diff options
author | Peter Harris <pharris@opentext.com> | 2013-06-11 12:57:59 -0400 |
---|---|---|
committer | Peter Harris <pharris@opentext.com> | 2013-07-02 11:46:25 -0400 |
commit | 885896d3b3eea00bce773e9f28c6a78b3111d2b8 (patch) | |
tree | ff733a7ab845fdcf9777811c4d084479bec0323a | |
parent | 1fd79b1b4dccd26434022c4b532a69be40d34b0b (diff) |
XI/ChangePointerDevice: Fix double-free
XCloseDevice frees the device parameter, even if it references an
invalid device. Therefore, the device parameter must not be on the stack.
Since xts5/XI does not clean up the devices created by
Setup_Extension_DeviceInfo, it is safe to XCloseDevice "device".
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Harris <pharris@opentext.com>
-rw-r--r-- | xts5/XI/ChangePointerDevice.m | 59 |
1 files changed, 31 insertions, 28 deletions
diff --git a/xts5/XI/ChangePointerDevice.m b/xts5/XI/ChangePointerDevice.m index d203f6e3..f80ced42 100644 --- a/xts5/XI/ChangePointerDevice.m +++ b/xts5/XI/ChangePointerDevice.m @@ -415,7 +415,10 @@ XDevice bogus; else FAIL; - device = &bogus; + /* + * Since xts5/XI does not clean up the devices created by + * Setup_Extension_DeviceInfo, it is safe to XCloseDevice "device". + */ XCloseDevice(display, device); XSync(display,0); if (geterr() == baddevice) @@ -426,7 +429,7 @@ XDevice bogus; else FAIL; - XSetDeviceMode(display, device, Absolute); + XSetDeviceMode(display, &bogus, Absolute); XSync(display,0); if (geterr() == baddevice) { @@ -436,7 +439,7 @@ XDevice bogus; else FAIL; - XGetDeviceMotionEvents(display, device, CurrentTime, CurrentTime, + XGetDeviceMotionEvents(display, &bogus, CurrentTime, CurrentTime, &nevents, &mode, &evcount); if (geterr() == baddevice) { @@ -446,7 +449,7 @@ XDevice bogus; else FAIL; - XChangeKeyboardDevice(display, device); + XChangeKeyboardDevice(display, &bogus); XSync(display,0); if (geterr() == baddevice) { @@ -456,7 +459,7 @@ XDevice bogus; else FAIL; - XChangePointerDevice(display, device, 0, 1); + XChangePointerDevice(display, &bogus, 0, 1); XSync(display,0); if (geterr() == baddevice) { @@ -466,7 +469,7 @@ XDevice bogus; else FAIL; - XGrabDevice(display, device, w, True, 1, &devicemotionnotifyclass, + XGrabDevice(display, &bogus, w, True, 1, &devicemotionnotifyclass, GrabModeAsync, GrabModeAsync, CurrentTime); if (geterr() == baddevice) { @@ -476,7 +479,7 @@ XDevice bogus; else FAIL; - XUngrabDevice(display, device, CurrentTime); + XUngrabDevice(display, &bogus, CurrentTime); XSync(display,0); if (geterr() == baddevice) { @@ -486,7 +489,7 @@ XDevice bogus; else FAIL; - XGrabDeviceKey(display, device, AnyKey, AnyModifier, NULL, + XGrabDeviceKey(display, &bogus, AnyKey, AnyModifier, NULL, w, True, 0, NULL, GrabModeAsync, GrabModeAsync); if (geterr() == baddevice) { @@ -496,7 +499,7 @@ XDevice bogus; else FAIL; - XUngrabDeviceKey(display, device, AnyKey, AnyModifier, NULL, w); + XUngrabDeviceKey(display, &bogus, AnyKey, AnyModifier, NULL, w); XSync(display,0); if (geterr() == baddevice) @@ -507,7 +510,7 @@ XDevice bogus; else FAIL; - XGrabDeviceButton(display, device, AnyButton, AnyModifier, NULL, + XGrabDeviceButton(display, &bogus, AnyButton, AnyModifier, NULL, w, True, 0, NULL, GrabModeAsync, GrabModeAsync); if (geterr() == baddevice) { @@ -517,7 +520,7 @@ XDevice bogus; else FAIL; - XUngrabDeviceButton(display, device, AnyButton, AnyModifier, NULL, w); + XUngrabDeviceButton(display, &bogus, AnyButton, AnyModifier, NULL, w); XSync(display,0); if (geterr() == baddevice) { @@ -527,7 +530,7 @@ XDevice bogus; else