frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dix: copy event in TouchConvertToPointerEvent correctly 

Fixes reading random memory read beyond the end of original event.

sizeof device_event: 424
sizeof internal_event: 2800

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
Maarten Lankhorst 2013-04-15 16:53:48 +02:00 committed by Peter Hutterer
parent 4bff442ec5
commit 98b94c36d6
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dix/touch.c
View File

@ -620,14 +620,14 @@ TouchConvertToPointerEvent(const InternalEvent *event,
BUG_WARN_MSG(!(event->device_event.flags & TOUCH_POINTER_EMULATED), BUG_WARN_MSG(!(event->device_event.flags & TOUCH_POINTER_EMULATED),
"Non-emulating touch event\n"); "Non-emulating touch event\n");
*motion_event = *event; motion_event->device_event = event->device_event;
motion_event->any.type = ET_Motion; motion_event->any.type = ET_Motion;
motion_event->device_event.detail.button = 0; motion_event->device_event.detail.button = 0;
motion_event->device_event.flags = XIPointerEmulated; motion_event->device_event.flags = XIPointerEmulated;
if (nevents > 1) { if (nevents > 1) {
BUG_RETURN_VAL(!button_event, 0); BUG_RETURN_VAL(!button_event, 0);
*button_event = *event; button_event->device_event = event->device_event;
button_event->any.type = ptrtype; button_event->any.type = ptrtype;
button_event->device_event.flags = XIPointerEmulated; button_event->device_event.flags = XIPointerEmulated;
/* detail is already correct */ /* detail is already correct */