debian/changelog | 7 ++ debian/patches/0006-axis-label-overrun.patch | 66 +++++++++++++++++++++++++++ debian/patches/series | 1 3 files changed, 74 insertions(+)
New commits: commit fb1384c50997ff215992aa7e658ed8f464454832 Author: Chase Douglas <[email protected]> Date: Thu Jun 7 09:24:26 2012 -0700 releasing version 1:2.7.0-0ubuntu2 diff --git a/debian/changelog b/debian/changelog index 498ffcf..b015ebe 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,9 +1,9 @@ -xserver-xorg-input-evdev (1:2.7.0-0ubuntu2) UNRELEASED; urgency=low +xserver-xorg-input-evdev (1:2.7.0-0ubuntu2) quantal; urgency=low * Fix crash due to axis label overrun (LP: #973297) - Add 0006-axis-label-overrun.patch - -- Chase Douglas <[email protected]> Wed, 06 Jun 2012 12:03:16 -0700 + -- Chase Douglas <[email protected]> Thu, 07 Jun 2012 09:24:10 -0700 xserver-xorg-input-evdev (1:2.7.0-0ubuntu1.1) precise-proposed; urgency=low commit 2678e4911a650dd4d383112670d6f8fbe472cba0 Author: Chase Douglas <[email protected]> Date: Wed Jun 6 12:05:17 2012 -0700 Fix crash due to axis label overrun (LP: #973297) * Fix crash due to axis label overrun (LP: #973297) - Add 0006-axis-label-overrun.patch diff --git a/debian/changelog b/debian/changelog index afc9845..498ffcf 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +xserver-xorg-input-evdev (1:2.7.0-0ubuntu2) UNRELEASED; urgency=low + + * Fix crash due to axis label overrun (LP: #973297) + - Add 0006-axis-label-overrun.patch + + -- Chase Douglas <[email protected]> Wed, 06 Jun 2012 12:03:16 -0700 + xserver-xorg-input-evdev (1:2.7.0-0ubuntu1.1) precise-proposed; urgency=low * Rebuild to fix an ABI breakage causing crashes when headsets are plugged in diff --git a/debian/patches/0006-axis-label-overrun.patch b/debian/patches/0006-axis-label-overrun.patch new file mode 100644 index 0000000..df7519e --- /dev/null +++ b/debian/patches/0006-axis-label-overrun.patch @@ -0,0 +1,66 @@ +From 4145fe1c087708bf5d6608e328342282ecb93ab0 Mon Sep 17 00:00:00 2001 +From: Chase Douglas <[email protected]> +Date: Wed, 6 Jun 2012 12:07:12 -0700 +Subject: [PATCH] Fix buffer overrun when populating axis label property array + +The axis label property array currently only has enough elements for the +non-multitouch axes. This change allocates enough space for all axes, +which prevents an array overrun write. This may manifest as stack +corruption on some platforms. + +Signed-off-by: Chase Douglas <[email protected]> +Signed-off-by: Peter Hutterer <[email protected]> +--- + src/evdev.c | 8 +++++--- + src/evdev.h | 1 + + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/src/evdev.c b/src/evdev.c +index 4b86f66..a628273 100644 +--- a/src/evdev.c ++++ b/src/evdev.c +@@ -1304,6 +1304,7 @@ EvdevAddAbsValuatorClass(DeviceIntPtr device) + } + #ifdef MULTITOUCH + if (num_mt_axes_total > 0) { ++ pEvdev->num_mt_vals = num_mt_axes_total; + pEvdev->mt_mask = valuator_mask_new(num_mt_axes_total); + if (!pEvdev->mt_mask) { + xf86Msg(X_ERROR, "%s: failed to allocate MT valuator mask.\n", +@@ -2879,7 +2880,8 @@ EvdevInitProperty(DeviceIntPtr dev) + if ((pEvdev->num_vals > 0) && (prop_axis_label = XIGetKnownProperty(AXIS_LABEL_PROP))) + { + int mode; +- Atom atoms[pEvdev->num_vals]; ++ int num_axes = pEvdev->num_vals + pEvdev->num_mt_vals; ++ Atom atoms[num_axes]; + + if (pEvdev->flags & EVDEV_ABSOLUTE_EVENTS) + mode = Absolute; +@@ -2890,9 +2892,9 @@ EvdevInitProperty(DeviceIntPtr dev) + mode = Absolute; + } + +- EvdevInitAxesLabels(pEvdev, mode, pEvdev->num_vals, atoms); ++ EvdevInitAxesLabels(pEvdev, mode, num_axes, atoms); + XIChangeDeviceProperty(dev, prop_axis_label, XA_ATOM, 32, +- PropModeReplace, pEvdev->num_vals, atoms, FALSE); ++ PropModeReplace, num_axes, atoms, FALSE); + XISetDevicePropertyDeletable(dev, prop_axis_label, FALSE); + } + /* Button labelling */ +diff --git a/src/evdev.h b/src/evdev.h +index 309b215..c2f9246 100644 +--- a/src/evdev.h ++++ b/src/evdev.h +@@ -153,6 +153,7 @@ typedef struct { + int grabDevice; /* grab the event device? */ + + int num_vals; /* number of valuators */ ++ int num_mt_vals; /* number of multitouch valuators */ + int axis_map[max(ABS_CNT, REL_CNT)]; /* Map evdev <axis> to index */ + ValuatorMask *vals; /* new values coming in */ + ValuatorMask *old_vals; /* old values for calculating relative motion */ +-- +1.7.9.5 + diff --git a/debian/patches/series b/debian/patches/series index 6b40bce..1308520 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ 0004-xi22-ubuntu.patch 0005-fix-horiz-scrolling.patch +0006-axis-label-overrun.patch -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]
