Behaviour of earlier X servers was to deliver the ButtonPress event
unconditionally, regardless of the actual event mask being set. This is
documented in the protocol:
"This request establishes a passive grab. In the future, the pointer is
actively grabbed as described in GrabPointer, the last-pointer-grab time is
set to the time at which the button was pressed (as transmitted in the
ButtonPress event), and the ButtonPress event is reported if all of the
following conditions are true:
<list of conditions, event mask is not one of them>"
Thus, a GrabButton event will always deliver the button press event, a
GrabKey always the key press event, etc. Same goes for XI and XI2.
Reproducible with a simple client requesting a button grab in the form of:
XGrabButton(dpy, AnyButton, AnyModifier, win, True, ButtonReleaseMask,
GrabModeAsync, GrabModeAsync, None, None);
On servers before MPX/XI2, the client will receive a button press and
release event. On current servers, the client receives only the release.
Clients that expect the press event to be delivered unconditionally.
XTS Xlib13 XGrabButton 5/39 now passes.
This reverts commit 48585bd1e3.
Effectively reverts commit 1c612acca8 as well,
the code introduced with 1c612 is not needed anymore.
Conflicts:
dix/events.c
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 1884db430a)
Without this patch, any negative valuator value is wrong when returned
from XQueryDeviceState(). This is a regression from at least xserver
1.4.
Valuator data is set in dix/getevents.c:set_valuators() by copying
signed int values into an unsigned int field
DeviceEvent.valuators.data.
That data is converted into a double with an implicit cast by
assignment to axisVal[i] in Xi/exevents.c:UpdateDeviceState().
That double is converted back to a signed int in
queryst.c:ProcXQueryDeviceState(). If the original value in
set_valuators() is negative, the double value will be > 2^31 and the
conversion back to a signed int is undefined. (Although I
consistently see the value -2^31.)
Fix this by changing the definition of DeviceEvent.valuators.data from
uint32_t to int32_t.
Signed-off-by: Joe Shaw <joeshaw@litl.com>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit e354ccac36)
These have the same default, but if you specify something different with
-s on the command line, only the screensaver time is changed. As DPMS
is usually what's desired, change it to match.
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 2a763c9023)
If a client sends a big request that's too big (i.e. bigger than
maxBigRequestSize << 2 bytes), the server just disconnects it. This makes the
client receive SIGPIPE the next time it tries to send something.
The X Test Suite sends requests that are too big when the test specifies the
TOO_LONG test type. When the client receives SIGPIPE, XTS marks it as
UNRESOLVED, which counts as a failure.
Instead, remember how long the request is supposed to be and then return that
size. Dispatch() checks the length and sends BadLength to the client. Then,
whenever oci->ignoreBytes is nonzero, ignore the data read instead of trying to
process it as a request.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit cf88363db0)
Because some EnterVT code needs to remove it self from the
call chain, we need to fix all of the wrappers to correctly
unwrap/rewrap during the call chain. This is a follow-on to the fix
for bug 27114 in commit 68a9ee8370.
Signed-off-by: Keith Packard <keithp@keithp.com>
Tested-by: Jesse Barnes <jesse.barnes@intel.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com>
(cherry picked from commit d75e8146c4, and
conflict from b618705 fixed up)
Signed-off-by: Julien Cristau <jcristau@debian.org>
When resetting the server, pScrn->EnterVT must be unwrapped or the
next server generation will end up wrapping the wrapper and causing an
infinite recursion on EnterVT.
Signed-off-by: Keith Packard <keithp@keithp.com>
Tested-by: Michael Stapelberg <michael+freedesktop@stapelberg.de>
(cherry picked from commit 68a9ee8370)
- Note that -br is now default.
- Move -bs after -br for alphabetical ordering.
- Remove -config option that's been hidden in "ignore" section,
since ajax removed the -config code a couple years back.
- Add -nocursor option.
- Add xinput & xrandr to list of runtime server control programs
- Replace XDarwin with Xquartz in list of Xservers
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7b09335a46)
ProcDRI2Dispatch uses LocalClient to determine if it's safe to respond
to a client that has made DRI2 requests which aren't sensible for
remote clients (anything but version). When the client has disappeared
mid-request stream (e.g. as a result of a kill -9, or a client-side
bug), LocalClient causes the X server to follow suit, as
((OsCommPtr)client->osPrivate)->trans_conn is NULL at this point.
