summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* libXi 1.7.5libXi-1.7.5Peter Hutterer2015-09-101-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Fix version check in _XIAllowEventsCosimo Cecchi2015-02-241-1/+1
| | | | | | | | | Commit 5810d0797160a97012664ffe719a59e1b288a525 changed _XIAllowEvents() to use _XiCheckVersion() instead of _XiCheckExtInit() to avoid a double display unlock, but it failed to correctly check for the version, since we should set have_XI22 to True for every version greater or equal to 2.2. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* XIGrabDevice: Unlock display in error path.Michal Srb2014-11-041-2/+9
| | | | | Signed-off-by: Michal Srb <msrb@suse.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Refactor XGetExtensionVersion.Michal Srb2014-11-033-19/+12
| | | | | | | | | | | | | _XiGetExtensionVersion was called from XGetExtensionVersion and from _XiCheckExtInit. When called from _XiCheckExtInit, nothing accounted for the fact that it can return ((XExtensionVersion *) NoSuchExtension) in case of error. Also it recursively calls _XiCheckExtInit potentionally causing multiple unlocks if _XiCheckExtInit fails. -> Remove it and call directly _XiGetExtensionVersionRequest and only call _XiCheckExtInit only from XGetExtensionVersion. Signed-off-by: Michal Srb <msrb@suse.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Fix logic in _XIAllowEvents and prevent double unlock.Michal Srb2014-11-031-2/+2
| | | | | | | | | Replacing the second _XiCheckExtInit with _XiCheckVersion prevents possible double unlock as _XiCheckExtInit actually unlocks the display when it returns -1. Signed-off-by: Michal Srb <msrb@suse.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* XIGetClientPointer: Return False on error.Michal Srb2014-11-031-1/+1
| | | | | | | Not NoSuchExtension which is 1 = True! Signed-off-by: Michal Srb <msrb@suse.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Do not return NoSuchExtension casted to pointer as an error.Michal Srb2014-11-038-8/+8
| | | | | | | | | Several functions were returning NoSuchExtension casted to a pointer in case of an error. Often in parallel with returning NULL in case of another error. It is undocumented and certainly wrong. Signed-off-by: Michal Srb <msrb@suse.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* XIChangeHierarchy: Add missing unlock.Michal Srb2014-11-031-5/+9
| | | | | | | When num_changes <= 0 or Xmalloc fails, the display has to be unlocked. Signed-off-by: Michal Srb <msrb@suse.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Fix double unlock when _XiCheckExtInit return -1.Michal Srb2014-11-035-7/+16
| | | | | | | | _XiCheckExtInit unlocks the display if it fails and returns -1. Most callers account for it properly, but few didn't. Signed-off-by: Michal Srb <msrb@suse.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Advance the request buffer by the right amount in XIChangeHierarchyJulien Cristau2014-10-281-1/+1
| | | | | | | | c->length is in 4-byte units, dptr is a char *, so we need to advance dptr by 4 * length to get the position of the next HierarchyChangeInfo. Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Julien Cristau <jcristau@debian.org>
* libXi 1.7.4libXi-1.7.4Peter Hutterer2014-07-181-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Fix locking bugs with XIAllowTouchEvents() and XIUngrabTouchBegin()Owen W. Taylor2014-07-142-6/+2
| | | | | | | | Fix two places where the display was double locked when an API function chained to an implementation that also locks the display. Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* libXi 1.7.3libXi-1.7.3Peter Hutterer2014-07-101-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* XIPassiveGrab: Fix completely broken locking in XIGrabTouchBeginJasper St. Pierre2014-07-101-0/+1
| | | | | | | | | | | | _XIPassiveGrabDevice calls LockDisplay as the first thing it does. That means that it expects the display to be unlocked. XIGrabTouchBegin locks the display to check for the XI extension, and then never unlocks it. Effectively, this meant that anybody that called XIGrabTouchBegin after XInitThreads just got a deadlock. Cool. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* XIPassiveGrab: Fix display locking inside _XIPassiveGrabDevice for error pathsJasper St. Pierre2014-07-101-9/+9
| | | | | | | The code here before would just leave the display locked on error, which is all sorts of broken. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Remove fallback for _XEatDataWords, require libX11 1.6 for itMichael Joost2013-11-252-20/+1
| | | | | | | | | | | | | | _XEatDataWords was orignally introduced with the May 2013 security patches, and in order to ease the process of delivering those, fallback versions of _XEatDataWords were included in the X extension library patches so they could be applied to older versions that didn't have libX11 1.6 yet. Now that we're past that hurdle, we can drop the fallbacks and just require libX11 1.6 for building new versions of the extension libraries. Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* man: Update XIQueryVersion docs to match new version compatibility semanticsKeith Packard2013-07-261-4/+16
| | | | | | | | | The X server now allows clients to specify any combination of versions starting with version 2.2, document how that works. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* libXi 1.7.2libXi-1.7.2Peter Hutterer2013-07-031-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Remove check that can never be true.Thomas Klausner2013-06-281-3/+0
