hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity
xserver/Xi
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Enrico Weigelt, metux IT consult 3023d9cbb5 Xi: zero device/pointer/state reply buffers 
Several XInput reply handlers built their payloads in buffers allocated with
the non-zeroing x_rpcbuf_reserve() and left bytes uninitialized that were then
sent to the client:

  * ProcXListInputDevices - xDeviceInfo.attached and xKeyInfo pad bytes.
  * ProcXIQueryPointer - the 32-byte button bitmask was only OR'ed with the
    down buttons via SetBit(), never zero-initialized.
  * ProcXIQueryDevice - pad bytes of xXIDeviceInfo, xXIValuatorInfo,
    xXIScrollInfo and xXIGestureInfo.
  * ProcXQueryDeviceState - xKeyState.pad1 and xButtonState.pad1.

Allocate all four reply payloads with x_rpcbuf_reserve0().

Fixes: 8c90875c3d ("Xi: ProcXListInputDevices(): use x_rpcbuf_t")
Fixes: 5281024261 ("Xi: ProcXIQueryPointer(): use x_rpcbuf_t")
Fixes: a7a48427f5 ("Xi: ProcXIQueryDevice(): use x_rpcbuf_t")
Fixes: 68b7098173 ("Xi: ProcXQueryDeviceState(): use x_rpcbuf_t")
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2026-06-12 18:55:16 +02:00
..
allowev.c Xi: ProcXAllowDeviceEvents(): declare variables where needed 2026-05-01 18:46:19 +02:00
chgdctl.c Xi: ProcXChangeDeviceControl(): declare variables where needed 2026-05-08 17:18:13 +02:00
chgfctl.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
chgkbd.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
chgkmap.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
chgprop.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
chgptr.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
chgptr.h Xi: fix missing includes 2026-04-24 13:59:57 +02:00
closedev.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
devbell.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
exevents.c Xi/exevents: fix off-by-one in UpdateDeviceState valuator bounds check 2026-05-21 18:36:26 +02:00
exglobals.h Xi: helper for private structure retrieval 2025-09-10 13:41:47 +02:00
extinit.c Xi: fail if we can't assign device names 2026-04-30 19:58:45 +02:00
getbmap.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
getdctl.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
getfctl.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
getfocus.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
getkmap.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
getmmap.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
getprop.c Xi: ProcXGetDeviceDontPropagateList(): use X_REQUEST_* macros 2026-05-08 17:27:05 +02:00
getprop.h Xi: fix missing includes 2026-04-24 13:59:57 +02:00
getselev.c Xi: ProcXGetSelectedExtensionEvents(): use X_REQUEST_* macros 2026-05-08 14:06:35 +02:00
getvers.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
grabdev.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
grabdev.h Xi: fix missing includes 2026-04-24 13:59:57 +02:00
grabdevb.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
grabdevk.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
gtmotion.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
handlers.h Xi: inline SProcXISelectEvents() and SProcXIGetSelectedEvents() 2025-10-30 09:44:41 +01:00
listdev.c Xi: zero device/pointer/state reply buffers 2026-06-12 18:55:16 +02:00
meson.build treewide: remove "lib" prefix in static_library names (meson) 2025-07-03 12:01:52 +02:00
opendev.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
queryst.c Xi: zero device/pointer/state reply buffers 2026-06-12 18:55:16 +02:00
selectev.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
sendexev.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
setbmap.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
setdval.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
setfocus.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
setmmap.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
setmode.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
stubs.c
ungrdev.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
ungrdevb.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
ungrdevk.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
xiallowev.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
xibarriers.c Xi: rename "screen" fields to "pScreen" 2026-02-10 10:32:35 +01:00
xibarriers.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
xichangecursor.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
xichangehierarchy.c Xi/xichangehierarchy: reject zero-length hierarchy change entries 2026-06-05 14:59:01 +02:00
xichangehierarchy.h Xi: fix missing includes 2026-04-24 13:59:57 +02:00
xigetclientpointer.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
xigrabdev.c Xi: xigrabdev: fix FTBS on *BSD 2026-05-06 19:18:27 +02:00
xipassivegrab.c Xi: add missing gesture grab type checks in ProcXIPassiveUngrabDevice 2026-05-21 20:32:43 +02:00
xiproperty.c Xi: Swap property data in ProcXChangeDeviceProperty/ProcXIChangeProperty 2026-06-05 16:32:25 +02:00
xiproperty.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
xiquerydevice.c Xi: zero device/pointer/state reply buffers 2026-06-12 18:55:16 +02:00
xiquerydevice.h Xi: fix missing includes 2026-04-24 13:59:57 +02:00
xiquerypointer.c Xi: zero device/pointer/state reply buffers 2026-06-12 18:55:16 +02:00
xiqueryversion.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
xiselectev.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
xisetclientpointer.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00
xisetdevfocus.c Xi: use new X_REPLY_FIELD_* macros 2026-04-28 17:30:25 +02:00
XIstubs.h Xi: fix missing includes 2026-04-24 13:59:57 +02:00
xiwarppointer.c Xi: use REQUEST_HEAD_STRUCT and REQUEST_FIELD_* macros 2026-02-04 12:52:48 +01:00