diff options
| author | Rob Bradford <rob@linux.intel.com> | 2012-10-09 18:44:34 +0100 |
|---|---|---|
| committer | Kristian Høgsberg <krh@bitplanet.net> | 2012-10-09 22:56:46 -0400 |
| commit | 053fe7652bc6445a234892e567f076642c468703 (patch) | |
| tree | ac400654f6989100c30090063ffe17dcda53e94f /clients/keyboard.c | |
| parent | 273fec8ede2bf1ec7c9fb14e841e383277113fdf (diff) | |
| download | weston-053fe7652bc6445a234892e567f076642c468703.tar.gz | |
keyboard: Avoid access beyond end off buffer
If the for loop does not match on a button it will fall through and try and
dereference into the array using the terminating value of the loop. This
terminating value of the loop is the dimension of the array and thus beyond
its bounds.
Cc: Jan Arne Petersen <jpetersen@openismus.com>
Signed-off-by: Rob Bradford <rob@linux.intel.com>
Diffstat (limited to 'clients/keyboard.c')
| -rw-r--r-- | clients/keyboard.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/clients/keyboard.c b/clients/keyboard.c index 8820a22a..19eb0346 100644 --- a/clients/keyboard.c +++ b/clients/keyboard.c @@ -313,12 +313,12 @@ button_handler(struct widget *widget, col = x / key_width + row * columns; for (i = 0; i < sizeof(keys) / sizeof(*keys); ++i) { col -= keys[i].width; - if (col < 0) + if (col < 0) { + keyboard_handle_key(keyboard, &keys[i]); break; + } } - keyboard_handle_key(keyboard, &keys[i]); - widget_schedule_redraw(widget); } |