andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ProcGetPointerMapping uses rep.nElts before it is initialized

Browse Source 
In:

	commit d792ac125a
	Author: Alan Coopersmith <alan.coopersmith@oracle.com>
	Date:   Mon Jul 9 19:12:43 2012 -0700

	    Use C99 designated initializers in dix Replies

the initializer for the .length element of the xGetPointerMappingReply
structure uses the value of rep.nElts, but that won't be set until
after this initializer runs, so we get garbage in the length element
and clients using it will generally wedge.

Easy to verify:

	$ xmodmap -pp

Fixed by creating a local nElts variable and using that.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
Keith Packard 2012-07-10 15:58:48 -07:00
parent 44bd27cdd1
commit 34cf559bcf
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dix/devices.c
View File

@ -1890,6 +1890,7 @@ ProcGetPointerMapping(ClientPtr client)
* the ClientPointer could change. */
DeviceIntPtr ptr = PickPointer(client);
ButtonClassPtr butc = ptr->button;
int nElts;
int rc;
REQUEST_SIZE_MATCH(xReq);
@ -1898,15 +1899,16 @@ ProcGetPointerMapping(ClientPtr client)
if (rc != Success)
return rc;
nElts = (butc) ? butc->numButtons : 0;
rep = (xGetPointerMappingReply) {
.type = X_Reply,
.nElts = (butc) ? butc->numButtons : 0,
.nElts = nElts,
.sequenceNumber = client->sequence,
.length = ((unsigned) rep.nElts + (4 - 1)) / 4
.length = ((unsigned) nElts + (4 - 1)) / 4
};
WriteReplyToClient(client, sizeof(xGetPointerMappingReply), &rep);
if (butc)
WriteToClient(client, (int) rep.nElts, &butc->map[1]);
WriteToClient(client, nElts, &butc->map[1]);
return Success;
}