From 5c361d59c5031d9b3f7f9093a52d2b1ff4d9ae5f Mon Sep 17 00:00:00 2001
From: Chase Douglas <chase.douglas@canonical.com>
Date: Fri, 20 Apr 2012 11:08:15 -0700
Subject: [PATCH] TouchListenerAcceptReject: Warn and return early on bad
 listener index

Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
Reviewed-by: Bryce Harrington <bryce@canonical.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 dix/touch.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/dix/touch.c b/dix/touch.c
index dd16367d0..401cb981a 100644
--- a/dix/touch.c
+++ b/dix/touch.c
@@ -966,6 +966,11 @@ TouchListenerAcceptReject(DeviceIntPtr dev, TouchPointInfoPtr ti, int listener,
     int nev;
     int i;
 
+    BUG_WARN(listener < 0);
+    BUG_WARN(listener >= ti->num_listeners);
+    if (listener < 0 || listener >= ti->num_listeners)
+        return BadMatch;
+
     if (listener > 0) {
         if (mode == XIRejectTouch)
             TouchRejected(dev, ti, ti->listeners[listener].listener, NULL);