From 6d43a45b99e07325c74cbe1d20b04094ba99950d Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Wed, 20 May 2009 11:47:37 +1000 Subject: Up the number of button labels atoms to EVDEV_MAXBUTTONS. Button labels would smash memory if the device had less than 4 buttons and did not advertise a wheel event. In this case the hard-coded wheel button labels would write past the atoms[] boundary. Potential memory smash if a device had a BTN_LEFT and BTN_0, since the latter would map to 8, regardless of the the number of actual buttons (same with BTN_MIDDLE and BTN_1 or BTN_RIGHT and BTN_2). Signed-off-by: Peter Hutterer (cherry picked from commit 33cc112ca1af377a85cfeb05dfb72f07d3850a95) --- src/evdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/evdev.c b/src/evdev.c index fc4832b..80ba276 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -2028,12 +2028,12 @@ EvdevInitProperty(DeviceIntPtr dev) /* Button labelling */ if ((pEvdev->buttons > 0) && (prop_btn_label = XIGetKnownProperty(BTN_LABEL_PROP))) { - Atom atom, atoms[pEvdev->buttons]; + Atom atom, atoms[EVDEV_MAXBUTTONS]; int button, bmap; /* First, make sure all atoms are initialized */ atom = XIGetKnownProperty(BTN_LABEL_PROP_BTN_UNKNOWN); - for (button = 0; button < pEvdev->buttons; button++) + for (button = 0; button < ArrayLength(atoms); button++) atoms[button] = atom; for (button = BTN_MISC; button < BTN_JOYSTICK; button++) -- cgit v1.2.3