diff options
| author | Chase Douglas <chase.douglas@canonical.com> | 2012-04-09 11:38:16 -0700 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2012-04-10 11:16:07 +1000 |
| commit | 3f9794a8a0f019a4b153941c9ec1927c7797ce6f (patch) | |
| tree | 786cb9839e5130453a90b57ebd4d2f9d78bdf6a8 /src | |
| parent | 4c87455f3ecd1b82a3612a3050e463a0efb90f0c (diff) | |
Check touch record bounds before access
We guess ten simultaneous touches if the device does not tell us. The
Linux drivers for the Apple multitouch trackpads do not tell the number
of simultaneous touches, but they can do more than ten. When this
occurs, the array index into the touch records will be invalid. We must
not process the touch or else we will segfault.
Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'src')
| -rw-r--r-- | src/eventcomm.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/eventcomm.c b/src/eventcomm.c index 28d034f..361f878 100644 --- a/src/eventcomm.c +++ b/src/eventcomm.c @@ -564,6 +564,9 @@ EventProcessTouchEvent(InputInfoPtr pInfo, struct SynapticsHwState *hw, { int slot_index = last_mt_vals_slot(priv); + if (slot_index < 0) + return; + if (hw->slot_state[slot_index] == SLOTSTATE_EMPTY || hw->slot_state[slot_index] == SLOTSTATE_OPEN_EMPTY) hw->slot_state[slot_index] = SLOTSTATE_UPDATE; |