From 6e17184486c4309ec8b47c7cfd11fef60bb360ac Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter@cs.unisa.edu.au>
Date: Fri, 18 Jan 2008 17:52:38 +1030
Subject: [PATCH] Xi: Check for DestroyAccess when trying to delete a master
 device.

---
 Xi/chdevhier.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/Xi/chdevhier.c b/Xi/chdevhier.c
index 0b2e3f1ab..65ff3873b 100644
--- a/Xi/chdevhier.c
+++ b/Xi/chdevhier.c
@@ -88,9 +88,6 @@ ProcXChangeDeviceHierarchy(ClientPtr client)
     REQUEST(xChangeDeviceHierarchyReq);
     REQUEST_AT_LEAST_SIZE(xChangeDeviceHierarchyReq);
 
-    /* XXX: check if client is allowed to change hierarch */
-
-
     any = (xAnyHierarchyChangeInfo*)&stuff[1];
     while(stuff->num_changes--)
     {
@@ -109,10 +106,13 @@ ProcXChangeDeviceHierarchy(ClientPtr client)
                     char* name;
                     int ret;
 
+                    /* XXX: check for creation permission */
+
                     SWAPIF(swaps(&c->namelen, n));
                     name = xcalloc(c->namelen + 1, sizeof(char));
                     strncpy(name, (char*)&c[1], c->namelen);
 
+
                     ret = AllocMasterDevice(name, &ptr, &keybd);
                     if (ret != Success)
                     {
@@ -143,7 +143,7 @@ ProcXChangeDeviceHierarchy(ClientPtr client)
                         return BadValue;
 
                     rc = dixLookupDevice(&ptr, r->deviceid, client,
-                                         DixWriteAccess);
+                                         DixDestroyAccess);
                     if (rc != Success)
                         return rc;
 
@@ -160,13 +160,26 @@ ProcXChangeDeviceHierarchy(ClientPtr client)
 
                     /* disable keyboards first */
                     if (IsPointerDevice(ptr))
-                        keybd = ptr->spriteInfo->paired;
+                    {
+                        rc = dixLookupDevice(&keybd,
+                                             ptr->spriteInfo->paired->id,
+                                             client,
+                                             DixDestroyAccess);
+                        if (rc != Success)
+                            return rc;
+                    }
                     else
                     {
                         keybd = ptr;
-                        ptr = keybd->spriteInfo->paired;
+                        rc = dixLookupDevice(&ptr,
+                                             keybd->spriteInfo->paired->id,
+                                             client,
+                                             DixDestroyAccess);
+                        if (rc != Success)
+                            return rc;
                     }
 
+
                     /* Disabling sends the devices floating, reattach them if
                      * desired. */
                     if (r->returnMode == AttachToMaster)