diff options
Diffstat (limited to 'src/emuWheel.c')
| -rw-r--r-- | src/emuWheel.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/src/emuWheel.c b/src/emuWheel.c index b007de0..488a6a2 100644 --- a/src/emuWheel.c +++ b/src/emuWheel.c @@ -350,11 +350,13 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val, } else if (atom == prop_wheel_button) { - int bt = *((CARD8*)val->data); + int bt; if (val->format != 8 || val->size != 1 || val->type != XA_INTEGER) return BadMatch; + bt = *((CARD8*)val->data); + if (bt < 0 || bt >= EVDEV_MAXBUTTONS) return BadValue; @@ -374,11 +376,13 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val, } } else if (atom == prop_wheel_inertia) { - int inertia = *((CARD16*)val->data); + int inertia; if (val->format != 16 || val->size != 1 || val->type != XA_INTEGER) return BadMatch; + inertia = *((CARD16*)val->data); + if (inertia < 0) return BadValue; @@ -386,11 +390,13 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val, pEvdev->emulateWheel.inertia = inertia; } else if (atom == prop_wheel_timeout) { - int timeout = *((CARD16*)val->data); + int timeout; if (val->format != 16 || val->size != 1 || val->type != XA_INTEGER) return BadMatch; + timeout = *((CARD16*)val->data); + if (timeout < 0) return BadValue; |