The simple and obvious fix is to just return "not local" when
trans_conn is NULL, which fixes the crash I was seeing; however Keith
Packard pointed out that just checking trans_conn isn't enough;
quoting Keith:
"This looks almost right to me -- I reviewed the os code to see when
_XSERVTransClose is called (which is what frees the trans_conn data) and
found that every place which called that immediately set trans_conn to
NULL, except for the call in CloseDownFileDescriptor which is only
called from CloseDownConnection and which is immediately followed by
freeing the OsCommRec and setting client->osPrivate to NULL. So, I'd
suggest checking client->osPrivate in addition to the above check."
Signed-off-by: Simon Farnsworth <simon.farnsworth@onelan.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 660f6ab549)
OpenSolaris recently added support for the getifaddrs() API.
Building with that uncovered two compiler issues (one warning, one error)
in the code that was now being built for the first time in our builds:
"access.c", line 768: warning: argument #1 is incompatible with prototype:
prototype: pointer to struct sockaddr {unsigned short sa_family, array[14] of char sa_data} : "access.c", line 213
argument : pointer to struct sockaddr_storage {unsigned short ss_family, array[6] of char _ss_pad1, double _ss_align, array[240] of char _ss_pad2}
"access.c", line 838: assignment type mismatch:
struct sockaddr {unsigned short sa_family, array[14] of char sa_data} "=" struct sockaddr_storage {unsigned short ss_family, array[6] of char _ss_pad1, double _ss_align, array[240] of char _ss_pad2}
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
(cherry picked from commit e42a29d269)
When the parser sees the "keyboard" driver, it automatically (and
silently) replaces it with the constant string "kbd".
Everybody else uses malloc'd memory for the driver name, so input
device closure assumes it can use free.
Free val.str, so this crash doesn't turn into a memory leak. Whew.
Signed-off-by: Jesse Adkins <jesserayadkins@gmail.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit bce12f2956)
A window with either dimension > 32767 can be positioned such that
coordinates > 32767 are visible on the screen. Attempts to draw to
those pixels will generate coordinates wrapped around to negative
values.
The optimized clipping macro, 'isClipped', in fbbits.h, computes
clipping in window space rather than screen space using int16 values,
and so it too has coordinates wrapped around to negative values and
hence ends up accepting the wrapped drawing coordinates.
Two possible fixes for this problem
1) Detect wrapped region coordinates and clip those to 32767.
2) Detect negative incoming coordinates and reject those
This patch takes the second approach as it is much shorter, simply
detecting when either X or Y incoming coordinate is negative, which
can never be 'within' any drawable.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 3e56efcfb6)
A simple hack to accommodate various EDID who have detailed modes that
exceed the EDID's max pixel clock. The pixel clock is only defined in
units of 10MHz and often appears as the maximum pixel code of the
detailed modes, rounded to the nearest 10MHz. Adjusting the max_clock to
include an extra 5MHz prevents the parser from rejecting the detailed
modes.
The kernel uses the same fuzz and by including it in X we can use the
same modes in X as for the console.
Fixes:
Bug 23833 - X uses different refresh rate to that set by kernel module
https://bugs.freedesktop.org/show_bug.cgi?id=23833
In the future, we will want to try harder to keep the KMS modes but at
the same time we need to apply the restrictions as specified by the
user's configuration, and need to fill in modes for fullscreen games on
fixed-mode panels.
Reported-and-tested-by: Fabio Pedretti <fabio.ped@libero.it>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 951605b466)
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 5725849a1b)
The callback data passed by reference to the hook was allocated on stack
within the scope of the case statement. The compiler is free to reuse
any of that stack space whilst making the function call so we may end up
passing garbage into the callback.
References:
Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()
https://bugs.freedesktop.org/show_bug.cgi?id=18451
v2: Drop the unrelated hunk that snuck in when ammending the commit
message.
