Fix drag-lock property handler for multiple draglock buttons.

Parsing of the values was wrong. Given an input of 1 2 3 4, button 1 sets
the lock for button 2 and button 3 sets the lock for button 4.

This also means we need to return BadMatch if the property isn't a multiple
of 2.

Red Hat Bug 524428 <https://bugzilla.redhat.com/show_bug.cgi?id=524428>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 11669d82790fd7c94c44c0d487d3fa5e203528e9)

1 files changed, 5 insertions, 4 deletions

diff --git a/src/draglock.c b/src/draglock.c
index a8bf079..6157cae 100644
--- a/src/draglock.c
+++ b/src/draglock.c
@@ -256,7 +256,7 @@ EvdevDragLockSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val,
                 pEvdev->dragLock.meta = meta;
                 memset(pEvdev->dragLock.lock_pair, 0, sizeof(pEvdev->dragLock.lock_pair));
             }
-        } else
+        } else if ((val->size % 2) == 0)
         {
             CARD8* vals = (CARD8*)val->data;
 
@@ -269,10 +269,11 @@ EvdevDragLockSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val,
                 pEvdev->dragLock.meta = 0;
                 memset(pEvdev->dragLock.lock_pair, 0, sizeof(pEvdev->dragLock.lock_pair));
 
-                for (i = 0; i < val->size && i < EVDEV_MAXBUTTONS; i++)
-                    pEvdev->dragLock.lock_pair[i] = vals[i];
+                for (i = 0; i < val->size && i < EVDEV_MAXBUTTONS; i += 2)
+                    pEvdev->dragLock.lock_pair[vals[i] - 1] = vals[i + 1];
             }
-        }
+        } else
+            return BadMatch;
     }
 
     return Success;