Xi: fix broken swap code in XISelectEvents request processing.
The pointer advanced 12 bytes too short. Rather unfortunate if both the code and the test have the same bug. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
parent
727de7c90d
commit
b41db8fe46
|
@ -73,7 +73,7 @@ SProcXISelectEvents(ClientPtr client)
|
|||
{
|
||||
swaps(&evmask->deviceid, n);
|
||||
swaps(&evmask->mask_len, n);
|
||||
evmask = (xXIEventMask*)(((char*)evmask) + evmask->mask_len * 4);
|
||||
evmask = (xXIEventMask*)(((char*)&evmask[1]) + evmask->mask_len * 4);
|
||||
}
|
||||
|
||||
return (ProcXISelectEvents(client));
|
||||
|
|
|
@ -113,7 +113,7 @@ static void request_XISelectEvent(xXISelectEventsReq *req, int error)
|
|||
mask = (xXIEventMask*)&req[1];
|
||||
for (i = 0; i < req->num_masks; i++)
|
||||
{
|
||||
next = (xXIEventMask*)((char*)mask) + mask->mask_len;
|
||||
next = (xXIEventMask*)((char*)&mask[1] + mask->mask_len * 4);
|
||||
swaps(&mask->deviceid, n);
|
||||
swaps(&mask->mask_len, n);
|
||||
mask = next;
|
||||
|
|
Loading…
Reference in New Issue
Block a user