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 6dae7f3792)
Classic strlen/strcpy mistake of
foo = malloc(strlen(bar));
strcpy(foo, bar);
Testcase: valgrind Xephyr :1
==8591== Invalid write of size 1
==8591== at 0x4A0638F: strcpy (mc_replace_strmem.c:311)
==8591== by 0x605593: _XkbCopyGeom (xkbUtils.c:1994)
==8591== by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591== by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591== by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591== by 0x447162: ActivateDevice (devices.c:530)
==8591== by 0x4475D6: InitCoreDevices (devices.c:672)
==8591== by 0x4449EE: main (main.c:254)
==8591== Address 0x6f96505 is 0 bytes after a block of size 53 alloc'd
==8591== at 0x4A0515D: malloc (vg_replace_malloc.c:195)
==8591== by 0x6054B7: _XkbCopyGeom (xkbUtils.c:1980)
==8591== by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591== by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591== by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591== by 0x447162: ActivateDevice (devices.c:530)
==8591== by 0x4475D6: InitCoreDevices (devices.c:672)
==8591== by 0x4449EE: main (main.c:254)
Reported-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by-and-apologised-for: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7f19a7a6e9)
Conflicts:
xkb/xkbUtils.c
(cherry picked from commit f85552aa45)
Signed-off-by: Julien Cristau <jcristau@debian.org>
While VT-switched, FB access is disabled and should remain so. Trying to switch
modes in that state would re-enable it, potentially causing crashes if trying
to access it before the driver has recovered from the mode switch.
Signed-off-by: Pierre-Loup A. Griffais <pgriffais@nvidia.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 41bdb6c003)
Signed-off-by: Julien Cristau <jcristau@debian.org>
In case you want to copy a region with source = dest, you have the same pixmap
as source and dest.
At the end of exaPixmapIsOffscreen_classic() the devPrivate.ptr is reset to
NULL (look at the sources).
Now this is what happens in ExaCheckCopyNtoN:
exaPrepareAccess( pDst );
Calls IsOffscreen()
sets devPrivate.ptr to NULL
sets up devPrivate.ptr to real pointer
Everything OK
exaPrepareAccess( pSrc );
Calls IsOffscreen()
sets devPrivate.ptr to NULL
BAILS OUT CAUSE OF NESTED OPERATION SINCE DST EQUALS SRC
We end up with devPrivate.ptr as NULL, and that is clearly wrong.
In particular this fixes a segfault when using the psb driver (bug 28077)
Signed-off-by: Éric Piel <eric.piel@tremplin-utc.net>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7e8f100121)
Upon resume, X may try to dereference a null pointer, which has been
reported in Debian bug #507916 (http://bugs.debian.org/507916).
Jim Paris came up with a patch which solves the problem for him. Here's
a (hopefully) fixed version of his patch (without the typo).
Cc: Jim Paris <jim@jtan.com>
Signed-off-by: Cyril Brulebois <kibi@debian.org>
Reviewed-By: Matthias Hopf <mhopf@suse.de>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit fa6c701257)
GetPairedDevice() may not always return the keyboard, resulting in a
null-pointer dereference when accessing the XKB state.
For floating devices, the GetMaster() returns the device itself.
X.Org Bug 27573 <http://bugs.freedesktop.org/show_bug.cgi?id=27573>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Tested-by: Ben Hutchings <ben@decadent.org.uk>
(cherry picked from commit 10de9e8ee3)
<rdar://problem/7989690>
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Edward Moy <emoy@apple.com>
(cherry picked from commit ecfeabec8d)
The middle mouse clicks return erroneous values after returning from
Fast User Switching.
<rdar://problem/7979468>
http://xquartz.macosforge.org/trac/ticket/389
Signed-off-by: Martin Otte <otte@duke.edu>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Edward Moy <emoy@apple.com>
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit a911292c85)
commit 206531f75c added localization files
for ar, add them to the Makefile.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 72758287f7)
With Xinerama enabled, event coordinates are relative to Screen 0, so
they can be negative. The new DeviceEvent's coordinates are of type
uint16_t, making screens above and to the left of Screen 0 unusable.
X.Org Bug 24986 <https://bugs.freedesktop.org/show_bug.cgi?id=24986>
Signed-off-by: Chris Humbert <freedesktop@mahadri.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 21ed660f30)
A call to miPointerUpdateSprite for the XTEST keyboard may result in a
NULL pointer dereference in miDCPutUpCursor() when the save buffer is NULL.
