);
+	return;
+    }
+
     if (!xf86Events)
         FatalError("Didn't allocate event store\n");