If the keycode range exceeds the allowable length, memory gets overwritten.
Catch this case by making sure that only allowed class types are
present.
X.Org Bug 25492 <http://bugs.freedesktop.org/show_bug.cgi?id=25492>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
The number of keycodes needs to be lower than 0xFFFD so that the length
field of xXIKeyInfo doesn't overflow.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
sizeof(in.valuators.mask) * 8 == 40, but the valuators arrays only
holds 36 entries, so the test was smashing the stack when 36 < i < 40
(leading to core dumps on Solaris x86, since the return address was
overwritten with an invalid pointer).
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
