dix: don't emulate scroll events for non-existing axes (#47281)

Test case:
- create a device with REL_HWHEEL and ABS_X and ABS_Y. evdev 2.7.0 will set
  that up as device with 1 relative axis
- move pointer to VGA1
- xrandr --output VGA1 --off

Warps the pointer to the new spot and calls GPE with the x/y mask bits set.
When running through the loop to check for scroll event, this overruns the
axes and may try to emulate scroll events based on random garbage in the
memory. If that memory contained non-zero for the scroll type but near-zero
for the increment field, the server would hang in an infinite loop.

This was the trigger for this suggested, never-merged, patch here:
http://patchwork.freedesktop.org/patch/9543/

X.Org Bug 47281 <http://bugs.freedesktop.org/show_bug.cgi?id=47281>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/dix/getevents.c b/dix/getevents.c
index 23bbe065c..c960d4467 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -1598,6 +1598,9 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
     /* Now turn the smooth-scrolling axes back into emulated button presses
      * for legacy clients, based on the integer delta between before and now */
     for (i = 0; i < valuator_mask_size(&mask); i++) {
+        if (i >= pDev->valuator->numAxes)
+            break;
+
         if (!valuator_mask_isset(&mask, i))
             continue;