diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2014-01-24 18:32:54 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2014-02-04 11:38:00 +1000 |
| commit | 87ca80a7196949597113225405f3e4ee03bbee13 (patch) | |
| tree | 7209392628dd597c4004c1b4cd3159ae67adb912 /dix | |
| parent | 14fb6cf92c009d726f0a6b6e8b89cc48f2dd50eb (diff) | |
dix: prevent a driver from initializing or submitting buttons > MAX_BUTTONS
The server internally relies on arrays with a MAX_BUTTONS maximum size (which
is the max the core protocol can transport). Make sure a driver adheres to
that.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Diffstat (limited to 'dix')
| -rw-r--r-- | dix/devices.c | 1 | ||||
| -rw-r--r-- | dix/getevents.c | 2 |
2 files changed, 3 insertions, 0 deletions
diff --git a/dix/devices.c b/dix/devices.c index a875f03cc..1c86d5242 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -1279,6 +1279,7 @@ InitButtonClassDeviceStruct(DeviceIntPtr dev, int numButtons, Atom *labels, BUG_RETURN_VAL(dev == NULL, FALSE); BUG_RETURN_VAL(dev->button != NULL, FALSE); + BUG_RETURN_VAL(numButtons >= MAX_BUTTONS, FALSE); butc = calloc(1, sizeof(ButtonClassRec)); if (!butc) diff --git a/dix/getevents.c b/dix/getevents.c index 646c723ea..ffa89fad2 100644 --- a/dix/getevents.c +++ b/dix/getevents.c @@ -1655,6 +1655,8 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type, } #endif + BUG_RETURN_VAL(buttons >= MAX_BUTTONS, 0); + /* refuse events from disabled devices */ if (!pDev->enabled) return 0; |