mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2026-02-04 07:10:26 +01:00
fbb636bf6b
Previously, it was looping through sizeof(ev->valuators.mask) * 8
valuators, where valuators.mask is defined as an array of
(MAX_VALUATORS + 7) / 8 entries. Since MAX_VALUATORS is defined as 36,
this made it actually loop through 40 entries. The last 4 bits in this
array should never be set, so we should never access memory outside the
bounds of the arrays defined to be exactly MAX_VALUATORS in length, but
we can make the static analyzer happier and not waste time checking bits
that should never be set.
Found by Oracle Parfait 13.3 static analyzer:
Read outside array bounds [read-outside-array-bounds]:
In array dereference of ev->valuators.data[i] with index i
Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
at line 741 of dix/eventconvert.c in function 'eventToDeviceEvent'.
Read outside array bounds [read-outside-array-bounds]:
In array dereference of ev->valuators.data[i] with index i
Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
at line 808 of dix/eventconvert.c in function 'eventToRawEvent'.
Read outside array bounds [read-outside-array-bounds]:
In array dereference of ev->valuators.data_raw[i] with index i
Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
at line 809 of dix/eventconvert.c in function 'eventToRawEvent'.
Fixes:
|
||
|---|---|---|
| .. | ||
| .gitignore | ||
| atom.c | ||
| buildatoms | ||
| BuiltInAtoms | ||
| colormap.c | ||
| cursor.c | ||
| devices.c | ||
| dispatch.c | ||
| dispatch.h | ||
| dixfonts.c | ||
| dixutils.c | ||
| enterleave.c | ||
| enterleave.h | ||
| eventconvert.c | ||
| events.c | ||
| extension.c | ||
| gc.c | ||
| gestures.c | ||
| getevents.c | ||
| globals.c | ||
| glyphcurs.c | ||
| grabs.c | ||
| initatoms.c | ||
| inpututils.c | ||
| main.c | ||
| Makefile.am | ||
| meson.build | ||
| pixmap.c | ||
| privates.c | ||
| property.c | ||
| protocol.txt | ||
| ptrveloc.c | ||
| region.c | ||
| registry.c | ||
| resource.c | ||
| selection.c | ||
| stubmain.c | ||
| swaprep.c | ||
| swapreq.c | ||
| tables.c | ||
| touch.c | ||
| window.c | ||