From 1f123a264bb4d43ed15e5cbdcfd5584ddfa53e20 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 17 Apr 2026 10:30:09 +1000
Subject: [PATCH] Xi/exevents: fix off-by-one in UpdateDeviceState valuator
 bounds check

There is no OOB write, the loop a few lines below has the correct
i < numAxes check. But this does set last_valuator to an invalid
value which may have flow-on effects elsewhere later.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2200>
---
 Xi/exevents.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Xi/exevents.c b/Xi/exevents.c
index 6bda32a6f..2ee4fbc53 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -904,7 +904,7 @@ UpdateDeviceState(DeviceIntPtr device, DeviceEvent *event)
                        "Ignoring event.\n", device->name);
                 return DONT_PROCESS;
             }
-            else if (v->numAxes < i) {
+            else if (v->numAxes <= i) {
                 ErrorF("[Xi] Too many valuators reported for device '%s'. "
                        "Ignoring event.\n", device->name);
                 return DONT_PROCESS;