diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2014-02-20 13:18:05 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2014-02-21 10:01:13 +1000 |
| commit | 0f10cfd4b903d4db293ec47c8a9a0d8b33965803 (patch) | |
| tree | 13a3ae6e664698ea016de7106fef92618137aff8 /Xi | |
| parent | ec6a44612565e0716bd5b2e2b80a8d381691feb6 (diff) | |
Xi: check for invalid modifiers for XI2 passive grabs
The other values are checked correctly, but if a modifier was outside the
allowed range, it would go unnoticed and cause a out-of-bounds read error for
any mask equal or larger than 256. The DetailRec where we store the grab masks
is only sized to 8 * sizeof(Mask).
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'Xi')
| -rw-r--r-- | Xi/exevents.c | 3 | ||||
| -rw-r--r-- | Xi/xipassivegrab.c | 4 |
2 files changed, 6 insertions, 1 deletions
diff --git a/Xi/exevents.c b/Xi/exevents.c index 4ed58eec4..e9f670ec5 100644 --- a/Xi/exevents.c +++ b/Xi/exevents.c @@ -2183,7 +2183,8 @@ CheckGrabValues(ClientPtr client, GrabParameters *param) return BadValue; } - if (param->grabtype != XI2 && (param->modifiers != AnyModifier) && + if (param->modifiers != AnyModifier && + param->modifiers != XIAnyModifier && (param->modifiers & ~AllModifiersMask)) { client->errorValue = param->modifiers; return BadValue; diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c index 8aba97781..700622d38 100644 --- a/Xi/xipassivegrab.c +++ b/Xi/xipassivegrab.c @@ -189,6 +189,10 @@ ProcXIPassiveGrabDevice(ClientPtr client) uint8_t status = Success; param.modifiers = *modifiers; + ret = CheckGrabValues(client, ¶m); + if (ret != Success) + goto out; + switch (stuff->grab_type) { case XIGrabtypeButton: status = GrabButton(client, dev, mod_dev, stuff->detail, |