From 87ca80a7196949597113225405f3e4ee03bbee13 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Fri, 24 Jan 2014 18:32:54 +1000 Subject: dix: prevent a driver from initializing or submitting buttons > MAX_BUTTONS The server internally relies on arrays with a MAX_BUTTONS maximum size (which is the max the core protocol can transport). Make sure a driver adheres to that. Signed-off-by: Peter Hutterer Reviewed-by: Daniel Stone --- dix/devices.c | 1 + 1 file changed, 1 insertion(+) (limited to 'dix/devices.c') diff --git a/dix/devices.c b/dix/devices.c index a875f03cc..1c86d5242 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -1279,6 +1279,7 @@ InitButtonClassDeviceStruct(DeviceIntPtr dev, int numButtons, Atom *labels, BUG_RETURN_VAL(dev == NULL, FALSE); BUG_RETURN_VAL(dev->button != NULL, FALSE); + BUG_RETURN_VAL(numButtons >= MAX_BUTTONS, FALSE); butc = calloc(1, sizeof(ButtonClassRec)); if (!butc) -- cgit v1.2.3