On 01/23/14 10:53 PM, Peter Hutterer wrote:
The request is followed by mask_len 4-byte units, then followed by the actual
modifiers.
Reported-by: Alan Coopersmith <[email protected]>
Signed-off-by: Peter Hutterer <[email protected]>
---
Xi/xipassivegrab.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index eccec0a..8aba977 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -63,7 +63,7 @@ SProcXIPassiveGrabDevice(ClientPtr client)
swaps(&stuff->mask_len);
swaps(&stuff->num_modifiers);
- mods = (uint32_t *) &stuff[1];
+ mods = (uint32_t *) &stuff[1] + stuff->mask_len;
for (i = 0; i < stuff->num_modifiers; i++, mods++) {
swapl(mods);
Matches the math in the unswapped function, and my reading of what
libXi sends from the client, so:
Reviewed-by: Alan Coopersmith <[email protected]>
--
-Alan Coopersmith- [email protected]
Oracle Solaris Engineering - http://blogs.oracle.com/alanc
_______________________________________________
[email protected]: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
