Attachment #486668 for bug #623972

View | Details | Raw Unified | Return to bug 623972
Collapse All | Expand All

Lines 95-103 SProcXSendExtensionEvent(ClientPtr client) Link Here

(-)a/Xi/sendexev.c (-2 / +9 lines)
95		95
96	eventP = (xEvent *) &stuff[1];	96	eventP = (xEvent *) &stuff[1];
97	for (i = 0; i < stuff->num_events; i++, eventP++) {	97	for (i = 0; i < stuff->num_events; i++, eventP++) {
		98	if (eventP->u.u.type == GenericEvent) {
		99	client->errorValue = eventP->u.u.type;
		100	return BadValue;
		101	}
		102
98	proc = EventSwapVector[eventP->u.u.type & 0177];	103	proc = EventSwapVector[eventP->u.u.type & 0177];
99	if (proc == NotImplemented) /* no swapping proc; invalid event type? */	104	/* no swapping proc; invalid event type? */
		105	if (proc == NotImplemented) {
		106	client->errorValue = eventP->u.u.type;
100	return BadValue;	107	return BadValue;
		108	}
101	(*proc) (eventP, &eventT);	109	(*proc) (eventP, &eventT);
102	*eventP = eventT;	110	*eventP = eventT;
103	}	111	}
104	-

Lines 117-123 SProcXSendExtensionEvent(ClientPtr client) Link Here

(-)a/Xi/sendexev.c (-6 / +7 lines)
117	int	117	int
118	ProcXSendExtensionEvent(ClientPtr client)	118	ProcXSendExtensionEvent(ClientPtr client)
119	{	119	{
120	int ret;	120	int ret, i;
121	DeviceIntPtr dev;	121	DeviceIntPtr dev;
122	xEvent *first;	122	xEvent *first;
123	XEventClass *list;	123	XEventClass *list;
Lines 141-150 ProcXSendExtensionEvent(ClientPtr client) Link Here
141	/* The client's event type must be one defined by an extension. */	141	/* The client's event type must be one defined by an extension. */
142		142
143	first = ((xEvent *) &stuff[1]);	143	first = ((xEvent *) &stuff[1]);
144	if (!((EXTENSION_EVENT_BASE <= first->u.u.type) &&	144	for (i = 0; i < stuff->num_events; i++) {
145	(first->u.u.type < lastEvent))) {	145	if (!((EXTENSION_EVENT_BASE <= first[i].u.u.type) &&
146	client->errorValue = first->u.u.type;	146	(first[i].u.u.type < lastEvent))) {
147	return BadValue;	147	client->errorValue = first[i].u.u.type;
		148	return BadValue;
		149	}
148	}	150	}
149		151
150	list = (XEventClass *) (first + stuff->num_events);	152	list = (XEventClass *) (first + stuff->num_events);
151	-

Lines 5366-5371 ProcSendEvent(ClientPtr client) Link Here

(-)a/dix/events.c (+6 lines)
5366	client->errorValue = stuff->event.u.u.type;	5366	client->errorValue = stuff->event.u.u.type;
5367	return BadValue;	5367	return BadValue;
5368	}	5368	}
		5369	/* Generic events can have variable size, but SendEvent request holds
		5370	exactly 32B of event data. */
		5371	if (stuff->event.u.u.type == GenericEvent) {
		5372	client->errorValue = stuff->event.u.u.type;
		5373	return BadValue;
		5374	}
5369	if (stuff->event.u.u.type == ClientMessage &&	5375	if (stuff->event.u.u.type == ClientMessage &&
5370	stuff->event.u.u.detail != 8 &&	5376	stuff->event.u.u.detail != 8 &&
5371	stuff->event.u.u.detail != 16 && stuff->event.u.u.detail != 32) {	5377	stuff->event.u.u.detail != 16 && stuff->event.u.u.detail != 32) {

Lines 292-297 SProcSendEvent(ClientPtr client) Link Here

(-)a/dix/swapreq.c (-1 / +7 lines)
292	swapl(&stuff->destination);	292	swapl(&stuff->destination);
293	swapl(&stuff->eventMask);	293	swapl(&stuff->eventMask);
294		294
		295	/* Generic events can have variable size, but SendEvent request holds
		296	exactly 32B of event data. */
		297	if (stuff->event.u.u.type == GenericEvent) {
		298	client->errorValue = stuff->event.u.u.type;
		299	return BadValue;
		300	}
		301
295	/* Swap event */	302	/* Swap event */
296	proc = EventSwapVector[stuff->event.u.u.type & 0177];	303	proc = EventSwapVector[stuff->event.u.u.type & 0177];
297	if (!proc \|\| proc == NotImplemented) /* no swapping proc; invalid event type? */	304	if (!proc \|\| proc == NotImplemented) /* no swapping proc; invalid event type? */
298	-

Lines 78-84 SProcXSendExtensionEvent(ClientPtr client) Link Here

(-)a/Xi/sendexev.c (-2 / +1 lines)
78	{	78	{
79	CARD32 *p;	79	CARD32 *p;
80	int i;	80	int i;
81	xEvent eventT;	81	xEvent eventT = { .u.u.type = 0 };
82	xEvent *eventP;	82	xEvent *eventP;
83	EventSwapPtr proc;	83	EventSwapPtr proc;
84		84
85	-

Return to bug 623972