Bug 23607

Summary:	having mask and mask_len unset in XIEventMask crashes Xorg
Product:	xorg	Reporter:	Carlos Garnacho Parro <carlosg>
Component:	Input/other	Assignee:	Peter Hutterer <peter.hutterer>
Status:	RESOLVED FIXED	QA Contact:	Xorg Project Team <xorg-team>
Severity:	normal
Priority:	medium
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:
Bug Depends on:
Bug Blocks:	23613

Description Carlos Garnacho Parro 2009-08-31 10:59:57 UTC

I know this is nasty, but Xorg shouldn't crash though :), code like this:

  XIEventMask mask; /* Note it's uninitialized */

  mask.deviceid = XIAllMasterDevices;
  XISelectEvents (xdisplay, xwindow, &mask, 1);

crashes Xorg for me, I will try to provide a backtrace later, but most surely the handling/crashing should happen in libXi instead.

Comment 1 Peter Hutterer 2009-09-01 23:18:10 UTC

xserver bug, afaict libXi behaves correctly here. you've uncovered a big pile of bugs here, thanks. fixes will be pushed soon.

Comment 2 Peter Hutterer 2009-09-02 15:46:52 UTC

Fixes addressing this issue

59a6d7d478903a8bc9c5d4cc8b2e62e2ad102dba Xi: don't overrun memory for grab masks.

83db2b126e8623824e1303e74070375994984599 Xi: don't try to set oversized or non-existing masks.

58c298acc1045927e0d90be73b8dbc8837252589 Xi: extra length checking for requests providing masks.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.