Age | Commit message (Collapse) | Author |
|
Signed-off-by: Michal Srb <msrb@suse.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Introduced in 4c8e9bcab459ea5f870d3e56eff15f931807f9b7.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
First: check for allocation failure on the mask.
XI2 requires that the mask is zeroed, so we can't just Data() the mask
provided by the client (it will pad) - we need a tmp buffer. Make sure that
doesn't fail.
Second:
req->mask_len is a uint16_t, so check against malicious mask_lens that would
cause us to corrupt memory on copy, as the code always allocates
req->mask_len * 4, but copies mask->mask_len bytes.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
|
|
Each XI2 call should check _XiCheckExtInit for XI version 2.0 or higher.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
|
|
Reported-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Miscalculation of length caused Data() to memcpy too many bytes.
==2865== Invalid read of size 1
==2865== at 0x4A07480: memcpy (mc_replace_strmem.c:602)
==2865== by 0x544271E: XIGrabDevice (XIGrabDevice.c:69)
==2865== by 0x400B0A: main (gnome642481.c:56)
==2865== Address 0x642f614 is 0 bytes after a block of size 20 alloc'd
==2865== at 0x4A04896: calloc (vg_replace_malloc.c:418)
==2865== by 0x54425D3: XIGrabDevice (XIGrabDevice.c:65)
==2865== by 0x400B0A: main (gnome642481.c:56)
SetReqLen() expects 4-byte units.
Data() expects bytes.
Gnome Bug 642481 <https://bugzilla.gnome.org/show_bug.cgi?id=642481>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
X.Org Bug 23708 <http://bugs.freedesktop.org/show_bug.cgi?id=23708>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
If a client issues an XI2 request against a non-XI2 server it should
generate a BadRequest error from the server.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
|
|
Reported-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
|
|
|