Error: Write outside array bounds at Xext/geext.c:406
in function 'GEWindowSetMask' [Symbolic analysis]
In array dereference of cli->nextSib[extension] with index 'extension'
Array size is 128 elements (of 4 bytes each), index <= 128
Error: Buffer overflow at dix/events.c:592
in function 'SetMaskForEvent' [Symbolic analysis]
In array dereference of filters[deviceid] with index 'deviceid'
Array size is 20 elements (of 512 bytes each), index >= 0 and index <= 20
Error: Read buffer overflow at hw/xfree86/loader/loader.c:226
in function 'LoaderOpen' [Symbolic analysis]
In array dereference of refCount[new_handle] with index 'new_handle'
Array size is 256 elements (of 4 bytes each), index >= 1 and index <= 256
These bugs were found using the Parfait source code analysis tool.
For more information see http://research.sun.com/projects/parfait
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
This wrong check may cause BadLength to be returned to the client even if the
length is correct.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
We only put internal events into the queue now, so let's check for ET_Motion
rather than the MotionNotify.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This is a shorthand for disabling acceleration, while retaining the
possiblity to use constant deceleration. If constant deceleration is
also unused, it will optimize motion processing.
Other possiblities to deactivate acceleration were quite hidden,
and didn't always work as expected. E.g. xset m 1 1 would retain
adaptive deceleration, while xset m 1 0 would not (in the default
profile).
Also removes the 'reserved' profile; it was unused and it's trivial
to add new ones anyway.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
newer gcc's warn against how this cast is done (though it eludes me why),
and lrintf() is also faster especially on insane processors like the P4
(http://www.mega-nerd.com/FPcast).
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
With the Xtest virtual slave devices we have 4 devices for each MD
pointer/keyboard pair, plus the AllDevices and AllMasterDevices reserved
deviceids. It's quite easy to hit the current limit.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
BadDevice is an XI error, but this cannot happen for core XTest fake input
anyway since the device will be the matching virtual XTest slave device.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
A driver with this hook will take care of preparing the outputs & crtcs,
so calling the prepare functions will just cause unnecessary flicker.
Fixes bug #21077
When ProcXkbSetNamedIndicator is called on a core device, and we
walk the slaves to set the LED's on each of them, ignore any slaves
that do not have either a KbdFeedbackCtrl or LedCtrl structure.
(This is much more critical in xserver-1.5-branch, where we walk
*all* devices, not just the slaves of the specified master, and
thus return failure when setting an LED on the Core Keyboard and
hit a xf86-input-mouse device with no LED's to set.)
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
For redirected rendering we end up with pixmaps (which the app thinks are
windows) that are double buffered.
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Tested-by: Pierre Willenbrock <pierre@pirsoft.de>
Zapping is triggered by xkb these days, so note in the man page that it's the
Terminate_Server action. Since it's XKB, personal preferences towards or
against zapping should be achieved through xkb rulesets.
If Terminate_Server is not in the xkb actions, then we can't zap anyway and we
don't need a default of DontZap "on".
This patch restores the old meaning of DontZap - disallow zapping altogether,
regardless of XKB's current keymap.
Ideally, this patch should be accompanied by b0f64bdab00db652e in
xkeyboard-config.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This patch adds a test/ directory that contains the setup for a unit-testing
suite designed for in-server unit-testing. All functions available to the X
server are available to the test binaries through static linking.
This test suite uses the glib testing framework.
Do not use glib calls outside of the test/ directory.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
All other functions are pushed into where they seemed to fit.
main.c is now linked separately into libmain.a and linked in by the various
DDXs.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
For embedded use, it's convenient to be able to disable the cursor
completely, without having to audit and fix up all your third-party
code (e.g. Mozilla Firefox).
Add -nocursor and -cursor server options to enable and disable the
cursor. The default is still -cursor, but embedded users can run the
server with -nocursor to hide the cursor regardless of what
application developers do.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Drivers need this if they add visuals that require implicit redirection. Add a
new SDK header, compositeext.h, to contain the prototype for this function.
This change implements the protocol for DRI2GetBuffersWithFormat, but
the bulk of the differences are the changes to the extension / driver
interface to make this function work. The old CreateBuffers and
DeleteBuffers routines are replaced with CreateBuffer and DeleteBuffer
(both singular).
This allows drivers to allocate buffers for a drawable one at a time.
As a result, 3D drivers can now allocate the (fake) front-buffer for a
window only when it is needed. Since 3D drivers only ask for the
front-buffer on demand, the real front-buffer is always created. This
allows CopyRegion impelemenations of SwapBuffers to continue working.
As with previous version of this code, if the client asks for the
front-buffer for a window, we instead give it the fake front-buffer.
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Kristian Høgsberg <krh@redhat.com>
commit 64b7f96dca accidentally inverted the comparison, could
result in crashes on some systems later on.
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
mieqProcessInputEvents doesn't process events from MDs anymore, so we don't
need to check for pDev->isMaster.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
A XTest virtual slave device pair (kbd/ptr) exists for every master
device pair. This is so XTest events are correctly propogated via slave
devices up to Master devices and the classes are correctly changed along
the way. We add the XTest slave device pair to the Virtual Core pointer
and provide a simple way of creating the devices.
A XTest Slave Device is identified by the XTstDevicePrivateKey property
being set in the devices devProperties
XI events are still propagated through the matching device, in the hope the
client knows what it is doing.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This adds a revised pixmap hook for driver pixmaps, which is
required to support tiling on various chips.
Signed-off-by: Dave Airlie <airlied@redhat.com>
This prevents building an older server with a new dri2proto.h from
resulting in a DRI2 extension module that lies about the version it
supports.
Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Allocating a slave device is essentially the same as allocating a master device.
Hence we rename AllocMaster to AllocDevicePair and provided the ability to
indicate if a master or slave device pair is required.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Some keyboards (?) advertise more than MAX_VALUATORS axes. Parts of the
internal event delivery relies on not having more than MAX_VALUATOR axes, so
let's cap it down.
If there's real devices that require more than the current 36, I'm sure we can
bump this up.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
