aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChase Douglas <chase.douglas@canonical.com>2012-06-06 12:07:12 -0700
committerPeter Hutterer <peter.hutterer@who-t.net>2012-06-07 11:31:57 +1000
commit4145fe1c087708bf5d6608e328342282ecb93ab0 (patch)
treead3b6f9233cee9f7c876a65c5567745155794252
parentReport the correct number of touches for MT protocol B devices (diff)
downloadxf86-input-evdev-4145fe1c087708bf5d6608e328342282ecb93ab0.tar.gz
xf86-input-evdev-4145fe1c087708bf5d6608e328342282ecb93ab0.tar.bz2
xf86-input-evdev-4145fe1c087708bf5d6608e328342282ecb93ab0.zip
Fix buffer overrun when populating axis label property array
The axis label property array currently only has enough elements for the non-multitouch axes. This change allocates enough space for all axes, which prevents an array overrun write. This may manifest as stack corruption on some platforms. Signed-off-by: Chase Douglas <chase.douglas@canonical.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-rw-r--r--src/evdev.c8
-rw-r--r--src/evdev.h1
2 files changed, 6 insertions, 3 deletions
diff --git a/src/evdev.c b/src/evdev.c
index 4b86f66..a628273 100644
--- a/src/evdev.c
+++ b/src/evdev.c
@@ -1304,6 +1304,7 @@ EvdevAddAbsValuatorClass(DeviceIntPtr device)
}
#ifdef MULTITOUCH
if (num_mt_axes_total > 0) {
+ pEvdev->num_mt_vals = num_mt_axes_total;
pEvdev->mt_mask = valuator_mask_new(num_mt_axes_total);
if (!pEvdev->mt_mask) {
xf86Msg(X_ERROR, "%s: failed to allocate MT valuator mask.\n",
@@ -2879,7 +2880,8 @@ EvdevInitProperty(DeviceIntPtr dev)
if ((pEvdev->num_vals > 0) && (prop_axis_label = XIGetKnownProperty(AXIS_LABEL_PROP)))
{
int mode;
- Atom atoms[pEvdev->num_vals];
+ int num_axes = pEvdev->num_vals + pEvdev->num_mt_vals;
+ Atom atoms[num_axes];
if (pEvdev->flags & EVDEV_ABSOLUTE_EVENTS)
mode = Absolute;
@@ -2890,9 +2892,9 @@ EvdevInitProperty(DeviceIntPtr dev)
mode = Absolute;
}
- EvdevInitAxesLabels(pEvdev, mode, pEvdev->num_vals, atoms);
+ EvdevInitAxesLabels(pEvdev, mode, num_axes, atoms);
XIChangeDeviceProperty(dev, prop_axis_label, XA_ATOM, 32,
- PropModeReplace, pEvdev->num_vals, atoms, FALSE);
+ PropModeReplace, num_axes, atoms, FALSE);
XISetDevicePropertyDeletable(dev, prop_axis_label, FALSE);
}
/* Button labelling */
diff --git a/src/evdev.h b/src/evdev.h
index 309b215..c2f9246 100644
--- a/src/evdev.h
+++ b/src/evdev.h
@@ -153,6 +153,7 @@ typedef struct {
int grabDevice; /* grab the event device? */
int num_vals; /* number of valuators */
+ int num_mt_vals; /* number of multitouch valuators */
int axis_map[max(ABS_CNT, REL_CNT)]; /* Map evdev <axis> to index */
ValuatorMask *vals; /* new values coming in */
ValuatorMask *old_vals; /* old values for calculating relative motion */