From e6c699dedcd6f3b5db497fe2d226806ca4bbe683 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Wed, 8 Oct 2008 14:35:12 +1030 Subject: Stricter value checking for property changes. --- src/emuWheel.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'src/emuWheel.c') diff --git a/src/emuWheel.c b/src/emuWheel.c index b0e244f..27dec7c 100644 --- a/src/emuWheel.c +++ b/src/emuWheel.c @@ -401,6 +401,9 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val) if (atom == prop_wheel_emu) { + if (val->format != 8 || val->size != 1 || val->type != XA_INTEGER) + return BadMatch; + pEvdev->emulateWheel.enabled = *((BOOL*)val->data); /* Don't enable with zero inertia, otherwise we may get stuck in an * infinite loop */ @@ -427,13 +430,16 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val) { int bt = *((CARD8*)val->data); + if (val->format != 8 || val->size != 1 || val->type != XA_INTEGER) + return BadMatch; + if (bt < 0 || bt >= EVDEV_MAXBUTTONS) return BadValue; pEvdev->emulateWheel.button = bt; } else if (atom == prop_wheel_axismap) { - if (val->size != 4) - return BadValue; + if (val->format != 8 || val->size != 4 || val->type != XA_INTEGER) + return BadMatch; pEvdev->emulateWheel.X.up_button = *((CARD8*)val->data); pEvdev->emulateWheel.X.down_button = *(((CARD8*)val->data) + 1); @@ -443,6 +449,9 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val) { int inertia = *((CARD16*)val->data); + if (val->format != 16 || val->size != 1 || val->type != XA_INTEGER) + return BadMatch; + if (inertia < 0) return BadValue; @@ -451,6 +460,9 @@ EvdevWheelEmuSetProperty(DeviceIntPtr dev, Atom atom, XIPropertyValuePtr val) { int timeout = *((CARD16*)val->data); + if (val->format != 16 || val->size != 1 || val->type != XA_INTEGER) + return BadMatch; + if (timeout < 0) return BadValue; -- cgit v1.2.3