File: | Xi/xipassivegrab.c |
Location: | line 237, column 5 |
Description: | Potential leak of memory pointed to by 'info' |
1 | /* | |||
2 | * Copyright © 2009 Red Hat, Inc. | |||
3 | * | |||
4 | * Permission is hereby granted, free of charge, to any person obtaining a | |||
5 | * copy of this software and associated documentation files (the "Software"), | |||
6 | * to deal in the Software without restriction, including without limitation | |||
7 | * the rights to use, copy, modify, merge, publish, distribute, sublicense, | |||
8 | * and/or sell copies of the Software, and to permit persons to whom the | |||
9 | * Software is furnished to do so, subject to the following conditions: | |||
10 | * | |||
11 | * The above copyright notice and this permission notice (including the next | |||
12 | * paragraph) shall be included in all copies or substantial portions of the | |||
13 | * Software. | |||
14 | * | |||
15 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |||
16 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |||
17 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL | |||
18 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |||
19 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING | |||
20 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER | |||
21 | * DEALINGS IN THE SOFTWARE. | |||
22 | * | |||
23 | * Author: Peter Hutterer | |||
24 | */ | |||
25 | ||||
26 | /*********************************************************************** | |||
27 | * | |||
28 | * Request to grab or ungrab input device. | |||
29 | * | |||
30 | */ | |||
31 | ||||
32 | #ifdef HAVE_DIX_CONFIG_H1 | |||
33 | #include <dix-config.h> | |||
34 | #endif | |||
35 | ||||
36 | #include "inputstr.h" /* DeviceIntPtr */ | |||
37 | #include "windowstr.h" /* window structure */ | |||
38 | #include <X11/extensions/XI2.h> | |||
39 | #include <X11/extensions/XI2proto.h> | |||
40 | #include "swaprep.h" | |||
41 | ||||
42 | #include "exglobals.h" /* BadDevice */ | |||
43 | #include "exevents.h" | |||
44 | #include "xipassivegrab.h" | |||
45 | #include "dixgrabs.h" | |||
46 | #include "misc.h" | |||
47 | #include "inpututils.h" | |||
48 | ||||
49 | int | |||
50 | SProcXIPassiveGrabDevice(ClientPtr client) | |||
51 | { | |||
52 | int i; | |||
53 | uint32_t *mods; | |||
54 | ||||
55 | REQUEST(xXIPassiveGrabDeviceReq)xXIPassiveGrabDeviceReq *stuff = (xXIPassiveGrabDeviceReq *)client ->requestBuffer; | |||
56 | REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq)if ((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client-> req_len ) return(16); | |||
57 | ||||
58 | swaps(&stuff->length)do { if (sizeof(*(&stuff->length)) != 2) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->length) & 1) && ((uintptr_t)(&stuff->length) & 1) == 0) *(&stuff->length) = lswaps(*(&stuff->length )); else swap_uint16((uint16_t *)(&stuff->length)); } while (0); | |||
59 | swaps(&stuff->deviceid)do { if (sizeof(*(&stuff->deviceid)) != 2) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&stuff->deviceid ) & 1) && ((uintptr_t)(&stuff->deviceid) & 1) == 0) *(&stuff->deviceid) = lswaps(*(&stuff-> deviceid)); else swap_uint16((uint16_t *)(&stuff->deviceid )); } while (0); | |||
60 | swapl(&stuff->grab_window)do { if (sizeof(*(&stuff->grab_window)) != 4) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->grab_window ) & 3) && ((uintptr_t)(&stuff->grab_window ) & 3) == 0) *(&stuff->grab_window) = lswapl(*(& stuff->grab_window)); else swap_uint32((uint32_t *)(&stuff ->grab_window)); } while (0); | |||
61 | swapl(&stuff->cursor)do { if (sizeof(*(&stuff->cursor)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->cursor) & 3) && ((uintptr_t)(&stuff->cursor) & 3) == 0) *(&stuff->cursor) = lswapl(*(&stuff->cursor )); else swap_uint32((uint32_t *)(&stuff->cursor)); } while (0); | |||
62 | swapl(&stuff->time)do { if (sizeof(*(&stuff->time)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->time) & 3) && ((uintptr_t)(&stuff->time) & 3) == 0 ) *(&stuff->time) = lswapl(*(&stuff->time)); else swap_uint32((uint32_t *)(&stuff->time)); } while (0); | |||
