diff options
| author | Dave Airlie <airlied@gmail.com> | 2013-04-10 16:09:01 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2013-04-17 14:56:00 +1000 |
| commit | 6ca03b9161d33b1d2b55a3a1a913cf88deb2343f (patch) | |
| tree | b207d9983728ac12b30ce4ca7950962c6671382d | |
| parent | ecf62755086fd65898998d5a509aee5f29a9583d (diff) | |
xf86: fix flush input to work with Linux evdev devices.
So when we VT switch back and attempt to flush the input devices,
we don't succeed because evdev won't return part of an event,
since we were only asking for 4 bytes, we'd only get -EINVAL back.
This could later cause events to be flushed that we shouldn't have
gotten.
This is a fix for CVE-2013-1940.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
| -rw-r--r-- | hw/xfree86/os-support/shared/posix_tty.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/xfree86/os-support/shared/posix_tty.c b/hw/xfree86/os-support/shared/posix_tty.c index ab3757a2a..4d08c1e85 100644 --- a/hw/xfree86/os-support/shared/posix_tty.c +++ b/hw/xfree86/os-support/shared/posix_tty.c @@ -421,7 +421,8 @@ xf86FlushInput(int fd) { fd_set fds; struct timeval timeout; - char c[4]; + /* this needs to be big enough to flush an evdev event. */ + char c[256]; DebugF("FlushingSerial\n"); if (tcflush(fd, TCIFLUSH) == 0) |