xserver/dix
Olivier Fourdan 9f7a9be13d dix: avoid deferencing NULL PtrCtrl
PtrCtrl really makes sense for relative pointing device only, absolute
devices such as touch devices do not have any PtrCtrl set.

In some cases, if the client issues a XGetPointerControl() immediatlely
after a ChangeMasterDeviceClasses() copied the touch device to the VCP,
a NULL pointer dereference will occur leading to a crash of Xwayland.

Check whether the PtrCtrl is not NULL in ProcGetPointerControl() and
return the default control values otherwise, to avoid the NULL pointer
dereference.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1519533
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
2017-12-06 11:59:28 -05:00
..
.gitignore
BuiltInAtoms
Makefile.am dix: Remove ffs.c 2017-11-06 17:22:46 -05:00
Xserver-dtrace.h.in
Xserver.d dix: unbreak --with-dtrace (default) on FreeBSD 11.1+ 2017-07-31 13:32:35 -04:00
atom.c
buildatoms
colormap.c
cursor.c dix: Work around non-premultiplied ARGB cursor data 2016-07-15 09:53:07 -04:00
devices.c dix: avoid deferencing NULL PtrCtrl 2017-12-06 11:59:28 -05:00
dispatch.c Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176) 2017-10-10 23:33:44 +02:00
dispatch.h
dixfonts.c Remove fd_set from Block/Wakeup handler API 2016-07-18 15:27:51 -04:00
dixutils.c Remove fd_set from Block/Wakeup handler API 2016-07-18 15:27:51 -04:00
enterleave.c
enterleave.h
eventconvert.c Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
events.c dix: Disallow GenericEvent in SendEvent request. 2017-06-19 11:58:50 +10:00
extension.c dix: Remove extension aliases 2017-06-20 16:37:24 -04:00
gc.c Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
getevents.c xwayland: Don't send KeyRelease events on wl_keyboard::leave 2016-11-29 18:44:54 +10:00
globals.c dpms: Consolidate a bunch of stuff into Xext/dpms.c 2017-03-27 15:59:47 -04:00
glyphcurs.c
grabs.c
initatoms.c
inpututils.c dix: Add valuator_mask_set_absolute_unaccelerated 2016-10-05 13:46:29 -04:00
main.c dpms: Consolidate a bunch of stuff into Xext/dpms.c 2017-03-27 15:59:47 -04:00
meson.build dix: Remove ffs.c 2017-11-06 17:22:46 -05:00
pixmap.c Make PixmapDirtyUpdateRec::src a DrawablePtr 2017-08-15 17:01:39 +09:00
privates.c Use ARRAY_SIZE all over the tree 2017-10-30 13:45:20 -04:00
property.c dix: Add a callback chain for window property state change 2017-02-23 13:30:11 -05:00
protocol.txt
ptrveloc.c
region.c
registry.c
resource.c dix: Bump MAXHASHSIZE for the resource db [v2] 2016-10-28 09:28:32 -07:00
selection.c
stubmain.c
swaprep.c dispatch: Mark swapped dispatch as _X_COLD 2017-03-01 10:16:20 -05:00
swapreq.c dix: Disallow GenericEvent in SendEvent request. 2017-06-19 11:58:50 +10:00
tables.c
touch.c
window.c dix/window: fix typos 2017-11-06 16:46:32 -05:00