fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-05-06 05:48:02 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sync TouchListener memory allocation with population in TouchSetupListeners()

Browse source 
The allocated TouchListener array may fall short by 1 if hitting the worst case
situation where there's an active grab, passive grabs on each window in the
sprite trace and event selection for touch in one of the windows. This may lead
to memory corruptions as the array is overflown.

Signed-off-by: Carlos Garnacho <carlosg@gnome.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit ced56f322e)
This commit is contained in:
Carlos Garnacho 2012-10-25 15:03:50 +02:00 • committed by Peter Hutterer
parent 835737244f
commit 10d9cd36b4
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
dix/touch.c
View file

@ -572,8 +572,8 @@ TouchBuildSprite(DeviceIntPtr sourcedev, TouchPointInfoPtr ti,
return FALSE;
/* Mark which grabs/event selections we're delivering to: max one grab per
* window plus the bottom-most event selection. */
ti->listeners = calloc(sprite->spriteTraceGood + 1, sizeof(*ti->listeners));
* window plus the bottom-most event selection, plus any active grab. */
ti->listeners = calloc(sprite->spriteTraceGood + 2, sizeof(*ti->listeners));
if (!ti->listeners) {
sprite->spriteTraceGood = 0;
return FALSE;