|
|
513f2c |
From 0909a1a76546284f27fb1b17a6f545a04537cc36 Mon Sep 17 00:00:00 2001
|
|
|
513f2c |
From: Peter Hutterer <peter.hutterer@who-t.net>
|
|
|
513f2c |
Date: Tue, 10 Jul 2018 11:17:50 +1000
|
|
|
513f2c |
Subject: [PATCH xf86-input-libinput] draglock: fix memory overwrite during
|
|
|
513f2c |
draglock parsing
|
|
|
513f2c |
|
|
|
513f2c |
Passing in the size of the array but using it as "number of elements" inside
|
|
|
513f2c |
the function. Rename a bunch of arguments to avoid this.
|
|
|
513f2c |
|
|
|
513f2c |
https://bugs.freedesktop.org/show_bug.cgi?id=107166
|
|
|
513f2c |
|
|
|
513f2c |
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
|
513f2c |
---
|
|
|
513f2c |
src/draglock.c | 14 +++++++-------
|
|
|
513f2c |
src/draglock.h | 6 +++---
|
|
|
513f2c |
src/xf86libinput.c | 2 +-
|
|
|
513f2c |
3 files changed, 11 insertions(+), 11 deletions(-)
|
|
|
513f2c |
|
|
|
513f2c |
diff --git a/src/draglock.c b/src/draglock.c
|
|
|
513f2c |
index b0bcac3..e0a91d0 100644
|
|
|
513f2c |
--- a/src/draglock.c
|
|
|
513f2c |
+++ b/src/draglock.c
|
|
|
513f2c |
@@ -116,7 +116,7 @@ draglock_get_meta(const struct draglock *dl)
|
|
|
513f2c |
}
|
|
|
513f2c |
|
|
|
513f2c |
size_t
|
|
|
513f2c |
-draglock_get_pairs(const struct draglock *dl, int *array, size_t sz)
|
|
|
513f2c |
+draglock_get_pairs(const struct draglock *dl, int *array, size_t nelem)
|
|
|
513f2c |
{
|
|
|
513f2c |
unsigned int i;
|
|
|
513f2c |
size_t last = 0;
|
|
|
513f2c |
@@ -131,8 +131,8 @@ draglock_get_pairs(const struct draglock *dl, int *array, size_t sz)
|
|
|
513f2c |
}
|
|
|
513f2c |
|
|
|
513f2c |
/* size N array with a[0] == 0, the rest ordered by button number */
|
|
|
513f2c |
- memset(array, 0, sz * sizeof(array[0]));
|
|
|
513f2c |
- for (i = 0; i < sz && i < ARRAY_SIZE(dl->lock_pair); i++) {
|
|
|
513f2c |
+ memset(array, 0, nelem * sizeof(array[0]));
|
|
|
513f2c |
+ for (i = 0; i < nelem && i < ARRAY_SIZE(dl->lock_pair); i++) {
|
|
|
513f2c |
array[i] = dl->lock_pair[i];
|
|
|
513f2c |
if (array[i] != 0 && i > last)
|
|
|
513f2c |
last = i;
|
|
|
513f2c |
@@ -153,20 +153,20 @@ draglock_set_meta(struct draglock *dl, int meta_button)
|
|
|
513f2c |
}
|
|
|
513f2c |
|
|
|
513f2c |
int
|
|
|
513f2c |
-draglock_set_pairs(struct draglock *dl, const int *array, size_t sz)
|
|
|
513f2c |
+draglock_set_pairs(struct draglock *dl, const int *array, size_t nelem)
|
|
|
513f2c |
{
|
|
|
513f2c |
unsigned int i;
|
|
|
513f2c |
|
|
|
513f2c |
- if (sz == 0 || array[0] != 0)
|
|
|
513f2c |
+ if (nelem == 0 || array[0] != 0)
|
|
|
513f2c |
return 1;
|
|
|
513f2c |
|
|
|
513f2c |
- for (i = 0; i < sz; i++) {
