diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2009-05-20 11:47:37 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2009-05-21 15:51:08 +1000 |
| commit | 33cc112ca1af377a85cfeb05dfb72f07d3850a95 (patch) | |
| tree | 233caa9e07b59f34a53a3173a786981af28e6b87 | |
| parent | 3c43d880f13725a04fcd7c0c8d5978a36208e373 (diff) | |
Up the number of button labels atoms to EVDEV_MAXBUTTONS.
Button labels would smash memory if the device had less than 4 buttons and
did not advertise a wheel event. In this case the hard-coded wheel button
labels would write past the atoms[] boundary.
Potential memory smash if a device had a BTN_LEFT and BTN_0, since the
latter would map to 8, regardless of the the number of actual buttons
(same with BTN_MIDDLE and BTN_1 or BTN_RIGHT and BTN_2).
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
| -rw-r--r-- | src/evdev.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/evdev.c b/src/evdev.c index fca0b64..4a9a331 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -2066,12 +2066,12 @@ EvdevInitProperty(DeviceIntPtr dev) /* Button labelling */ if ((pEvdev->buttons > 0) && (prop_btn_label = XIGetKnownProperty(BTN_LABEL_PROP))) { - Atom atom, atoms[pEvdev->buttons]; + Atom atom, atoms[EVDEV_MAXBUTTONS]; int button, bmap; /* First, make sure all atoms are initialized */ atom = XIGetKnownProperty(BTN_LABEL_PROP_BTN_UNKNOWN); - for (button = 0; button < pEvdev->buttons; button++) + for (button = 0; button < ArrayLength(atoms); button++) atoms[button] = atom; for (button = BTN_MISC; button < BTN_JOYSTICK; button++) |