diff options
| -rw-r--r-- | xserver/Xi/sendexev.c | 24 | ||||
| -rw-r--r-- | xserver/dix/events.c | 6 | ||||
| -rw-r--r-- | xserver/dix/swapreq.c | 7 |
3 files changed, 30 insertions, 7 deletions
diff --git a/xserver/Xi/sendexev.c b/xserver/Xi/sendexev.c index 183f88dae..5ecc228ee 100644 --- a/xserver/Xi/sendexev.c +++ b/xserver/Xi/sendexev.c @@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client) { CARD32 *p; int i; - xEvent eventT; + xEvent eventT = { .u.u.type = 0 }; xEvent *eventP; EventSwapPtr proc; @@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client) eventP = (xEvent *) &stuff[1]; for (i = 0; i < stuff->num_events; i++, eventP++) { + if (eventP->u.u.type == GenericEvent) { + client->errorValue = eventP->u.u.type; + return BadValue; + } + proc = EventSwapVector[eventP->u.u.type & 0177]; - if (proc == NotImplemented) /* no swapping proc; invalid event type? */ + /* no swapping proc; invalid event type? */ + if (proc == NotImplemented) { + client->errorValue = eventP->u.u.type; return BadValue; + } (*proc) (eventP, &eventT); *eventP = eventT; } @@ -117,7 +125,7 @@ SProcXSendExtensionEvent(ClientPtr client) int ProcXSendExtensionEvent(ClientPtr client) { - int ret; + int ret, i; DeviceIntPtr dev; xEvent *first; XEventClass *list; @@ -141,10 +149,12 @@ ProcXSendExtensionEvent(ClientPtr client) /* The client's event type must be one defined by an extension. */ first = ((xEvent *) &stuff[1]); - if (!((EXTENSION_EVENT_BASE <= first->u.u.type) && - (first->u.u.type < lastEvent))) { - client->errorValue = first->u.u.type; - return BadValue; + for (i = 0; i < stuff->num_events; i++) { + if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) && + (first[i].u.u.type < lastEvent))) { + client->errorValue = first[i].u.u.type; + return BadValue; + } } list = (XEventClass *) (first + stuff->num_events); diff --git a/xserver/dix/events.c b/xserver/dix/events.c index efaf91d2b..0591f8fcb 100644 --- a/xserver/dix/events.c +++ b/xserver/dix/events.c @@ -5355,6 +5355,12 @@ ProcSendEvent(ClientPtr client) client->errorValue = stuff->event.u.u.type; return BadValue; } + /* Generic events can have variable size, but SendEvent request holds + exactly 32B of event data. */ + if (stuff->event.u.u.type == GenericEvent) { + client->errorValue = stuff->event.u.u.type; + return BadValue; + } if (stuff->event.u.u.type == ClientMessage && stuff->event.u.u.detail != 8 && stuff->event.u.u.detail != 16 && stuff->event.u.u.detail != 32) { diff --git a/xserver/dix/swapreq.c b/xserver/dix/swapreq.c index 61d3ce0f4..8cc64b6ed 100644 --- a/xserver/dix/swapreq.c +++ b/xserver/dix/swapreq.c @@ -292,6 +292,13 @@ SProcSendEvent(ClientPtr client) swapl(&stuff->destination); swapl(&stuff->eventMask); + /* Generic events can have variable size, but SendEvent request holds + exactly 32B of event data. */ + if (stuff->event.u.u.type == GenericEvent) { + client->errorValue = stuff->event.u.u.type; + return BadValue; + } + /* Swap event */ proc = EventSwapVector[stuff->event.u.u.type & 0177]; if (!proc || proc == NotImplemented) /* no swapping proc; invalid event type? */ |