filter: validate custom acceleration function's points size

Adds min and max size limit for custom acceleration function's points.
Adds tests to make sure validation works properly.

Signed-off-by: Yinon Burgansky <51504-Yinon@users.noreply.gitlab.freedesktop.org>

4 files changed, 47 insertions, 13 deletions

diff --git a/src/filter-custom.c b/src/filter-custom.c
index 57cdea0e..0172f7c0 100644
--- a/src/filter-custom.c
+++ b/src/filter-custom.c
@@ -49,6 +49,12 @@ create_custom_accel_function(double step, const double *points, size_t npoints)
 	if (step <= 0 || step > LIBINPUT_ACCEL_STEP_MAX)
 		return NULL;
 
+	for (size_t idx = 0; idx < npoints; idx++) {
+		if (points[idx] < LIBINPUT_ACCEL_POINT_MIN_VALUE ||
+		    points[idx] > LIBINPUT_ACCEL_POINT_MAX_VALUE)
+			return NULL;
+	}
+
 	struct custom_accel_function *cf = zalloc(sizeof(*cf) + npoints * sizeof(*points));
 	cf->last_time = 0;
 	cf->step = step;
diff --git a/src/libinput-private.h b/src/libinput-private.h
index 042ef07f..298d5422 100644
--- a/src/libinput-private.h
+++ b/src/libinput-private.h
@@ -245,6 +245,16 @@ struct libinput_device_config_send_events {
 #define LIBINPUT_ACCEL_NPOINTS_MAX 64
 
 /**
+ * Custom acceleration function min point value
+ */
+#define LIBINPUT_ACCEL_POINT_MIN_VALUE 0
+
+/**
+ * Custom acceleration function max point value
+ */
+#define LIBINPUT_ACCEL_POINT_MAX_VALUE 10000
+
+/**
  * Custom acceleration function max step size
  */
 #define LIBINPUT_ACCEL_STEP_MAX 10000
diff --git a/src/libinput.c b/src/libinput.c
index 37451fa1..c40266d7 100644
--- a/src/libinput.c
+++ b/src/libinput.c
@@ -4267,6 +4267,12 @@ libinput_config_accel_set_points(struct libinput_config_accel *config,
 	if (npoints < LIBINPUT_ACCEL_NPOINTS_MIN || npoints > LIBINPUT_ACCEL_NPOINTS_MAX)
 		return LIBINPUT_CONFIG_STATUS_INVALID;
 
+	for (size_t idx = 0; idx < npoints; idx++) {
+		if (points[idx] < LIBINPUT_ACCEL_POINT_MIN_VALUE ||
+		    points[idx] > LIBINPUT_ACCEL_POINT_MAX_VALUE)
+			return LIBINPUT_CONFIG_STATUS_INVALID;
+	}
+
 	struct libinput_config_accel_custom_func *func = libinput_config_accel_custom_func_create();
 
 	func->step = step;
diff --git a/test/test-pointer.c b/test/test-pointer.c
index c9f2e344..f8eb1eff 100644
--- a/test/test-pointer.c
+++ b/test/test-pointer.c
@@ -2281,12 +2281,25 @@ START_TEST(pointer_accel_config)
 	struct libinput_device *device = dev->libinput_device;
 	enum libinput_config_status status;
 	enum libinput_config_accel_profile profile;
-	double custom_speed[] = {0.1234, -0.567, 0.89};
-	double custom_step[] = {0.5, 0.003, 2.7};
-	double custom_npoints = 4;
-	double custom_points[3][4] = {{1.0, 2.0, 2.5, 2.6},
-				      {0.1, 0.3, 0.4, 0.45},
-				      {1.0, 3.0, 4.5, 4.5}};
+	enum libinput_config_status valid = LIBINPUT_CONFIG_STATUS_SUCCESS,
+				    invalid = LIBINPUT_CONFIG_STATUS_INVALID;
+	enum libinput_config_accel_type fallback = LIBINPUT_ACCEL_TYPE_FALLBACK,
+					motion = LIBINPUT_ACCEL_TYPE_MOTION;
+	struct custom_config_test {
+		enum libinput_config_accel_type accel_type;
+		double step;
+		double points[4];
+		enum libinput_config_status expected_status;
+	} tests[] = {
+		{ fallback,  0.5, { 1.0, 2.0, 2.5, 2.6 },  valid },
+		{ motion,  0.003, { 0.1, 0.3, 0.4, 0.45 }, valid },
+		{ fallback,  2.7, { 1.0, 3.0, 4.5, 4.5 },  valid },
+		{ motion,      0, { 1.0, 2.0, 2.5, 2.6 },  invalid },
+		{ fallback,   -1, { 1.0, 2.0, 2.5, 2.6 },  invalid },
+		{ motion,   1e10, { 1.0, 2.0, 2.5, 2.6 },  invalid },
+		{ fallback,    1, { 1.0, 2.0, -2.5, 2.6 }, invalid },
+		{ motion,      1, { 1.0, 2.0, 1e10, 2.6 }, invalid },
+	};
 
 	ck_assert(libinput_device_config_accel_is_available(device));
 
@@ -2298,14 +2311,13 @@ START_TEST(pointer_accel_config)
 	ck_assert_ptr_nonnull(config_custom_default);
 	ck_assert_ptr_nonnull(config_custom_changed);
 
-
-	for (size_t idx = 0; idx < ARRAY_LENGTH(custom_speed); idx++) {
+	ARRAY_FOR_EACH(tests, t) {
 		status = libinput_config_accel_set_points(config_custom_changed,
-							  LIBINPUT_ACCEL_TYPE_FALLBACK,
-							  custom_step[idx],
-							  custom_npoints,
-							  custom_points[idx]);
-		ck_assert_int_eq(status, LIBINPUT_CONFIG_STATUS_SUCCESS);
+							  t->accel_type,
+							  t->step,
+							  ARRAY_LENGTH(t->points),
+							  t->points);
+		ck_assert_int_eq(status, t->expected_status);
 
 		status = libinput_device_config_accel_apply(device, config_custom_changed);
 		ck_assert_int_eq(status, LIBINPUT_CONFIG_STATUS_SUCCESS);