Attachment 26038 Details for Bug 21464 – fix

[patch] fix

0001-Bug-6428-16458-21464-Fix-crash-due-to-uninitia.patch (text/plain), 2.21 KB, created by Tomas Janousek on 2009-05-20 06:27:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomas Janousek

Created: 2009-05-20 06:27:10 UTC

Size: 2.21 KB

patch

obsolete

>From 96de990a791897c4710d8c81b50af0c706e5d4f3 Mon Sep 17 00:00:00 2001
>From: Tomas Janousek <tomi@nomi.cz>
>Date: Wed, 20 May 2009 15:03:01 +0200
>Subject: [PATCH] Bug #6428, #16458, #21464: Fix crash due to uninitialized VModMap fields.
>
>In ProcXkbGetKbdByName, mrep.firstVModMapKey, .nVModMapKeys and
>.totalVModMapKeys were not initialized, contained random values and caused
>accesses to unallocated and later modified memory, causing
>XkbSizeVirtualModMap and XkbWriteVirtualModMap to see different number of
>nonzero values, resulting in writes past the end of an array in XkbSendMap.
>
>This patch initializes those values sensibly and reverts commits 5c0a2088 and
>6dd4fc46, which have been plain non-sense.
>
>Signed-off-by: Tomas Janousek <tomi@nomi.cz>
>---
> xkb/xkb.c |    8 +++++---
> 1 files changed, 5 insertions(+), 3 deletions(-)
>
>diff --git a/xkb/xkb.c b/xkb/xkb.c
>index 15a0f43..4ff2d5f 100644
>--- a/xkb/xkb.c
>+++ b/xkb/xkb.c
>@@ -1311,7 +1311,7 @@ XkbSizeVirtualModMap(XkbDescPtr xkb,xkbGetMapReply *rep)
> 	rep->totalVModMapKeys= 0;
> 	return 0;
>     }
>-    for (nRtrn=i=0;i<rep->nVModMapKeys-1;i++) {
>+    for (nRtrn=i=0;i<rep->nVModMapKeys;i++) {
> 	if (xkb->server->vmodmap[i+rep->firstVModMapKey]!=0)
> 	    nRtrn++;
>     }
>@@ -1330,7 +1330,7 @@ unsigned short *	pMap;
> 
>     wire= (xkbVModMapWireDesc *)buf;
>     pMap= &xkb->server->vmodmap[rep->firstVModMapKey];
>-    for (i=0;i<rep->nVModMapKeys-1;i++,pMap++) {
>+    for (i=0;i<rep->nVModMapKeys;i++,pMap++) {
> 	if (*pMap!=0) {
> 	    wire->key= i+rep->firstVModMapKey;
> 	    wire->vmods= *pMap;
>@@ -5673,7 +5673,7 @@ ProcXkbGetKbdByName(ClientPtr client)
> 	    mrep.present = 0;
> 	    mrep.totalSyms = mrep.totalActs =
> 		mrep.totalKeyBehaviors= mrep.totalKeyExplicit= 
>-		mrep.totalModMapKeys= 0;
>+		mrep.totalModMapKeys= mrep.totalVModMapKeys= 0;
> 	    if (rep.reported&(XkbGBN_TypesMask|XkbGBN_ClientSymbolsMask)) {
> 		mrep.present|= XkbKeyTypesMask;
> 		mrep.firstType = 0;
>@@ -5699,6 +5699,8 @@ ProcXkbGetKbdByName(ClientPtr client)
> 			mrep.firstKeyExplicit = new->min_key_code;
> 		mrep.nKeyActs = mrep.nKeyBehaviors = 
> 			mrep.nKeyExplicit = XkbNumKeys(new);
>+		mrep.firstVModMapKey= new->min_key_code;
>+		mrep.nVModMapKeys= XkbNumKeys(new);
> 	    }
> 	    else {
> 		mrep.virtualMods= 0;
>-- 
>1.6.2.4
>

Actions: View | Splinter Review

Attachments on bug 21464: 25861 | 26038

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.