XTS test case: Xlib 11 KeymapNotify
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit af170a4ab7)
This avoids painting the root window when it isn't actually drawable.
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 7b506fdc84)
Fixes https://bugs.freedesktop.org/show_bug.cgi?id=27380 .
Signed-off-by: Michel Dänzer <daenzer@vmware.com>
Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 7b65175266)
If both devices are synchronously grabbed, first with a GrabPointer, then
with a GrabKeyboard (GrabModeSync on both), sync.other of each device points
to the grab of the respective other device.
If the keyboard is then thawed through a AllowSome request, the VCK's
sync.other is reset to NULL. Subsequently, an event on the VCP would crash
the server when dereferencing sync.other on the VCP.
The check's purpose is to compare if the other device is grabbed by the same
client, which should be checked by accessing (dev->deviceGrab->grab->resource).
A check of the server-1.3 sources confirms that.
XTS test case: Xlib13 XAllowEvents 20.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 9ddbb03fa5)
- Pixmaps that are created during a fallback are automatically prepared access.
- During the fallback accelerated ops are blocked to prevent new/scratch gc's
from triggering accelerated ops on mapped pixmaps.
- A few cases of incorrect wrapping (on the top level pointer instead of
between damage and (w)fb) have been removed.
Signed-off-by: Maarten Maathuis <madman2003@gmail.com>
Acked-by: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 342f3689d1)
Conflicts:
exa/exa_mixed.c
Debian bug#576816 <http://bugs.debian.org/576816>
Tested-by: Arthur Marsh <arthur.marsh@internode.on.net>
Signed-off-by: Cyril Brulebois <kibi@debian.org>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The GenericEvent is a core event, we never send an extension event, so
don't reserve an id for one.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit fc5d767408)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Fixes a crash in XIQueryDevice which calls strlen on a NULL pointer.
#0 strlen () at ../sysdeps/x86_64/strlen.S:31
#1 0x00000000004c16ed in SizeDeviceInfo (dev=0x969bd0)
at ../../Xi/xiquerydevice.c:204
#2 0x00000000004c1a01 in ProcXIQueryDevice (client=0xa57510)
at ../../Xi/xiquerydevice.c:98
Debian bug#575905 <http://bugs.debian.org/575905>
Reported-by: "Bernhard R. Link" <brlink@debian.org>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 0e7703f9b1)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This changes the DC layer to maintain a persistent set of GCs/pixmaps/pictures
for each pScreen instead of failing to thrash between them when changing
screens.
Signed-off-by: Pierre-Loup A. Griffais <pgriffais@nvidia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 00b8b7ad61)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
The de-duplication of CheckPhysLimits 942eae6868 added a
condition that is invalid for a Xinerama setup. pScreen is invalid for the
Xinerama case, so comparing it to anything is a bad idea.
Signed-off-by: Tim Yamin <plasm@roo.me.uk>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 5f31e21961)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
<rdar://problem/7862319>
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Marc Majka <majka@apple.com>
(cherry picked from commit fe7778e58e)
See option_sends_alt in Xquartz(1)
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Kevin Van Vechten <kvv@apple.com>
(cherry picked from commit 840d12c7a6)
vga arbiter will be locked in one device while AbortDDX will call LeaveVT
routines from the other device. Fail!
Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit b9ad452ec9)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
A client requesting a GrabModeSync button grab, owner-events true, with only
the ButtonRelease mask set would never receive the press event even if the
grab window had the ButtonPress mask set.
The protocol requires that if owner-events is true, then the delivery mask
is the combination of the grab mask + the window event mask.
X.Org Bug 25400 <http://bugs.freedesktop.org/show_bug.cgi?id=25400>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Jim Ramsay <i.am@jimramsay.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 1c612acca8)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Make sure the reference count of the new cursor is increased before the old
one is decreased, otherwise bad things will happen if they're one and the
same and the reference count is 1 initially. Not sure this can actually happen
here, but better safe than sorry.
Signed-off-by: Michel Dänzer <daenzer@vmware.com>
Reviewed-by: Roland Scheidegger <sroland@vmware.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 3083c5d0c4)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
There are keycodes > 193 in evdev, e.g. KEY_WIMAX which is 246 .
Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Adam Jackson <ajax@nwnk.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit e086b99c1f)
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
