From 76b3be75b62657e346731444736f7e4d200beb5b Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Fri, 24 Jan 2014 16:51:02 +1000 Subject: [PATCH 1/2] Xi: fix modifier offset in XIPassiveGrab swapping function The request is followed by mask_len 4-byte units, then followed by the actual modifiers. Also fix up the swapping test, which had the same issue. Reported-by: Alan Coopersmith Signed-off-by: Peter Hutterer Reviewed-by: Alan Coopersmith --- Xi/xipassivegrab.c | 2 +- test/xi2/protocol-xipassivegrabdevice.c | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c index eccec0ab8..8aba97781 100644 --- a/Xi/xipassivegrab.c +++ b/Xi/xipassivegrab.c @@ -63,7 +63,7 @@ SProcXIPassiveGrabDevice(ClientPtr client) swaps(&stuff->mask_len); swaps(&stuff->num_modifiers); - mods = (uint32_t *) &stuff[1]; + mods = (uint32_t *) &stuff[1] + stuff->mask_len; for (i = 0; i < stuff->num_modifiers; i++, mods++) { swapl(mods); diff --git a/test/xi2/protocol-xipassivegrabdevice.c b/test/xi2/protocol-xipassivegrabdevice.c index 1e2341eb7..c747ddf03 100644 --- a/test/xi2/protocol-xipassivegrabdevice.c +++ b/test/xi2/protocol-xipassivegrabdevice.c @@ -137,6 +137,7 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req, { int rc; int local_modifiers; + int mask_len; rc = ProcXIPassiveGrabDevice(&client_request); assert(rc == error); @@ -153,10 +154,11 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req, swaps(&req->deviceid); local_modifiers = req->num_modifiers; swaps(&req->num_modifiers); + mask_len = req->mask_len; swaps(&req->mask_len); while (local_modifiers--) { - CARD32 *mod = ((CARD32 *) (req + 1)) + local_modifiers; + CARD32 *mod = (CARD32 *) (req + 1) + mask_len + local_modifiers; swapl(mod); } @@ -228,6 +230,11 @@ test_XIPassiveGrabDevice(void) request->detail = XIAnyButton; request_XIPassiveGrabDevice(&client_request, request, Success, 0); + /* Set a few random masks to make sure we handle modifiers correctly */ + SetBit(mask, XI_ButtonPress); + SetBit(mask, XI_KeyPress); + SetBit(mask, XI_Enter); + /* some modifiers */ request->num_modifiers = N_MODS; request->length += N_MODS; From 9fc19168e7ca6308275bf8769d1ccb982f88465b Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Fri, 24 Jan 2014 23:42:49 -0800 Subject: [PATCH 2/2] Check for calloc() failure in add_master() Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Signed-off-by: Peter Hutterer --- Xi/xichangehierarchy.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c index e2f4b8a0a..9e36354d1 100644 --- a/Xi/xichangehierarchy.c +++ b/Xi/xichangehierarchy.c @@ -143,6 +143,10 @@ add_master(ClientPtr client, xXIAddMasterInfo * c, int flags[MAXDEVICES]) int rc; name = calloc(c->name_len + 1, sizeof(char)); + if (name == NULL) { + rc = BadAlloc; + goto unwind; + } strncpy(name, (char *) &c[1], c->name_len); rc = AllocDevicePair(client, name, &ptr, &keybd,