From 6272529339f975777f22bb0e6162ac43480ae257 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Mon, 15 Feb 2021 11:33:56 +0100 Subject: [PATCH] dix: Guard against non-existing PtrFeedbackPtr Trying to change the pointer control settings on a device without PtrFeedbackPtr would be a bug and a crash in the Xserver. Guard against that case by returning early with a BadImplementation error, that might kill the X11 client but the Xserver would survive. Signed-off-by: Olivier Fourdan Reviewed-by: Peter Hutterer Related: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1137 (cherry picked from commit dee2bb033e78e2f4aae7f5708c3d4fc74a9957de) --- dix/devices.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dix/devices.c b/dix/devices.c index 00c453980..e7c74d7b7 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -2261,6 +2261,9 @@ ProcChangePointerControl(ClientPtr client) REQUEST(xChangePointerControlReq); REQUEST_SIZE_MATCH(xChangePointerControlReq); + /* If the device has no PtrFeedbackPtr, the xserver has a bug */ + BUG_RETURN_VAL (!mouse->ptrfeed, BadImplementation); + ctrl = mouse->ptrfeed->ctrl; if ((stuff->doAccel != xTrue) && (stuff->doAccel != xFalse)) { client->errorValue = stuff->doAccel;