diff options
| author | Andreas Wettstein <wettstein509@solnet.ch> | 2012-12-19 18:13:21 +0100 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2013-01-09 11:23:12 +1000 |
| commit | 3578cc3c2e1b5cb8eb191e2d12ad88e1bc9e6e1e (patch) | |
| tree | ca61c5e65d7c0ed98decdfbbd07e783fb8c99930 /xkb | |
| parent | df746a73410b892a4d41a2934cf9cd2e8ad7ba51 (diff) | |
xkb: Do not use base group as an array index.
The base group is not brought into range and, therefore, using it as an array
index crashed the X server. Also, at this place, we should ignore locked
groups, but not latched groups. Therefore, use sum of base and latched groups,
brought into range.
Reproducible with:
key <FK07> {
type= "ONE_LEVEL",
symbols[Group1]= [ NoSymbol ],
actions[Group1]= [ LatchGroup(group=-1, clearLocks) ]
};
And hitting F7 will exceed the group level and access arbitrary memory.
Signed-off-by: Andreas Wettstein <wettstein509@solnet.ch>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'xkb')
| -rw-r--r-- | xkb/xkbUtils.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/xkb/xkbUtils.c b/xkb/xkbUtils.c index c23cd7784..6c6af60f0 100644 --- a/xkb/xkbUtils.c +++ b/xkb/xkbUtils.c @@ -642,6 +642,7 @@ XkbComputeCompatState(XkbSrvInfoPtr xkbi) CARD16 grp_mask; XkbStatePtr state = &xkbi->state; XkbCompatMapPtr map; + XkbControlsPtr ctrls; if (!state || !xkbi->desc || !xkbi->desc->ctrls || !xkbi->desc->compat) return; @@ -650,9 +651,14 @@ XkbComputeCompatState(XkbSrvInfoPtr xkbi) grp_mask = map->groups[state->group].mask; state->compat_state = state->mods | grp_mask; state->compat_lookup_mods = state->lookup_mods | grp_mask; + ctrls= xkbi->desc->ctrls; - if (xkbi->desc->ctrls->enabled_ctrls & XkbIgnoreGroupLockMask) - grp_mask = map->groups[state->base_group].mask; + if (ctrls->enabled_ctrls & XkbIgnoreGroupLockMask) { + unsigned char grp = state->base_group+state->latched_group; + if (grp >= ctrls->num_groups) + grp = XkbAdjustGroup(XkbCharToInt(grp), ctrls); + grp_mask = map->groups[grp].mask; + } state->compat_grab_mods = state->grab_mods | grp_mask; return; } |