|
|
|
513f2c |
+ for (i = 0; i < nelem; i++) {
|
|
|
513f2c |
if (array[i] < 0 || array[i] >= DRAGLOCK_MAX_BUTTONS)
|
|
|
513f2c |
return 1;
|
|
|
513f2c |
}
|
|
|
513f2c |
|
|
|
513f2c |
dl->mode = DRAGLOCK_DISABLED;
|
|
|
513f2c |
- for (i = 0; i < sz; i++) {
|
|
|
513f2c |
+ for (i = 0; i < nelem; i++) {
|
|
|
513f2c |
dl->lock_pair[i] = array[i];
|
|
|
513f2c |
if (dl->lock_pair[i])
|
|
|
513f2c |
dl->mode = DRAGLOCK_PAIRS;
|
|
|
513f2c |
diff --git a/src/draglock.h b/src/draglock.h
|
|
|
513f2c |
index acc1314..900d538 100644
|
|
|
513f2c |
--- a/src/draglock.h
|
|
|
513f2c |
+++ b/src/draglock.h
|
|
|
513f2c |
@@ -107,13 +107,13 @@ draglock_get_meta(const struct draglock *dl);
|
|
|
513f2c |
* @note Button numbers start at 1, array[0] is always 0.
|
|
|
513f2c |
*
|
|
|
513f2c |
* @param[in|out] array Caller-allocated array to hold the button mappings.
|
|
|
513f2c |
- * @param[in] sz Maximum number of elements in array
|
|
|
513f2c |
+ * @param[in] nelem Maximum number of elements in array
|
|
|
513f2c |
*
|
|
|
513f2c |
* @return The number of valid elements in array or 0 if the current mode is
|
|
|
513f2c |
* not DRAGLOCK_PAIRS
|
|
|
513f2c |
*/
|
|
|
513f2c |
size_t
|
|
|
513f2c |
-draglock_get_pairs(const struct draglock *dl, int *array, size_t sz);
|
|
|
513f2c |
+draglock_get_pairs(const struct draglock *dl, int *array, size_t nelem);
|
|
|
513f2c |
|
|
|
513f2c |
/**
|
|
|
513f2c |
* Set the drag lock config to the DRAGLOCK_META mode, with the given
|
|
|
513f2c |
@@ -140,7 +140,7 @@ draglock_set_meta(struct draglock *dl, int meta_button);
|
|
|
513f2c |
* @return 0 on successor nonzero otherwise
|
|
|
513f2c |
*/
|
|
|
513f2c |
int
|
|
|
513f2c |
-draglock_set_pairs(struct draglock *dl, const int *array, size_t sz);
|
|
|
513f2c |
+draglock_set_pairs(struct draglock *dl, const int *array, size_t nelem);
|
|
|
513f2c |
|
|
|
513f2c |
/**
|
|
|
513f2c |
* Process the given button event through the drag lock state machine.
|
|
|
513f2c |
diff --git a/src/xf86libinput.c b/src/xf86libinput.c
|
|
|
513f2c |
index 2e950cd..34f1102 100644
|
|
|
513f2c |
--- a/src/xf86libinput.c
|
|
|
513f2c |
+++ b/src/xf86libinput.c
|
|
|
513f2c |
@@ -5326,7 +5326,7 @@ LibinputInitDragLockProperty(DeviceIntPtr dev,
|
|
|
513f2c |
break;
|
|
|
513f2c |
case DRAGLOCK_PAIRS:
|
|
|
513f2c |
sz = draglock_get_pairs(&driver_data->draglock,
|
|
|
513f2c |
- dl_values, sizeof(dl_values));
|
|
|
513f2c |
+ dl_values, ARRAY_SIZE(dl_values));
|
|
|
513f2c |
break;
|
|
|
513f2c |
default:
|
|
|
513f2c |
xf86IDrvMsg(dev->public.devicePrivate,
|
|
|
513f2c |
--
|
|
|
513f2c |
2.17.1
|
|
|
513f2c |
|