summaryrefslogtreecommitdiff
path: root/Xi
diff options
context:
space:
mode:
authorPeter Hutterer <peter.hutterer@who-t.net>2009-09-01 16:30:52 +1000
committerPeter Hutterer <peter.hutterer@who-t.net>2009-09-03 08:39:27 +1000
commit59a6d7d478903a8bc9c5d4cc8b2e62e2ad102dba (patch)
treea5e16ec29cae585656c9531d33e67a433fad55d1 /Xi
parent83db2b126e8623824e1303e74070375994984599 (diff)
Xi: don't overrun memory for grab masks.
A grab mask provided in the request may be larger than the one used in the server. Cut down to size before memcopying. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'Xi')
-rw-r--r--Xi/xigrabdev.c4
-rw-r--r--Xi/xipassivegrab.c4
2 files changed, 6 insertions, 2 deletions
diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c
index 95beb832b..5394b1900 100644
--- a/Xi/xigrabdev.c
+++ b/Xi/xigrabdev.c
@@ -66,6 +66,7 @@ ProcXIGrabDevice(ClientPtr client)
int ret = Success;
uint8_t status;
GrabMask mask;
+ int mask_len;
REQUEST(xXIGrabDeviceReq);
REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq);
@@ -77,8 +78,9 @@ ProcXIGrabDevice(ClientPtr client)
if (!IsMaster(dev))
stuff->paired_device_mode = GrabModeAsync;
+ mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4);
memset(mask.xi2mask, 0, sizeof(mask.xi2mask));
- memcpy(mask.xi2mask, (char*)&stuff[1], stuff->mask_len * 4);
+ memcpy(mask.xi2mask, (char*)&stuff[1], mask_len);
ret = GrabDevice(client, dev, stuff->grab_mode,
stuff->paired_device_mode,
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index 1d6200f3a..0cfdc1d9b 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -86,6 +86,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
GrabMask mask;
GrabParameters param;
void *tmp;
+ int mask_len;
REQUEST(xXIPassiveGrabDeviceReq);
REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
@@ -127,8 +128,9 @@ ProcXIPassiveGrabDevice(ClientPtr client)
}
}
+ mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4);
memset(mask.xi2mask, 0, sizeof(mask.xi2mask));
- memcpy(mask.xi2mask[stuff->deviceid], &stuff[1], stuff->mask_len * 4);
+ memcpy(mask.xi2mask[stuff->deviceid], &stuff[1], mask_len * 4);
rep.repType = X_Reply;
rep.RepType = X_XIPassiveGrabDevice;