diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c index 3e9a4796e..eafc0e9a0 100644 --- a/hw/xfree86/common/xf86Xinput.c +++ b/hw/xfree86/common/xf86Xinput.c @@ -507,6 +507,12 @@ xf86PostMotionEventP(DeviceIntPtr device, int index; int flags = 0; + if (num_valuators > MAX_VALUATORS) { + xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d" + " is greater than MAX_VALUATORS\n", num_valuators); + return; + } + if (is_absolute) flags = POINTER_ABSOLUTE; else @@ -644,6 +650,12 @@ xf86PostKeyEvent(DeviceIntPtr device, "badly south after this message, then xf86PostKeyEvent is " "broken.\n"); + if (num_valuators > MAX_VALUATORS) { + xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d" + " is greater than MAX_VALUATORS\n", num_valuators); + return; + } + if (!xf86Events) FatalError("Didn't allocate event store\n");