From 8e396f2b806496cdcac233cc731b0322735020c3 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Fri, 21 Aug 2009 12:11:19 +1000 Subject: Xi: fix swapping for XIQueryPointer request/reply handling. buttons_size is necessary as WriteToClient swaps the buttons_len field, resulting in the wrong number of bytes being written later. Signed-off-by: Peter Hutterer --- Xi/xiquerypointer.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'Xi') diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c index d51d383fe..80e953dd8 100644 --- a/Xi/xiquerypointer.c +++ b/Xi/xiquerypointer.c @@ -64,6 +64,8 @@ SProcXIQueryPointer(ClientPtr client) REQUEST(xXIQueryPointerReq); swaps(&stuff->length, n); + swaps(&stuff->deviceid, n); + swapl(&stuff->win, n); return (ProcXIQueryPointer(client)); } @@ -77,6 +79,7 @@ ProcXIQueryPointer(ClientPtr client) SpritePtr pSprite; XkbStatePtr state; char *buttons = NULL; + int buttons_size = 0; /* size of buttons array */ REQUEST(xXIQueryPointerReq); REQUEST_SIZE_MATCH(xXIQueryPointerReq); @@ -131,7 +134,8 @@ ProcXIQueryPointer(ClientPtr client) int i, down; rep.buttons_len = bytes_to_int32(bits_to_bytes(pDev->button->numButtons)); rep.length += rep.buttons_len; - buttons = xcalloc(rep.buttons_len, 4); + buttons_size = rep.buttons_len * 4; + buttons = xcalloc(1, buttons_size); if (!buttons) return BadAlloc; @@ -180,7 +184,7 @@ ProcXIQueryPointer(ClientPtr client) WriteReplyToClient(client, sizeof(xXIQueryPointerReply), &rep); if (buttons) - WriteToClient(client, rep.buttons_len * 4, buttons); + WriteToClient(client, buttons_size, buttons); xfree(buttons); @@ -202,6 +206,14 @@ SRepXIQueryPointer(ClientPtr client, int size, swaps(&rep->sequenceNumber, n); swapl(&rep->length, n); + swapl(&rep->root, n); + swapl(&rep->child, n); + swapl(&rep->root_x, n); + swapl(&rep->root_y, n); + swapl(&rep->win_x, n); + swapl(&rep->win_y, n); + swaps(&rep->buttons_len, n); + WriteToClient(client, size, (char *)rep); } -- cgit v1.2.3