Xi: check cursor and grab_window before attempting the passive grab.

Both values need to fail the request, so we need to check them before
looping through the modifier masks. Otherwise, a wrong grab_window will
show up in each failed modifier return but not actually cause an error.

1 files changed, 18 insertions, 0 deletions

diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index 1ba534a77..2b77d18b6 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -85,6 +85,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     xXIGrabModifierInfo *modifiers_failed;
     GrabMask mask;
     GrabParameters param;
+    void *tmp;
 
     REQUEST(xXIPassiveGrabDeviceReq);
     REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
@@ -134,6 +135,23 @@ ProcXIPassiveGrabDevice(ClientPtr client)
     param.grabWindow = stuff->grab_window;
     param.cursor = stuff->cursor;
 
+    if (stuff->cursor != None)
+    {
+        status = dixLookupResourceByType(&tmp, stuff->cursor,
+                                         RT_CURSOR, client, DixUseAccess);
+	if (status != Success)
+	{
+	    client->errorValue = stuff->cursor;
+	    return (status == BadValue) ? BadCursor : status;
+	}
+    }
+
+    status = dixLookupWindow((WindowPtr*)&tmp, stuff->grab_window, client, DixSetAttrAccess);
+    if (status != Success)
+	return status;
+
+    status = CheckGrabValues(client, &param);
+
     modifiers = (uint32_t*)&stuff[1] + stuff->mask_len;
     modifiers_failed = xcalloc(stuff->num_modifiers, sizeof(xXIGrabModifierInfo));
     if (!modifiers_failed)