FAIL; - XAllowDeviceEvents(display, device, AsyncAll, CurrentTime); + XAllowDeviceEvents(display, &bogus, AsyncAll, CurrentTime); XSync(display,0); if (geterr() == baddevice) { @@ -537,7 +540,7 @@ XDevice bogus; else FAIL; - XGetDeviceFocus(display, device, &focus, &revert, &time); + XGetDeviceFocus(display, &bogus, &focus, &revert, &time); if (geterr() == baddevice) { CHECK; @@ -546,7 +549,7 @@ XDevice bogus; else FAIL; - XSetDeviceFocus(display, device, None, RevertToNone, CurrentTime); + XSetDeviceFocus(display, &bogus, None, RevertToNone, CurrentTime); XSync(display,0); if (geterr() == baddevice) { @@ -556,7 +559,7 @@ XDevice bogus; else FAIL; - XGetFeedbackControl(display, device, &nfeed); + XGetFeedbackControl(display, &bogus, &nfeed); if (geterr() == baddevice) { CHECK; @@ -568,7 +571,7 @@ XDevice bogus; feedctl.class = KbdFeedbackClass; feedctl.percent = 0; mask = DvPercent; - XChangeFeedbackControl(display, device, mask, (XFeedbackControl*) &feedctl); + XChangeFeedbackControl(display, &bogus, mask, (XFeedbackControl*) &feedctl); XSync(display,0); if (geterr() == baddevice) { @@ -578,7 +581,7 @@ XDevice bogus; else FAIL; - XGetDeviceKeyMapping(display, device, MinKeyCode, 1, &ksyms_per); + XGetDeviceKeyMapping(display, &bogus, MinKeyCode, 1, &ksyms_per); if (geterr() == baddevice) { CHECK; @@ -587,7 +590,7 @@ XDevice bogus; else FAIL; - XChangeDeviceKeyMapping(display, device, MinKeyCode, 1, &ksyms, 1); + XChangeDeviceKeyMapping(display, &bogus, MinKeyCode, 1, &ksyms, 1); XSync(display,0); if (geterr() == baddevice) { @@ -597,7 +600,7 @@ XDevice bogus; else FAIL; - XGetDeviceModifierMapping(display, device); + XGetDeviceModifierMapping(display, &bogus); if (geterr() == baddevice) { CHECK; @@ -606,7 +609,7 @@ XDevice bogus; else FAIL; - XSetDeviceModifierMapping(display, device, modmap); + XSetDeviceModifierMapping(display, &bogus, modmap); XSync(display,0); if (geterr() == baddevice) { @@ -616,7 +619,7 @@ XDevice bogus; else FAIL; - XGetDeviceButtonMapping(display, device, bmap, 8); + XGetDeviceButtonMapping(display, &bogus, bmap, 8); if (geterr() == baddevice) { CHECK; @@ -625,7 +628,7 @@ XDevice bogus; else FAIL; - XSetDeviceButtonMapping(display, device, bmap, 8); + XSetDeviceButtonMapping(display, &bogus, bmap, 8); XSync(display,0); if (geterr() == baddevice) { @@ -635,7 +638,7 @@ XDevice bogus; else FAIL; - XQueryDeviceState(display, device); + XQueryDeviceState(display, &bogus); if (geterr() == baddevice) { CHECK; @@ -644,7 +647,7 @@ XDevice bogus; else FAIL; - XSetDeviceValuators(display, device, &valuators, 0, 1); + XSetDeviceValuators(display, &bogus, &valuators, 0, 1); XSync(display,0); if (geterr() == baddevice) { @@ -654,7 +657,7 @@ XDevice bogus; else FAIL; - XDeviceBell(display, device, 0, 0, 100); + XDeviceBell(display, &bogus, 0, 0, 100); XSync(display,0); if (geterr() == baddevice) { @@ -664,7 +667,7 @@ XDevice bogus; else FAIL; - XGetDeviceControl(display, device, DEVICE_RESOLUTION); + XGetDeviceControl(display, &bogus, DEVICE_RESOLUTION); if (geterr() == baddevice) { CHECK; @@ -678,7 +681,7 @@ XDevice bogus; dctl.num_valuators=1; dctl.first_valuator=0; dctl.resolutions = &valuators; - XChangeDeviceControl(display, device, DEVICE_RESOLUTION, (XDeviceControl*) &dctl); + XChangeDeviceControl(display, &bogus, DEVICE_RESOLUTION, (XDeviceControl*) &dctl); XSync(display,0); if (geterr() == baddevice) { @@ -689,7 +692,7 @@ XDevice bogus; FAIL; ev.type = devicemotionnotify; - XSendExtensionEvent(display, device, PointerWindow, True, 0, NULL, + XSendExtensionEvent(display, &bogus, PointerWindow, True, 0, NULL, &ev); XSync(display,0); if (geterr() == baddevice) |