From abc4a8b60387c3c9ae8b0199bf61acede4f6dba2 Mon Sep 17 00:00:00 2001 From: Tobias Himmer Date: Fri, 23 Jan 2015 02:13:17 +0100 Subject: Check for incoming MT slot indices exceeding the allocated number of slots. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=88715 Signed-off-by: Tobias Himmer Signed-off-by: Peter Hutterer --- src/evdev.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src') diff --git a/src/evdev.c b/src/evdev.c index 2d99f07..5cbce35 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -733,6 +733,14 @@ EvdevProcessTouchEvent(InputInfoPtr pInfo, struct input_event *ev) if (ev->code == ABS_MT_SLOT) { EvdevProcessTouch(pInfo); + if (ev->value >= num_slots(pEvdev) ) { + LogMessageVerbSigSafe(X_WARNING, 0, + "%s: Slot index %d out of bounds (max %d), touch events may be incorrect.\n", + pInfo->name, + ev->value, + num_slots(pEvdev) - 1); + return; + } pEvdev->cur_slot = ev->value; } else { -- cgit v1.2.3