If acpid sends a string in a format that we can't parse, bail out instead of
potentially dereferencing a NULL-pointer.
X.Org Bug 73227 <http://bugs.freedesktop.org/show_bug.cgi?id=73227>
Signed-off-by: Ted Felix <ted@tedfelix.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
mask[(MAX_VALUATORS + 7)/8] is larger than data[MAX_VALUATORS], so static
code checkers think we may be running OOB on the data array. Mask is
initialized to 0, so this should not happen, but change it anyway to shut up
code analyzer noise.
X.Org Bug 59939 <http://bugs.freedesktop.org/show_bug.cgi?id=59939>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
dv is still NULL at this point, so return firstValuator instead (which is
the same value dv->firstValuator would be once initialized)
X.Org Bug 59937 <http://bugs.freedesktop.org/show_bug.cgi?id=59937>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
dmx-config.h is a server header which includes dix-config.h. That again
defines a bunch of server-specifics, including setting the size of XID to
32 bit.
libX11 uses unsigned long (8 bits on x86_64). XGCValues thus ends up being
16 bytes smaller in xdmxconfig than in the library, causing garbage to be
sent to the server.
X.Org Bug 37502 <http://bugs.freedesktop.org/show_bug.cgi?id=37502>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Call find_header first, returning on failure before calling malloc.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Found by parfait 1.1 memory analyser:
Memory leak of pointer 'pAdapt' allocated with malloc((88 * num_adaptors))
at line 162 of hw/xfree86/common/xf86xvmc.c in function 'xf86XvMCScreenInit'.
'pAdapt' allocated at line 158 with malloc((88 * num_adaptors)).
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Also avoids leaving invalid pointers in structures if realloc had to
move them elsewhere to make them larger.
Found by parfait 1.1 code analyzer:
Memory leak of pointer 'newCallbacks' allocated with realloc(((char*)offman->FreeBoxesUpdateCallback), (8 * (offman->NumCallbacks + 1)))
at line 328 of hw/xfree86/common/xf86fbman.c in function 'localRegisterFreeBoxCallback'.
'newCallbacks' allocated at line 320 with realloc(((char*)offman->FreeBoxesUpdateCallback), (8 * (offman->NumCallbacks + 1))).
newCallbacks leaks when newCallbacks != NULL at line 327.
Memory leak of pointer 'newPrivates' allocated with realloc(((char*)offman->devPrivates), (8 * (offman->NumCallbacks + 1)))
at line 328 of hw/xfree86/common/xf86fbman.c in function 'localRegisterFreeBoxCallback'.
'newPrivates' allocated at line 324 with realloc(((char*)offman->devPrivates), (8 * (offman->NumCallbacks + 1))).
newPrivates leaks when newCallbacks == NULL at line 327.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reported by parfait 1.1 code analyzer:
Error: Null pointer dereference (CWE 476)
Read from null pointer 'p'
at line 746 of hw/xfree86/common/xf86Option.c in function 'xf86TokenToOptName'.
Function 'xf86TokenToOptinfo' may return constant 'NULL' at line 721, called at line 745.
Null pointer introduced at line 721 in function 'xf86TokenToOptinfo'.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Our in-house parfait 1.1 code analysis tool complained that every exit
path from xf86ValidateModes() in hw/xfree86/common/xf86Mode.c leaks the
storeClockRanges allocation made at line 1501 with XNFalloc.
Investigating, it seems that this code to copy the clock range list to
the clockRanges list in the screen pointer is just plain insane, and
according to git, has been since we first imported it from XFree86.
We start at line 1495 by walking the linked list from scrp->clockRanges
until we find the end. But that was just a diversion, since we've found
the end and immediately forgotten it, and thus at 1499 we know that
storeClockRanges is NULL, but that's not a problem since we're going to
immediately overwrite that value as the first thing in the loop.
So we move on through this loop at 1499, which takes us through the
linked list from the clockRanges variable, and for every entry in
that list allocates a new structure and copies cp to it. If we've
not filled in the screen's clockRanges pointer yet, we set it to
the first storeClockRanges we copied from cp. Otherwise, as best
I can tell, we just drop it into memory and let it leak away, as
parfait warned.
And then we hit the loop action, which if we haven't hit the end of
the cp list, advances cp to the next item in the list, and then just
for the fun of it, also sets storeClockRanges to the ->next pointer it
has just copied from cp as well, even though it's going to overwrite
it as the very first instruction in the loop body.
v2: rewritten using nt_list_* macros from Xorg's list.h header
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Found by parfait 1.1 code analyser:
Memory leak of pointer 'keymap' allocated with XGetKeyboardMapping(HostX.dpy, min_keycode, ((max_keycode - min_keycode) + 1), &host_width)
at line 861 of hw/kdrive/ephyr/hostx.c in function 'hostx_load_keymap'.
'keymap' allocated at line 845 with XGetKeyboardMapping(HostX.dpy, min_keycode, ((max_keycode - min_keycode) + 1), &host_width).
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Found by parfait 1.1 code analyzer:
Error: Memory leak (CWE 401)
Memory leak of pointer 'overlayWin' allocated with malloc(72)
at line 806 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
pointer allocated at line 794 with malloc(72).
