diff options
| author | Alan Coopersmith <alan.coopersmith@sun.com> | 2009-09-15 17:53:50 -0700 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2009-09-16 11:44:08 +1000 |
| commit | 139368f7ae192b592e24d013e8ca5ce4175effe1 (patch) | |
| tree | a31c5bd7a48e529c58d849984dd7d988c23cc4a7 /test | |
| parent | 13decf5efe76e735a003227c951e58a41e36a8b5 (diff) | |
Fix num_masks/length overflow test for XiSelectEvents
Have to set windowid to a valid value first, since that check
appears earlier in the code than the masks/length check.
Also have to have data[] set large enough so that reading mask
data for 0xFFFF masks doesn't overflow past the end of the array
into uninitialized data.
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'test')
| -rw-r--r-- | test/xi2/protocol-xiselectevents.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/test/xi2/protocol-xiselectevents.c b/test/xi2/protocol-xiselectevents.c index f314462b5..fe1c26df8 100644 --- a/test/xi2/protocol-xiselectevents.c +++ b/test/xi2/protocol-xiselectevents.c @@ -60,7 +60,7 @@ #include "protocol-common.h" #include <glib.h> -static unsigned char *data[4096 * 16]; /* the request data buffer */ +static unsigned char *data[4096 * 20]; /* the request data buffer */ int __wrap_XISetEventMask(DeviceIntPtr dev, WindowPtr win, int len, unsigned char* mask) { @@ -284,6 +284,7 @@ static void test_XISelectEvents(void) request_XISelectEvent(req, BadWindow); g_test_message("Triggering num_masks/length overflow"); + req->win = ROOT_WINDOW_ID; /* Integer overflow - req->length can't hold that much */ req->num_masks = 0xFFFF; request_XISelectEvent(req, BadLength); |