This fixes a format string vulnerabilty.
evdev_log_message() composes a format string consisting of a fixed
prefix (including the rendered device name) and the passed-in format
buffer. This format string is then passed with the arguments to the
actual log handler, which usually and eventually ends up being printf.
If the device name contains a printf-style format directive, these ended
up in the format string and thus get interpreted correctly, e.g. for a
device "Foo%sBar" the log message vs printf invocation ends up being:
evdev_log_message(device, "some message %s", "some argument");
printf("event9 - Foo%sBar: some message %s", "some argument");
This can enable an attacker to execute malicious code with the
privileges of the process using libinput.
To exploit this, an attacker needs to be able to create a kernel device
with a malicious name, e.g. through /dev/uinput or a Bluetooth device.
To fix this, convert any potential format directives in the device name
by duplicating percentages.
Pre-rendering the device to avoid the issue altogether would be nicer
but the current log level hooks do not easily allow for this. The device
name is the only user-controlled part of the format string.
A second potential issue is the sysname of the device which is also
sanitized.
This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from
Assured AB, and independently by Lukas Lamster.
Fixes#752
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit a423d7d326)
https://gitlab.freedesktop.org/libinput/libinput/-/merge_requests/512 disables
input smoothing for AES devices. However, some AES devices produce
segmented/wobbly curves without smoothing. This change introduces an
`AttrTabletSmoothing` boolean property, which overrides the default smoothing
behavior.
See #632
Signed-off-by: Quytelda Kahja <quytelda@tamalin.org>
(cherry picked from commit e6c4b1d16e)
Pressing Ctrl/Shift on this model triggers light touches that causes random clicks.
This doesn't occur on Windows 10 so adding this quirk to fix it
Signed-off-by: sharno <sharnoby3@gmail.com>
(cherry picked from commit 5a23665dfb)
Always prefix the ninja args with the FDO_CI_CONCURRENT values (i.e. how many
jobs the runner tells us).
Note that this variable is currently not passed through to the qemu jobs, so
inside the VM we'll still use the ninja default values.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
When pinching, the thumb tends to move slower than the finger, so we may
suppress it too early.
Add a grace period during which it may be revived.
Signed-off-by: novenary <streetwalkermc@gmail.com>
A pinch is defined as two fingers moving in different directions, and a
scroll as two fingers moving in the same direction.
Often enough when the user is trying to pinch, we may initially see both
fingers moving in the same direction and decide that they want to
scroll.
Add a grace period during which we may transition to a pinch in those
situations.
Test fix: touchpad_trackpoint_buttons_2fg_scroll emits movements that
change the distance between fingers, which triggers this new transition
and makes the test fail; correct this.
Signed-off-by: novenary <streetwalkermc@gmail.com>
Generated with a script to scrape the openrazer project for Razer Blade
internal keyboard VIDs, see `razer_quirk_util.py` [1]
This allows us to potentially bulk-add all Razer Blade models to benefit from
palm rejection, rather than processing individual requests and merges.
[1] https://gist.github.com/danryu/ee0c24ac50af40321550462bbf9ab594
Signed-off-by: dan g <dan.garton@gmail.com>
Let a few obvious modifiers through, including the F-key range. Especially
left control is useful to know if it's down.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The kernel emulates key events on its own anyway, replaying key events with
libinput replay as well just duplicates the events. Turning kernel
repeat off is not an option, it makes the device look different (EV_REP
changes). So let's just not replay those events.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Use a scan-build wrapper to generate plist files, then parse those into a
JUnit xml format. This makes the errors appear on the main MR page as opposed
to being hidden in the artifacts somewhere.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
New commandline switch --with-hidraw. This will open all hidraw devices
associated with this device and add any reports to the output in the
form:
events:
- hid:
time: [0, 0]
hidraw1: [0x01, 0x02, 0x03, 0x05, 0x06]
hidraw2: [0x07, 0x08, 0x09, 0x0a, 0x0b]
- evdev:
...
i.e. there's a nesting of `hid` with a list of reports, each with the hidraw
node as dictionary entry.
Because hidraw events do not have timestamps and always occur before the evdev
events, they are in a separate frame (as shown above). We could try to figure
out how to match them with the upcoming evdev frame but it's not worth it for
now.
The timestamp itself is a special key in the hidraw with the timestamp from
clock_gettime.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
YAML does support hex as long as it's 0x-prefixed. The comment here (probably)
dates from an in-development version of libinput-record that used JSON.
Anyway, let's print the HID report descriptor as hex because that's the common
format for it.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This assumption dates back roughly a decade when INPUT_PROP_BUTTONPAD was
introduced into the kernel. To my knowledge, devices right now erroneously
advertise INPUT_PROP_BUTTONPAD when they are not a clickpad (but then they
have BTN_RIGHT) or they lack INPUT_PROP_BUTTONPAD (and only have BTN_LEFT).
So let's change our assumption here - if a clickpad has a right button log the
kernel bug and continue with the assumption the device is a touchpad with
physical buttons.
To disable that warning, fix the kernel or add an AttrInputPropDisable quirk
for the device.
Fixes#595
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
There is only one touchpad with a physical left button but no right button and
that is the old Apple touchpad, discontinued in 2008. Not a huge number of
those left, I assume.
So let's change our assumptions because these days the vast majority of
touchpads are clickpads - any touchpad that only has a left button is treated
as clickpad, even where the kernel doesn't set the INPUT_PROP_BUTTONPAD.
We do need to check for BTN_LEFT as well though, because Wacom touchpads (i.e.
the touch part of non-integrated Wacom tablets) don't have a left button
either.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Move the code in used to detect motion based gestures (scroll, swipe and pinch)
to tp_gesture_detect_motion_gestures.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Move tp_gesture_same_directions, tp_gesture_mm_moved and tp_gesture_init_pinch
to be able to use them in future commits.
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
