diff options
| author | Tobias Himmer <provisorisch@online.de> | 2015-01-23 02:13:17 +0100 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2015-03-24 14:59:43 +1000 |
| commit | 4996694cc9b80ffef28289ea491965b16615f2d1 (patch) | |
| tree | cf44702148d560dc1c3727e1180ecfc3b751ea0e | |
| parent | 05f7057ad5716ccf643b80f2f5fbfff34783a950 (diff) | |
Check for incoming MT slot indices exceeding the allocated number of slots.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=88715
Signed-off-by: Tobias Himmer <provisorisch@online.de>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit abc4a8b60387c3c9ae8b0199bf61acede4f6dba2)
| -rw-r--r-- | src/evdev.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/evdev.c b/src/evdev.c index 1a385c9..651b895 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -751,6 +751,14 @@ EvdevProcessTouchEvent(InputInfoPtr pInfo, struct input_event *ev) if (ev->code == ABS_MT_SLOT) { EvdevProcessTouch(pInfo); + if (ev->value >= num_slots(pEvdev) ) { + LogMessageVerbSigSafe(X_WARNING, 0, + "%s: Slot index %d out of bounds (max %d), touch events may be incorrect.\n", + pInfo->name, + ev->value, + num_slots(pEvdev) - 1); + return; + } pEvdev->cur_slot = ev->value; } else { |