From aa6ccf0b30400775b8e548d191f825dce21e6c0c Mon Sep 17 00:00:00 2001 From: Carlos Garnacho Date: Fri, 4 Sep 2009 15:23:33 +0200 Subject: [PATCH] Xi: Fix mask_len being passed to XICheckInvalidMaskBits() mask_len is specified in bytes, so no need to multiply by 4, as that would overrun past the actual mask length. --- Xi/xigrabdev.c | 2 +- Xi/xipassivegrab.c | 2 +- Xi/xiselectev.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c index 24ededc..44a44dd 100644 --- a/Xi/xigrabdev.c +++ b/Xi/xigrabdev.c @@ -80,7 +80,7 @@ ProcXIGrabDevice(ClientPtr client) stuff->paired_device_mode = GrabModeAsync; if (XICheckInvalidMaskBits((unsigned char*)&stuff[1], - stuff->mask_len * 4) != Success) + stuff->mask_len) != Success) return BadValue; mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4); diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c index 41a56b1..9ff3101 100644 --- a/Xi/xipassivegrab.c +++ b/Xi/xipassivegrab.c @@ -119,7 +119,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) } if (XICheckInvalidMaskBits((unsigned char*)&stuff[1], - stuff->mask_len * 4) != Success) + stuff->mask_len) != Success) return BadValue; mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4); diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c index 672edab..1ea306d 100644 --- a/Xi/xiselectev.c +++ b/Xi/xiselectev.c @@ -142,7 +142,7 @@ ProcXISelectEvents(ClientPtr client) } if (XICheckInvalidMaskBits((unsigned char*)&evmask[1], - evmask->mask_len * 4) != Success) + evmask->mask_len) != Success) return BadValue; evmask = (xXIEventMask*)(((unsigned char*)evmask) + evmask->mask_len * 4); -- 1.6.0.4