Instead of returning BadAccess when "read" permission is denied
on a device, falsify the device state (buttons down, keys pressed).
This is nicer to applications, but may still have undesired side
effects. The long-term solution is not to use these requests in
event-driven code!
Requests affected: QueryPointer, QueryKeymap, XiQueryDevice.
[Backport to 1.6]
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
Signed-off-by: Keith Packard <keithp@keithp.com>
When the windows are restructured, CheckMotion needs to be called for all
masters and floating slaves to update the spriteTrace.
X.Org Bug 23257 <http://bugs.freedesktop.org/show_bug.cgi?id=23257>
(cherry picked from commit 6c292d1705)
Tested-by: Thomas Jaeger
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
dixLookupResource attempted to automatically detect whether the caller
wanted a lookup by-type or by-class, unfortunately, it guessed wrong for
RT_NONE. Instead of trying to make the guess better, this patch just reverts
the unification and creates separate functions for each operation.
(cherry picked from commit f8dd80d13b)
Signed-off-by: Keith Packard <keithp@keithp.com>
Error: Write outside array bounds at Xext/geext.c:406
in function 'GEWindowSetMask' [Symbolic analysis]
In array dereference of cli->nextSib[extension] with index 'extension'
Array size is 128 elements (of 4 bytes each), index <= 128
Error: Buffer overflow at dix/events.c:592
in function 'SetMaskForEvent' [Symbolic analysis]
In array dereference of filters[deviceid] with index 'deviceid'
Array size is 20 elements (of 512 bytes each), index >= 0 and index <= 20
Error: Read buffer overflow at hw/xfree86/loader/loader.c:226
in function 'LoaderOpen' [Symbolic analysis]
In array dereference of refCount[new_handle] with index 'new_handle'
Array size is 256 elements (of 4 bytes each), index >= 1 and index <= 256
These bugs were found using the Parfait source code analysis tool.
For more information see http://research.sun.com/projects/parfait
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit b680bda34d)
(cherry picked from commit 04c9e80f08)
Signed-off-by: Keith Packard <keithp@keithp.com>
Add a proper access mode, and reverse the logic of the return value.
Zero ("Success") is returned on success from the hook calls.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
(cherry picked from commit 3cea176d5a)
Note that deviceKeyButtonPointer and keyButtonPointer have the same wire
layout, so we only need to check for event types.
X.Org Bug 20557 <http://bugs.freedesktop.org/show_bug.cgi?id=20557>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
If the MD's lastSlave was a devices with custom axes ranges, then a
WarpPointer would position the cursor at the wrong location. A WarpPointer
request provides screen coordinates and these coordinates were scaled to the
device range before warping.
This patch consists of two parts:
1) in the WarpPointer handling, get the lastSlave and post the event through
this device.
2) assume that WarpPointer coordinates are always in screen coordinates and
scale them to device coordinates in GPE before continuing. Note that this
breaks device-coordinate based XWarpDevicePointer calls (for which the spec
isn't nailed down yet anyway) until a better solution is found.
X.Org Bug 19297 <http://bugs.freedesktop.org/show_bug.cgi?id=19297>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit d36adf52a2)
No MotionNotify events in the processing anymore, so let's have them treat DMN
instead.
Reported by Thomas Jaeger.
(cherry picked from commit 488d452951)
This was broken in 32aa252e98.
Signed-off-by: Kim Woelders <kim@woelders.dk>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 30d2cfcd38)
Conflicts:
dix/events.c
Signed-off-by: Keith Packard <keithp@keithp.com>
This commit moves the focus handling from events.c into enterleave.c and
implements a model similar to the core enter/leave model.
For a full description of the model, see:
http://lists.freedesktop.org/archives/xorg/2008-December/041740.html
This commit also gets rid of the focusinout array in the WindowRec, ditching
it in favour of a local array that keeps the current focus window for each
device.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit eb2d7b3d70)
Conflicts:
dix/events.c
include/input.h
Signed-off-by: Keith Packard <keithp@keithp.com>
Device events always need to be delivered, core events only in some cases.
Let's keep them completely separate so we can adjust core event delivery.
Signed-off-by: Peter Hutterer <peter.hutterer@redhat.com>
We need them for each window, every time a window is allocated. Storing them
in a devPrivate is the wrong thing to do.
This also removes the unused ENTER_LEAVE_SEMAPHORE_ISSET macro.
Signed-off-by: Peter Hutterer <peter.hutterer@redhat.com>
Signed-off-by: Daniel Stone <daniel@fooishbar.org>
grab == devgrab anyway, this is a leftover from the time when we had two
different grabs per device (core and XI grab).
Signed-off-by: Peter Hutterer <peter.hutterer@redhat.com>
Really, this was a bad idea. It's not security, the UI features that would
have been cool (e.g. clicking through windows) aren't implemented anyway, and
there's nothing you can't achieve just by using plain XI anyway.
Requires inputproto 1.9.99.6.
Two corrections
1. the "detail" field has NotifyVirtual, etc., not the "mode" field. This was
a clear bug.
2. don't set/unset the flags for NotifyGrab or NotifyUngrab. Clients are
expected to deal with multiple enter/leave events per window if the mode is
not NotifyNormal.
Testable with TCL menu boxes (such as used in gitk):
tk_optionMenu .menu globVar Val1 Val2 Val3 ValJunk
pack .menu
Thanks to Michel Dänzer for pointing this out.
This fixes a severe issue - when the client died the event mask didn't get
unregistered and a future event would dereference dangling pointers. By
storing the event masks in the resource system we can free them when the
client dies.
Dereferencing into dev->valuator could crash the server, although it looks
like I could only reproduce this by having a keyboard send an event after it
was created and the WM was still replaying. Or so.
device->button->down used to be a 32-byte bitmask with one bit for each
button. This has changed into a 256-byte array, with one byte assigned for
each button. Some of the callers were still using this array as a bitmask
however, this is fixed with this patch.
Thanks to Keith Packard for pointing this out. See also:
http://lists.freedesktop.org/archives/xorg/2008-June/036202.html
RealizeCursor should be called when the cursor is allocated. However, when the
root cursor is allocated, no devices exist yet, and thus RealizeCursor is
never called. This may lead to segfaults lateron in DDXes like Xnest that
actually need to do something for each cursor, and lateron rely on that
DDX-specific data for each cursor has been initialized.
