Bug 23607 - having mask and mask_len unset in XIEventMask crashes Xorg
Summary: having mask and mask_len unset in XIEventMask crashes Xorg
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Input/other (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: Peter Hutterer
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: xserver-1.7
  Show dependency tree / graph
 
Reported: 2009-08-31 10:59 UTC by Carlos Garnacho Parro
Modified: 2009-09-02 15:46 UTC (History)
0 users

See Also:
i915 platform:
i915 features:

Attachments

Description Carlos Garnacho Parro 2009-08-31 10:59:57 UTC 
I know this is nasty, but Xorg shouldn't crash though :), code like this:

  XIEventMask mask; /* Note it's uninitialized */

  mask.deviceid = XIAllMasterDevices;
  XISelectEvents (xdisplay, xwindow, &mask, 1);

crashes Xorg for me, I will try to provide a backtrace later, but most surely the handling/crashing should happen in libXi instead.
Comment 1 Peter Hutterer 2009-09-01 23:18:10 UTC 
xserver bug, afaict libXi behaves correctly here. you've uncovered a big pile of bugs here, thanks. fixes will be pushed soon.
Comment 2 Peter Hutterer 2009-09-02 15:46:52 UTC 
Fixes addressing this issue

59a6d7d478903a8bc9c5d4cc8b2e62e2ad102dba Xi: don't overrun memory for grab masks.

83db2b126e8623824e1303e74070375994984599 Xi: don't try to set oversized or non-existing masks.

58c298acc1045927e0d90be73b8dbc8837252589 Xi: extra length checking for requests providing masks.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.