From b41db8fe460fc0956922b79261752d1bb104684f Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Wed, 2 Sep 2009 08:57:40 +1000 Subject: [PATCH] Xi: fix broken swap code in XISelectEvents request processing. The pointer advanced 12 bytes too short. Rather unfortunate if both the code and the test have the same bug. Signed-off-by: Peter Hutterer --- Xi/xiselectev.c | 2 +- test/xi2/protocol-xiselectevents.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c index d4f5faa7c..16eada7c8 100644 --- a/Xi/xiselectev.c +++ b/Xi/xiselectev.c @@ -73,7 +73,7 @@ SProcXISelectEvents(ClientPtr client) { swaps(&evmask->deviceid, n); swaps(&evmask->mask_len, n); - evmask = (xXIEventMask*)(((char*)evmask) + evmask->mask_len * 4); + evmask = (xXIEventMask*)(((char*)&evmask[1]) + evmask->mask_len * 4); } return (ProcXISelectEvents(client)); diff --git a/test/xi2/protocol-xiselectevents.c b/test/xi2/protocol-xiselectevents.c index ac38c53c9..9782cff5c 100644 --- a/test/xi2/protocol-xiselectevents.c +++ b/test/xi2/protocol-xiselectevents.c @@ -113,7 +113,7 @@ static void request_XISelectEvent(xXISelectEventsReq *req, int error) mask = (xXIEventMask*)&req[1]; for (i = 0; i < req->num_masks; i++) { - next = (xXIEventMask*)((char*)mask) + mask->mask_len; + next = (xXIEventMask*)((char*)&mask[1] + mask->mask_len * 4); swaps(&mask->deviceid, n); swaps(&mask->mask_len, n); mask = next;