<unknown> leaks when rc != 0 at line 804.
at line 816 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
pointer allocated at line 794 with malloc(72).
<unknown> leaks when pOc == NULL at line 815.
at line 825 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
pointer allocated at line 794 with malloc(72).
<unknown> leaks when cs->pOverlayWin == NULL at line 822
and compCreateOverlayWindow(pScreen) == 0 at line 823.
at line 834 of composite/compext.c in function 'PanoramiXCompositeGetOverlayWindow'.
pointer allocated at line 794 with malloc(72).
<unknown> leaks when rc != 0 at line 832.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Check for NULL pointer (which can be returned for multiple reasons)
before trying to dereference it to add privates. To avoid memory leak
in error path, delay malloc of privates until we're ready to add them.
In case we do return NULL up through SyncInitDeviceIdleTime, handle the
possibility of getting NULL passed back down to SyncRemoveDeviceIdleTime.
As reported by parfait 1.1:
Error: Null pointer dereference (CWE 476)
Read from null pointer 'idle_time_counter'
at line 2764 of xserver/Xext/sync.c in function 'init_system_idle_counter'.
Function 'SyncCreateSystemCounter' may return constant 'NULL' at line 952, called at line 2756.
Null pointer introduced at line 952 in function 'SyncCreateSystemCounter'.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
This was accidentally excluded when we added barriers.
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
udev.c: In function 'device_removed':
udev.c:270:9: warning: format '%d' expects argument of type 'int', but argument 3 has type 'const char *' [-Wformat]
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
inputstr, double defines TouchListener typedef, maybe some gcc handles it,
but not all.
fixes tinderbox
Reported-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
This is the lazy man's %f support. Print the decimal part of the number,
then append a decimal point, then print the first two digits of the
fractional part. So %f in sigsafe printing is really %.2f.
No boundary checks in place here.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Until we have support for them, ignore any length modifiers so we don't need
to update all callers.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Ever looked at your own code and thought 'WTF was I thinking?'. yeah, that.
Instead of passing in the expected string just use sprintf to print the
number for us and compare. In the end we're just trying to emulate printf
behaviour anyway.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Use ITaskBarList interface to ensure that the taskbar notices if the window has
changed it's style in a way which affects if the taskbar shows it or not.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Move styling update code from WM_WM_HINTS_EVENT to a function UpdateStyle(),
which is also invoked from WM_WM_MAP3, so everything which needs to be done
to style the window happens when it is mapped
(Otherwise, the appearance of the window is sensitive to the timing of the
notification of the windows appearance hint properties being set relative to
window creation. e.g. see [1])
[1] http://sourceware.org/ml/cygwin-xfree/2012-06/msg00004.html
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Future work: It looks like this code could be rationalized quite a lot: It might
make sense to pull the checking for override-redirect up out of UpdateIcon() and
UpdateName() and consolidate WM_WM_MAP2 and WM_WM_MAP3
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Add a new WM_WM_HINTS_EVENT event to update window style if any of the
properties which affect window style change
Check PropertyNotify events for any of the window properties which we consider
to decide on the window style, and update the window style by sending a
WM_WM_HINTS_EVENT message to the WM.
This allows the styling of the window to change during it's lifetime.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Move reshape code, which was only used when handling a map event, from
winUpdateWindowPosition(), to put it explicitly in the map event handler.
Remove 'reshape' parameter from winUpdatePosition().
(Note that there's no handling of the ShapeNotify event to notice when the
window shape changes, instead we hook the screen SetShape procedure and reshape
the native window then)
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
winglobals.h checks if RELOCATE_PROJECTROOT is defined to see if a declaration
of g_fLogFileChanged is needed, so must include xwin-config.h
Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
RELOCATE_PROJECTROOT is AC_DEFINED in configure.ac, but currently has no effect
as it doesn't appear in any AC_CONFIG_HEADER header.
When packaged for Windows, we do not have a unix-style filesystem tree, where
file needed by the X server can be found in fixed, absolute paths under the
prefix (PROJECTROOT).
Instead, the filesystem tree containing files needed by the X server and clients
will be installed with the directory containing the X server executable as the
root directory of that tree.
(Typically, this will be in the Program Files directory, which does not have a
fixed name, as it can be moved, localized, or added to to indicate x86 or x64
binaries)
So, RELOCATE_PROJECTROOT is used to make a native Windows build of the X server
look for various files (fonts, xkb data) in locations relative to the X server
rather than at absolute paths, by translating those paths at run-time.
Additionally the XKEYSYMDB, XERRORDB, XLOCALEDIR env vars checked by libX11 are
set appropriately for clients started by the X server.
Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
GetTouchEvents is usually called in a signal context.
Calling ErrorF for the error messages leads to X complaining about log:
(EE) BUG: triggered 'if (inSignalContext)'
(EE) BUG: log.c:484 in LogVMessageVerb()
(EE) Warning: attempting to log data in a signal unsafe manner while in signal context.
