Bug 35082

Summary:	BadLength in XChangeDevicePropery of XInputExtension when performing byte-swapping
Product:	xorg	Reporter:	Markus Fleschutz <markus.fleschutz>
Component:	Server/Input/Core	Assignee:	Xorg Project Team <xorg-team>
Status:	RESOLVED FIXED	QA Contact:	Xorg Project Team <xorg-team>
Severity:	normal
Priority:	medium	Keywords:	patch
Version:	git
Hardware:	All
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Markus Fleschutz 2011-03-07 05:52:35 UTC

In the function SProcXChangeDeviceProperty() in Xi/xiproperty.c the length of the request is checked by using REQUEST_SIZE_MATCH(xChangeDevicePropertyReq).

However, in most cases the request will have an attachment and this results in BadLength error. Therefore, it should be changed to REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq).

The same issue applies to SProcXIChangeProperty(), too.

Comment 1 Julien Cristau 2011-03-07 09:57:25 UTC

Thanks for the report.  Patch submitted at http://patchwork.freedesktop.org/patch/4427/

Comment 2 Alistair Leslie-Hughes 2011-04-06 03:01:40 UTC

commit eb8141b6edd8b477c0ba796be71e985c35520a9b
Author: Julien Cristau <jcristau@debian.org>
Date:   Mon Mar 7 18:55:19 2011 +0100

    Xi: fix length checks for swapped clients
    
    ChangeDeviceProperty and XIChangeProperty are followed by some data, so
    use REQUEST_AT_LEAST_SIZE instead of REQUEST_SIZE_MATCH.
    
    X.Org bug#35082 <https://bugs.freedesktop.org/show_bug.cgi?id=35082>
    
    Reported-by: Markus Fleschutz <markus.fleschutz@x-software.com>
    Signed-off-by: Julien Cristau <jcristau@debian.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.