From abc4a8b60387c3c9ae8b0199bf61acede4f6dba2 Mon Sep 17 00:00:00 2001
From: Tobias Himmer <provisorisch@online.de>
Date: Fri, 23 Jan 2015 02:13:17 +0100
Subject: Check for incoming MT slot indices exceeding the allocated number of
 slots.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=88715

Signed-off-by: Tobias Himmer <provisorisch@online.de>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 src/evdev.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/evdev.c b/src/evdev.c
index 2d99f07..5cbce35 100644
--- a/src/evdev.c
+++ b/src/evdev.c
@@ -733,6 +733,14 @@ EvdevProcessTouchEvent(InputInfoPtr pInfo, struct input_event *ev)
 
     if (ev->code == ABS_MT_SLOT) {
         EvdevProcessTouch(pInfo);
+        if (ev->value >= num_slots(pEvdev) ) {
+            LogMessageVerbSigSafe(X_WARNING, 0,
+                                  "%s: Slot index %d out of bounds (max %d), touch events may be incorrect.\n",
+                                  pInfo->name,
+                                  ev->value,
+                                  num_slots(pEvdev) - 1);
+            return;
+        }
         pEvdev->cur_slot = ev->value;
     } else
     {
-- 
cgit v1.2.3