summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorTobias Himmer <provisorisch@online.de>2015-01-23 02:13:17 +0100
committerPeter Hutterer <peter.hutterer@who-t.net>2015-01-23 12:05:28 +1000
commitabc4a8b60387c3c9ae8b0199bf61acede4f6dba2 (patch)
tree84b0324e5577b6ebfa19189beb40f0cd74b6580f /src
parentb370ccdff8f721de75d3d91486cc4807668d040c (diff)
Check for incoming MT slot indices exceeding the allocated number of slots.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=88715 Signed-off-by: Tobias Himmer <provisorisch@online.de> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'src')
-rw-r--r--src/evdev.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/src/evdev.c b/src/evdev.c
index 2d99f07..5cbce35 100644
--- a/src/evdev.c
+++ b/src/evdev.c
@@ -733,6 +733,14 @@ EvdevProcessTouchEvent(InputInfoPtr pInfo, struct input_event *ev)
if (ev->code == ABS_MT_SLOT) {
EvdevProcessTouch(pInfo);
+ if (ev->value >= num_slots(pEvdev) ) {
+ LogMessageVerbSigSafe(X_WARNING, 0,
+ "%s: Slot index %d out of bounds (max %d), touch events may be incorrect.\n",
+ pInfo->name,
+ ev->value,
+ num_slots(pEvdev) - 1);
+ return;
+ }
pEvdev->cur_slot = ev->value;
} else
{