diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2012-04-27 16:31:17 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2012-05-03 11:23:56 +1000 |
| commit | b53cdf4c53f0787ed41281278877e0405fcb2674 (patch) | |
| tree | 7997938e719381e5550af24e678e9d26adba2776 | |
| parent | 9ddf9e2388f9ac5f4c325304ab0c59c1fd5e2024 (diff) | |
dix: don't emulate scroll events for non-existing axes (#47281)
Test case:
- create a device with REL_HWHEEL and ABS_X and ABS_Y. evdev 2.7.0 will set
that up as device with 1 relative axis
- move pointer to VGA1
- xrandr --output VGA1 --off
Warps the pointer to the new spot and calls GPE with the x/y mask bits set.
When running through the loop to check for scroll event, this overruns the
axes and may try to emulate scroll events based on random garbage in the
memory. If that memory contained non-zero for the scroll type but near-zero
for the increment field, the server would hang in an infinite loop.
This was the trigger for this suggested, never-merged, patch here:
http://patchwork.freedesktop.org/patch/9543/
X.Org Bug 47281 <http://bugs.freedesktop.org/show_bug.cgi?id=47281>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
(cherry picked from commit af88b43f9e604157b74270d609c08bdfa256a792)
| -rw-r--r-- | dix/getevents.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/dix/getevents.c b/dix/getevents.c index fa85fe7cf..4e0af452a 100644 --- a/dix/getevents.c +++ b/dix/getevents.c @@ -1574,6 +1574,9 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type, /* Now turn the smooth-scrolling axes back into emulated button presses * for legacy clients, based on the integer delta between before and now */ for (i = 0; i < valuator_mask_size(&mask); i++) { + if (i >= pDev->valuator->numAxes) + break; + if (!valuator_mask_isset(&mask, i)) continue; |