From b7b27e9cc1c948bdf4eace5fee8db3667eb4a8d5 Mon Sep 17 00:00:00 2001 From: Sam Spilsbury Date: Wed, 14 Sep 2011 09:58:34 +0800 Subject: [PATCH] Remove the SendEvent bit (0x80) before doing range checks on event type. Some extension libraries may set this bit before converting the event to wire protocol and as such range checking the event will cause an invalid BadValue error to result. As the documentation suggests the the bit should be "forced on", remove it before doing range checks and continue to force it on in the server. Reviewed-by: Jamey Sharp Signed-off-by: Peter Hutterer (cherry picked from commit 2d2dce558d24eeea0eb011ec9ebaa6c5c2273c39) (cherry picked from commit e9ae33316012ffe9acfeeb7303ab3392c2ca2a2b) --- dix/events.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/dix/events.c b/dix/events.c index eefcdef0a..effbb223c 100644 --- a/dix/events.c +++ b/dix/events.c @@ -4981,6 +4981,8 @@ CloseDownEvents(void) InputEventList = NULL; } +#define SEND_EVENT_BIT 0x80 + /** * Server-side protocol handling for SendEvent request. * @@ -4998,6 +5000,16 @@ ProcSendEvent(ClientPtr client) REQUEST_SIZE_MATCH(xSendEventReq); + /* libXext and other extension libraries may set the bit indicating + * that this event came from a SendEvent request so remove it + * since otherwise the event type may fail the range checks + * and cause an invalid BadValue error to be returned. + * + * This is safe to do since we later add the SendEvent bit (0x80) + * back in once we send the event to the client */ + + stuff->event.u.u.type &= ~(SEND_EVENT_BIT); + /* The client's event type must be a core event type or one defined by an extension. */ @@ -5055,7 +5067,7 @@ ProcSendEvent(ClientPtr client) client->errorValue = stuff->propagate; return BadValue; } - stuff->event.u.u.type |= 0x80; + stuff->event.u.u.type |= SEND_EVENT_BIT; if (stuff->propagate) { for (;pWin; pWin = pWin->parent)