From d2158d4063dd87e630ca4c853ac07b88f3662c8f Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Mon, 20 Feb 2023 15:10:26 +1000 Subject: [PATCH] dix: fix wheel emulation lockup when a negative increment is set The increment sign wasn't taking into account when checking if the next value is past our current value. The result was that for negative increments, we kept looping indefinitely, locking up the server. Easiest to reproduce with the evdev driver which has a negative increment on the y axis. Fixes 0a22502c34f2ea9799a67386498f657d769c7af8 dix: switch scroll button emulation to multiples of increment Signed-off-by: Peter Hutterer --- dix/getevents.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dix/getevents.c b/dix/getevents.c index d4441224e..c39ef3371 100644 --- a/dix/getevents.c +++ b/dix/getevents.c @@ -1607,9 +1607,9 @@ emulate_scroll_button_events(InternalEvent *events, /* The next value we want to send out a button event for */ double next_val = last_scroll_val + direction * incr; - if ((direction > 0 && next_val > current_val) || - (direction < 0 && next_val < current_val)) - break; + if ((((direction > 0 && incr > 0) || (direction < 0 && incr < 0)) && (next_val > current_val)) || + (((direction > 0 && incr < 0) || (direction < 0 && incr > 0)) && (next_val < current_val))) + break; /* fill_pointer_events() generates four events: one normal and one raw * event for button press and button release.