frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xi: get the class length before swapping. 

Advancing by the already-swapped length lets our pointers point into
nirvana.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
Peter Hutterer 2009-06-09 13:03:38 +10:00
parent 9974249980
commit 482cc72aa7
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Xi/querydev.c
View File

@ -425,6 +425,7 @@ SwapDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info)
for (i = 0; i < info->num_classes; i++) for (i = 0; i < info->num_classes; i++)
{ {
int len = ((xXIAnyInfo*)any)->length;
switch(((xXIAnyInfo*)any)->type) switch(((xXIAnyInfo*)any)->type)
{ {
case ButtonClass: case ButtonClass:
@ -438,7 +439,7 @@ SwapDeviceInfo(DeviceIntPtr dev, xXIDeviceInfo* info)
break; break;
} }
any += (((xXIAnyInfo*)any)->length * 4); any += len * 4;
} }
swaps(&info->deviceid, n); swaps(&info->deviceid, n);