| | | | | | | | | | clang warns: warning: comparison of constant 268435455 with expression of type 'CARD16' (aka 'unsigned short') is always false Signed-off-by: Thomas Klausner <wiz@NetBSD.org> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* libXi 1.7.1.901libXi-1.7.1.901Peter Hutterer2013-06-271-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Include limits.h to prevent build error: missing INT_MAXPeter Hutterer2013-06-272-0/+2
| | | | | | Introduced in 4c8e9bcab459ea5f870d3e56eff15f931807f9b7. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* If the XGetDeviceDontPropagateList reply has an invalid length, return 0Peter Hutterer2013-06-271-1/+3
| | | | | | | | If we skip over the reply data, return 0 as number of event classes. Follow-up to 6dd6dc51a2935c72774be81e5cc2ba2c30e9feff. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Change size += to size = in XGetDeviceControlPeter Hutterer2013-06-271-5/+5
| | | | | | | | | | size += blah is technically correct but it implies that we're looping or otherwise incrementing the size. Which we don't, it's only ever set once. Change this to avoid reviewer confusion. Reported-by: Dave "color-me-confused" Airlie <airlied@redhat.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Fix potential corruption in mask_len handlingPeter Hutterer2013-06-273-12/+45
| | | | | | | | | | | | | | First: check for allocation failure on the mask. XI2 requires that the mask is zeroed, so we can't just Data() the mask provided by the client (it will pad) - we need a tmp buffer. Make sure that doesn't fail. Second: req->mask_len is a uint16_t, so check against malicious mask_lens that would cause us to corrupt memory on copy, as the code always allocates req->mask_len * 4, but copies mask->mask_len bytes. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Don't overwrite the cookies serial numberPeter Hutterer2013-05-241-1/+0
| | | | | | | | | | | | serial != sequenceNumber, see _XSetLastRequestRead() cookie->serial is already set at this point, setting it again directly from the sequenceNumber of the event causes a bunch of weird issues such as scrollbars and text drag-n-drop breaking. https://bugzilla.redhat.com/show_bug.cgi?id=965347 Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* sign extension issue in XListInputDevices() [CVE-2013-1995]Alan Coopersmith2013-05-231-6/+10
| | | | | | | | | | | | | | nptr is (signed) char, which can be negative, and will sign extend when added to the int size, which means size can be subtracted from, leading to allocating too small a buffer to hold the data being copied from the X server's reply. v2: check that string size fits inside the data read from the server, so that we don't read out of bounds either Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* Avoid integer overflow in XListInputDevices() [CVE-2013-1984 8/8]Alan Coopersmith2013-05-231-4/+6
| | | | | | | | | If the length of the reply as reported by the Xserver is too long, it could overflow the calculation for the size of the buffer to copy the reply into, causing memory corruption. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* Avoid integer overflow in XGetDeviceProperties() [CVE-2013-1984 7/8]Alan Coopersmith2013-05-231-24/+37
| | | | | | | | | If the number of items as reported by the Xserver is too large, it could overflow the calculation for the size of the buffer to copy the reply into, causing memory corruption. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* integer overflow in XIGetSelectedEvents() [CVE-2013-1984 6/8]Alan Coopersmith2013-05-231-6/+19
| | | | | | | | | | | | | | | If the number of events or masks reported by the server is large enough that it overflows when multiplied by the size of the appropriate struct, or the sizes overflow as they are totaled up, then memory corruption can occur when more bytes are copied from the X server reply than the size of the buffer we allocated to hold them. v2: check that reply size fits inside the data read from the server, so that we don't read out of bounds either Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* integer overflow in XIGetProperty() [CVE-2013-1984 5/8]Alan Coopersmith2013-05-231-4/+7
| | | | | | | | | | | If the number of items reported by the server is large enough that it overflows when multiplied by the size of the appropriate item type, then memory corruption can occur when more bytes are copied from the X server reply than the size of the buffer we allocated to hold them. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* integer overflow in XGetDeviceMotionEvents() [CVE-2013-1984 4/8]Alan Coopersmith2013-05-231-5/+17
| | | | | | | | | | | If the number of events or axes reported by the server is large enough that it overflows when multiplied by the size of the appropriate struct, then memory corruption can occur when more bytes are copied from the X server reply than the size of the buffer we allocated to hold them. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* integer overflow in XGetDeviceDontPropagateList() [CVE-2013-1984 3/8]Alan Coopersmith2013-05-231-3/+5
| | | | | | | | | | | | | If the number of event classes reported by the server is large enough that it overflows when multiplied by the size of the appropriate struct, then memory corruption can occur when more bytes are copied from the X server reply than the size of the buffer we allocated to hold them. V2: EatData if count is 0 but length is > 0 to avoid XIOErrors Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* integer overflow in XGetFeedbackControl() [CVE-2013-1984 2/8]Alan Coopersmith2013-05-231-5/+19
