diff options
| -rw-r--r-- | dix/events.c | 6 | ||||
| -rw-r--r-- | dix/swapreq.c | 7 |
2 files changed, 13 insertions, 0 deletions
diff --git a/dix/events.c b/dix/events.c index 3e3a01ef9..d3a33ea3f 100644 --- a/dix/events.c +++ b/dix/events.c @@ -5366,6 +5366,12 @@ ProcSendEvent(ClientPtr client) client->errorValue = stuff->event.u.u.type; return BadValue; } + /* Generic events can have variable size, but SendEvent request holds + exactly 32B of event data. */ + if (stuff->event.u.u.type == GenericEvent) { + client->errorValue = stuff->event.u.u.type; + return BadValue; + } if (stuff->event.u.u.type == ClientMessage && stuff->event.u.u.detail != 8 && stuff->event.u.u.detail != 16 && stuff->event.u.u.detail != 32) { diff --git a/dix/swapreq.c b/dix/swapreq.c index 719e9b81c..67850593b 100644 --- a/dix/swapreq.c +++ b/dix/swapreq.c @@ -292,6 +292,13 @@ SProcSendEvent(ClientPtr client) swapl(&stuff->destination); swapl(&stuff->eventMask); + /* Generic events can have variable size, but SendEvent request holds + exactly 32B of event data. */ + if (stuff->event.u.u.type == GenericEvent) { + client->errorValue = stuff->event.u.u.type; + return BadValue; + } + /* Swap event */ proc = EventSwapVector[stuff->event.u.u.type & 0177]; if (!proc || proc == NotImplemented) /* no swapping proc; invalid event type? */ |