diff options
| author | Povilas Kanapickas <povilas@radix.lt> | 2022-01-23 22:18:52 +0200 |
|---|---|---|
| committer | Povilas Kanapickas <povilas@radix.lt> | 2022-02-09 11:33:03 +0000 |
| commit | 6ef5c05728f8b18170fbc8415d7502495a08670b (patch) | |
| tree | c9f4456d70f4b88e8ca681c7fc28eb8ceb74081e /Xi | |
| parent | 34b870da8833b2450f48fd8036c9a7eff5c19e95 (diff) | |
dix: Correctly save replayed event into GrabInfoRec
When processing events we operate on InternalEvent pointers. They may
actually refer to a an instance of DeviceEvent, GestureEvent or any
other event that comprises the InternalEvent union. This works well in
practice because we always look into event type before doing anything,
except in the case of copying the event.
*dst_event = *src_event would copy whole InternalEvent event and would
cause out of bounds read in case the pointed to event was not
InternalEvent but e.g. DeviceEvent.
This regression has been introduced in
23a8b62d34344575f9df9d057fb74bfefa94a77b.
Fixes https://gitlab.freedesktop.org/xorg/xserver/-/issues/1261
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
Diffstat (limited to 'Xi')
| -rw-r--r-- | Xi/exevents.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Xi/exevents.c b/Xi/exevents.c index 94b9983bd..217baa956 100644 --- a/Xi/exevents.c +++ b/Xi/exevents.c @@ -1524,7 +1524,7 @@ DeliverTouchEmulatedEvent(DeviceIntPtr dev, TouchPointInfoPtr ti, g = AllocGrab(devgrab); BUG_WARN(!g); - *dev->deviceGrab.sync.event = *ev; + CopyPartialInternalEvent(dev->deviceGrab.sync.event, ev); /* The listener array has a sequence of grabs and then one event * selection. Implicit grab activation occurs through delivering an |