| | | | | | | | | | | | | | | If the number of feedbacks reported by the server is large enough that it overflows when multiplied by the size of the appropriate struct, or if the total size of all the feedback structures overflows when added together, then memory corruption can occur when more bytes are copied from the X server reply than the size of the buffer we allocated to hold them. v2: check that reply size fits inside the data read from the server, so we don't read out of bounds either Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* integer overflow in XGetDeviceControl() [CVE-2013-1984 1/8]Alan Coopersmith2013-05-231-7/+24
| | | | | | | | | | | | | | If the number of valuators reported by the server is large enough that it overflows when multiplied by the size of the appropriate struct, then memory corruption can occur when more bytes are copied from the X server reply than the size of the buffer we allocated to hold them. v2: check that reply size fits inside the data read from the server, so we don't read out of bounds either Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* unvalidated lengths in XQueryDeviceState() [CVE-2013-1998 3/3]Alan Coopersmith2013-05-231-5/+12
| | | | | | | | | If the lengths given for each class state in the reply add up to more than the rep.length, we could read past the end of the buffer allocated to hold the data read from the server. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* memory corruption in _XIPassiveGrabDevice() [CVE-2013-1998 2/3]Alan Coopersmith2013-05-231-1/+1
| | | | | | | | | If the server returned more modifiers than the caller asked for, we'd just keep copying past the end of the array provided by the caller, writing over who-knows-what happened to be there. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* Stack buffer overflow in XGetDeviceButtonMapping() [CVE-2013-1998 1/3]Alan Coopersmith2013-05-231-8/+13
| | | | | | | | | | We copy the entire reply sent by the server into the fixed size mapping[] array on the stack, even if the server says it's a larger size than the mapping array can hold. HULK SMASH STACK! Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* Use _XEatDataWords to avoid overflow of rep.length bit shiftingAlan Coopersmith2013-05-2315-20/+36
| | | | | | | rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
* Copy the sequence number into the target event too (#64687)Peter Hutterer2013-05-201-0/+9
| | | | | | | X.Org Bug 64687 <http://bugs.freedesktop.org/show_bug.cgi?id=64687> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Jasper St. Pierre <jstpierre@mecheye.net>
* Expand comment on the memory vs. reply ordering in XIGetSelectedEvents()Alan Coopersmith2013-04-301-2/+8
| | | | | | | | | Unpacking from the wire involves un-interleaving the structs & masks, which wasn't obvious to me the first time I read it, so make notes before I forget again. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* libXi 1.7.1libXi-1.7.1Peter Hutterer2013-04-051-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Require XFixes for PointerBarrier, remove duplicate typedefPeter Hutterer2013-04-054-2/+5
| | | | | | | | | | | | | | | | | | The PointerBarrier typedef is duplicate if a client includes both Xfixes.h and XInput2.h. gcc 4.6 won't complain about that, but earlier versions do: http://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=ce3765bf44e49ef0568a1ad4a0b7f807591d6412 gcc 4.6 with -pedantic-errors shows: /opt/xorg/include/X11/extensions/XInput2.h:172:13: error: redefinition of typedef ‘PointerBarrier’ [-pedantic] In file included from test.c:1:0: /opt/xorg/include/X11/extensions/Xfixes.h:255:13: note: previous declaration of ‘PointerBarrier’ was here Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Julien Cristau <jcristau@debian.org>
* libXi 1.7libXi-1.7Peter Hutterer2013-03-071-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* autogen.sh: Implement GNOME Build APIbaserock/morphColin Walters2013-01-151-1/+3
| | | | | | http://people.gnome.org/~walters/docs/build-api.txt Signed-off-by: Adam Jackson <ajax@redhat.com>
* configure: Remove AM_MAINTAINER_MODEAdam Jackson2013-01-151-1/+0
| | | | Signed-off-by: Adam Jackson <ajax@redhat.com>
* Add missing XI_RawTouch* in XInputCopyCookieBenjamin Tissoires2013-01-151-0/+3
| | | | | | | | | | | Looks like XI_RawTouch* events are missing in the big switch in this function. When running XIT tests for multitouch devices, several following errors appears: XInputCopyCookie: Failed to copy evtype 22 XInputCopyCookie: Failed to copy evtype 23 XInputCopyCookie: Failed to copy evtype 24 Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* libXi 1.6.99.1libXi-1.6.99.1Peter Hutterer2012-12-261-1/+1
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* Merge branch 'barriers'Peter Hutterer2012-12-178-3/+274
|\
| * man: add man-page for XIBarrierReleasePointerPeter Hutterer2012-12-092-0/+79
| | | | | | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
| * Add support for pointer barrier eventsJasper St. Pierre2012-12-096-2/+194
| | | | | | | | | | Signed-off-by: Jasper St. Pierre <jstpierre@mecheye.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
View Lorry Controller Status