From 2d2dce558d24eeea0eb011ec9ebaa6c5c2273c39 Mon Sep 17 00:00:00 2001 From: Sam Spilsbury Date: Wed, 14 Sep 2011 09:58:34 +0800 Subject: [PATCH] Remove the SendEvent bit (0x80) before doing range checks on event type. Some extension libraries may set this bit before converting the event to wire protocol and as such range checking the event will cause an invalid BadValue error to result. As the documentation suggests the the bit should be "forced on", remove it before doing range checks and continue to force it on in the server. Reviewed-by: Jamey Sharp Signed-off-by: Peter Hutterer --- dix/events.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/dix/events.c b/dix/events.c index 7fe0fba5d..fbe4fc953 100644 --- a/dix/events.c +++ b/dix/events.c @@ -5251,6 +5251,8 @@ CloseDownEvents(void) InputEventList = NULL; } +#define SEND_EVENT_BIT 0x80 + /** * Server-side protocol handling for SendEvent request. * @@ -5268,6 +5270,16 @@ ProcSendEvent(ClientPtr client) REQUEST_SIZE_MATCH(xSendEventReq); + /* libXext and other extension libraries may set the bit indicating + * that this event came from a SendEvent request so remove it + * since otherwise the event type may fail the range checks + * and cause an invalid BadValue error to be returned. + * + * This is safe to do since we later add the SendEvent bit (0x80) + * back in once we send the event to the client */ + + stuff->event.u.u.type &= ~(SEND_EVENT_BIT); + /* The client's event type must be a core event type or one defined by an extension. */ @@ -5325,7 +5337,7 @@ ProcSendEvent(ClientPtr client) client->errorValue = stuff->propagate; return BadValue; } - stuff->event.u.u.type |= 0x80; + stuff->event.u.u.type |= SEND_EVENT_BIT; if (stuff->propagate) { for (;pWin; pWin = pWin->parent)