Xi: fix modifier offset in XIPassiveGrab swapping function

The request is followed by mask_len 4-byte units, then followed by the actual
modifiers.

Also fix up the swapping test, which had the same issue.

Reported-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
Peter Hutterer 2014-01-24 16:51:02 +10:00
parent c1ce807d9f
commit 76b3be75b6
2 changed files with 9 additions and 2 deletions

View File

@ -63,7 +63,7 @@ SProcXIPassiveGrabDevice(ClientPtr client)
swaps(&stuff->mask_len);
swaps(&stuff->num_modifiers);
mods = (uint32_t *) &stuff[1];
mods = (uint32_t *) &stuff[1] + stuff->mask_len;
for (i = 0; i < stuff->num_modifiers; i++, mods++) {
swapl(mods);

View File

@ -137,6 +137,7 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req,
{
int rc;
int local_modifiers;
int mask_len;
rc = ProcXIPassiveGrabDevice(&client_request);
assert(rc == error);
@ -153,10 +154,11 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req,
swaps(&req->deviceid);
local_modifiers = req->num_modifiers;
swaps(&req->num_modifiers);
mask_len = req->mask_len;
swaps(&req->mask_len);
while (local_modifiers--) {
CARD32 *mod = ((CARD32 *) (req + 1)) + local_modifiers;
CARD32 *mod = (CARD32 *) (req + 1) + mask_len + local_modifiers;
swapl(mod);
}
@ -228,6 +230,11 @@ test_XIPassiveGrabDevice(void)
request->detail = XIAnyButton;
request_XIPassiveGrabDevice(&client_request, request, Success, 0);
/* Set a few random masks to make sure we handle modifiers correctly */
SetBit(mask, XI_ButtonPress);
SetBit(mask, XI_KeyPress);
SetBit(mask, XI_Enter);
/* some modifiers */
request->num_modifiers = N_MODS;
request->length += N_MODS;