With this patch we catch the error case separately. Previously, it
was not possible to distinguish between a size of 0 and an error.
XListInputDevices assumed that a return value of 0 indicates an
error and returned an error itself.

This caused a crash in any application that uses Chromium since it
does not handle the error case properly.

v2: Do not set size in case of an error.

Signed-off-by: Niels Ole Salscheider <niels_...@salscheider-online.de>
---
 src/XListDev.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/XListDev.c b/src/XListDev.c
index f850cd0..b2bad72 100644
--- a/src/XListDev.c
+++ b/src/XListDev.c
@@ -73,10 +73,10 @@ static int pad_to_xid(int base_size)
     return ((base_size + padsize - 1)/padsize) * padsize;
 }
 
-static size_t
-SizeClassInfo(xAnyClassPtr *any, size_t len, int num_classes)
+static int
+SizeClassInfo(xAnyClassPtr *any, size_t len, int num_classes, size_t *size_out)
 {
-    int size = 0;
+    size_t size = 0;
     int j;
     for (j = 0; j < num_classes; j++) {
         switch ((*any)->class) {
@@ -91,7 +91,7 @@ SizeClassInfo(xAnyClassPtr *any, size_t len, int num_classes)
                     xValuatorInfoPtr v;
 
                     if (len < sizeof(v))
-                        return 0;
+                        return 1;
                     v = (xValuatorInfoPtr) *any;
                     size += pad_to_xid(sizeof(XValuatorInfo) +
                         (v->num_axes * sizeof(XAxisInfo)));
@@ -101,11 +101,11 @@ SizeClassInfo(xAnyClassPtr *any, size_t len, int 
num_classes)
                 break;
         }
         if ((*any)->length > len)
-            return 0;
+            return 1;
         *any = (xAnyClassPtr) ((char *)(*any) + (*any)->length);
     }
-
-    return size;
+    *size_out = size;
+    return 0;
 }
 
 static void
@@ -220,8 +220,7 @@ XListInputDevices(
        sav_any = any;
        end = (char *)list + rlen;
        for (i = 0; i < *ndevices; i++, list++) {
-            s = SizeClassInfo(&any, end - (char *)any, (int)list->num_classes);
-            if (!s)
+            if(SizeClassInfo(&any, end - (char *)any, (int)list->num_classes, 
&s))
                 goto out;
             size += s;
        }
-- 
2.10.1

_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: https://lists.x.org/mailman/listinfo/xorg-devel

Reply via email to