Please update to check inSignalContext and/or use LogMessageVerbSigSafe() or ErrorFSigSafe().
The offending log format message is:
%s: Attempted to start touch without x/y (driver bug)
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The changes to miPointerSetPosition interface from int->double breaks
the SIS driver build, so time to bump this.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
DGA only handles master devices but it does intercept slave device events as
well (since the event handlers are per event type, not per device).
The DGA code must thus call into UpdateDeviceState to reset the button/key
state on the slave device before it discards the remainder of the event.
Test case:
- Passive GrabModeSync on VCP
- Press button
- Enable DGA after ButtonPress
- AllowEvents(SyncPointer)
- Release button
The button release is handled by DGAProcessPointerEvent but the device state
is never updated, so the slave ends up with the button permanently down.
And since the master's button state is the union of the slave states, the
master has the button permanently down.
X.Org Bug 59100 <http://bugs.freedesktop.org/show_bug.cgi?id=59100>
Reported-by: Steven Elliott <selliott4@austin.rr.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Reported-by: Steven Elliott <selliott4@austin.rr.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
If a XI2.1+ client has a grab on a non-root window, it must still receive
raw events on the root window.
Test case: register for XI_ButtonPress on window and XI_RawMotion on root.
No raw events are received once the press activates an implicit grab on the
window.
X.Org Bug 53897 <http://bugs.freedesktop.org/show_bug.cgi?id=53897>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Add missing #include <pthread.h>
In file included from /jhbuild/checkout/xorg/xserver/hw/xwin/winSetAppUserModelID.c:31:0:
/jhbuild/checkout/xorg/xserver/hw/xwin/winwindow.h:140:11: error: expected declaration specifiers or ‘...’ before ‘pthread_t’
/jhbuild/checkout/xorg/xserver/hw/xwin/winwindow.h:141:11: error: expected declaration specifiers or ‘...’ before ‘pthread_t’
/jhbuild/checkout/xorg/xserver/hw/xwin/winwindow.h:142:11: error: expected declaration specifiers or ‘...’ before ‘pthread_mutex_t’
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
De-queuing Windows messages and X events happens in the same thread of
execution. Draining the windows message queue can lead to the X event queue
overflowing if lots of those windows messages cause X events (e.g. if a keyboard
macro program has just dumped thousands of keypresses into the Windows message
queue). See the mailing list thread [1] for more details.
Processing one Windows message per wakeup, rather than all of them gives the X
server a chance to do stuff as well after each message.
[1] http://cygwin.com/ml/cygwin-xfree/2010-01/msg00056.html
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Bring the X screen window to the front on a single left click on the tray icon,
like the comment says we do
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Instead of requiring every mode set to complete successfully, start up
as long as at least one CRTC is working. This avoids failures when one
or more CRTCs can't start due to mode setting conflicts.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Should've been removed in bc1f90a615018c05994fae3e678dd2341256cd82a, but got
left here due to a botched rebase.
Fixes stray button events sent to clients after deactivating an async
pointer grab on a pointer-emulating-touch.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
events.c: In function 'DeactivatePointerGrab':
events.c:1524:51: warning: 'dev' may be used uninitialized in this function
[-Wuninitialized
dev is unset when we get here, the device to check is "mouse".
Introduced in ece8157a59.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Instead of guessing what resource type the listener is and what property to
retrieve, store the resource type in the listener directly.
Breaks XIT test cases:
TouchGrabTestMultipleTaps.PassiveGrabPointerEmulationMultipleTouchesFastSuccession
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=56557
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Chase Douglas <chase.douglas@ubuntu.com>
This places a pointer to the grab related to a TouchListener directly
in the TouchListener structure rather than hoping to find the grab
later on using the resource ID.
Passive grabs have resource ID in the resource DB so they can be
removed when a client exits, and those resource IDs get copied when
activated, but implicit grabs are constructed on-the-fly and have no
resource DB entry.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
No reason to have a struct declared inside another struct
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The base group is not brought into range and, therefore, using it as an array
index crashed the X server. Also, at this place, we should ignore locked
groups, but not latched groups. Therefore, use sum of base and latched groups,
brought into range.
Reproducible with:
key <FK07> {
type= "ONE_LEVEL",
symbols[Group1]= [ NoSymbol ],
actions[Group1]= [ LatchGroup(group=-1, clearLocks) ]
};
And hitting F7 will exceed the group level and access arbitrary memory.
Signed-off-by: Andreas Wettstein <wettstein509@solnet.ch>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The loop above the previous call may end up triggering other
handlers attaching to the same function slot, so unwrapping
the handler after that could leave the just attached handler
in a dangling but not unset state.
This issue was most visible on the XO, where destroying a
window with an animated cursor set and running would trigger
this inconsistent state, never calling the miSpriteBlockHandler
again after the animated cursor is unset.
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Different miPointerSpriteFuncRec implementations do a varying
business at ultimately calling miPointerUpdateSprite(), this
particularly fails when using the plain mi sprite on touch events,
where the sprite is just moved/updated on cursor changes.
So, ensure miPointerUpdateSprite() is called generically for
pointer emulating touch events as with regular motion events.
Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>