In:
commit d792ac125a0462a04a930af543cbc732f8cdab7d
Author: Alan Coopersmith <[email protected]>
Date: Mon Jul 9 19:12:43 2012 -0700
Use C99 designated initializers in dix Replies
the initializer for the .length element of the xGetPointerMappingReply
structure uses the value of rep.nElts, but that won't be set until
after this initializer runs, so we get garbage in the length element
and clients using it will generally wedge.
Easy to verify:
$ xmodmap -pp
Fixed by creating a local nElts variable and using that.
Signed-off-by: Keith Packard <[email protected]>
---
dix/devices.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/dix/devices.c b/dix/devices.c
index 839de35..207b78b 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -1890,6 +1890,7 @@ ProcGetPointerMapping(ClientPtr client)
* the ClientPointer could change. */
DeviceIntPtr ptr = PickPointer(client);
ButtonClassPtr butc = ptr->button;
+ int nElts;
int rc;
REQUEST_SIZE_MATCH(xReq);
@@ -1898,15 +1899,16 @@ ProcGetPointerMapping(ClientPtr client)
if (rc != Success)
return rc;
+ nElts = (butc) ? butc->numButtons : 0;
rep = (xGetPointerMappingReply) {
.type = X_Reply,
- .nElts = (butc) ? butc->numButtons : 0,
+ .nElts = nElts,
.sequenceNumber = client->sequence,
- .length = ((unsigned) rep.nElts + (4 - 1)) / 4
+ .length = ((unsigned) nElts + (4 - 1)) / 4
};
WriteReplyToClient(client, sizeof(xGetPointerMappingReply), &rep);
if (butc)
- WriteToClient(client, (int) rep.nElts, &butc->map[1]);
+ WriteToClient(client, nElts, &butc->map[1]);
return Success;
}
--
1.7.10.4
_______________________________________________
[email protected]: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