63 | swapl(&stuff->detail)do { if (sizeof(*(&stuff->detail)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->detail) & 3) && ((uintptr_t)(&stuff->detail) & 3) == 0) *(&stuff->detail) = lswapl(*(&stuff->detail )); else swap_uint32((uint32_t *)(&stuff->detail)); } while (0); | |||
64 | swaps(&stuff->mask_len)do { if (sizeof(*(&stuff->mask_len)) != 2) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&stuff->mask_len ) & 1) && ((uintptr_t)(&stuff->mask_len) & 1) == 0) *(&stuff->mask_len) = lswaps(*(&stuff-> mask_len)); else swap_uint16((uint16_t *)(&stuff->mask_len )); } while (0); | |||
65 | swaps(&stuff->num_modifiers)do { if (sizeof(*(&stuff->num_modifiers)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->num_modifiers ) & 1) && ((uintptr_t)(&stuff->num_modifiers ) & 1) == 0) *(&stuff->num_modifiers) = lswaps(*(& stuff->num_modifiers)); else swap_uint16((uint16_t *)(& stuff->num_modifiers)); } while (0); | |||
66 | ||||
67 | REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) *4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) *4) + 3) >> 2) != (uint64_t) client->req_len)) return(16) | |||
68 | ((uint32_t) stuff->mask_len + stuff->num_modifiers) *4)if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) *4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) *4) + 3) >> 2) != (uint64_t) client->req_len)) return(16); | |||
69 | mods = (uint32_t *) &stuff[1] + stuff->mask_len; | |||
70 | ||||
71 | for (i = 0; i < stuff->num_modifiers; i++, mods++) { | |||
72 | swapl(mods)do { if (sizeof(*(mods)) != 4) wrong_size(); if (__builtin_constant_p ((uintptr_t)(mods) & 3) && ((uintptr_t)(mods) & 3) == 0) *(mods) = lswapl(*(mods)); else swap_uint32((uint32_t *)(mods)); } while (0); | |||
73 | } | |||
74 | ||||
75 | return ProcXIPassiveGrabDevice(client); | |||
76 | } | |||
77 | ||||
78 | int | |||
79 | ProcXIPassiveGrabDevice(ClientPtr client) | |||
80 | { | |||
81 | DeviceIntPtr dev, mod_dev; | |||
82 | xXIPassiveGrabDeviceReply rep = { | |||
83 | .repType = X_Reply1, | |||
84 | .RepType = X_XIPassiveGrabDevice54, | |||
85 | .sequenceNumber = client->sequence, | |||
86 | .length = 0, | |||
87 | .num_modifiers = 0 | |||
88 | }; | |||
89 | int i, ret = Success0; | |||
90 | uint32_t *modifiers; | |||
91 | xXIGrabModifierInfo *modifiers_failed; | |||
92 | GrabMask mask = { 0 }; | |||
93 | GrabParameters param; | |||
94 | void *tmp; | |||
95 | int mask_len; | |||
96 | ||||
97 | REQUEST(xXIPassiveGrabDeviceReq)xXIPassiveGrabDeviceReq *stuff = (xXIPassiveGrabDeviceReq *)client ->requestBuffer; | |||
98 | REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) * 4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) * 4) + 3) >> 2 ) != (uint64_t) client->req_len)) return(16) | |||
99 | ((uint32_t) stuff->mask_len + stuff->num_modifiers) * 4)if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) * 4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) * 4) + 3) >> 2 ) != (uint64_t) client->req_len)) return(16); | |||
100 | ||||
101 | if (stuff->deviceid == XIAllDevices0) | |||
| ||||
102 | dev = inputInfo.all_devices; | |||
103 | else if (stuff->deviceid == XIAllMasterDevices1) | |||
104 | dev = inputInfo.all_master_devices; | |||
105 | else { | |||
106 | ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess(1<<17)); | |||
107 | if (ret != Success0) { | |||
108 | client->errorValue = stuff->deviceid; | |||
109 | return ret; | |||
110 | } | |||
111 | } | |||
112 | ||||
113 | if (stuff->grab_type != XIGrabtypeButton0 && | |||
114 | stuff->grab_type != XIGrabtypeKeycode1 && | |||
115 | stuff->grab_type != XIGrabtypeEnter2 && | |||
116 | stuff->grab_type != XIGrabtypeFocusIn3 && | |||
117 | stuff->grab_type != XIGrabtypeTouchBegin4) { | |||
118 | client->errorValue = stuff->grab_type; | |||
119 | return BadValue2; | |||
120 | } | |||
121 | ||||
122 | if ((stuff->grab_type == XIGrabtypeEnter2 || | |||
123 | stuff->grab_type == XIGrabtypeFocusIn3 || | |||
124 | stuff->grab_type == XIGrabtypeTouchBegin4) && stuff->detail != 0) { | |||
125 | client->errorValue = stuff->detail; | |||
126 | return BadValue2; | |||
127 | } | |||
128 | ||||
129 | if (stuff->grab_type == XIGrabtypeTouchBegin4 && | |||
130 | (stuff->grab_mode != XIGrabModeTouch2 || | |||
131 | stuff->paired_device_mode != GrabModeAsync1)) { | |||
132 | client->errorValue = stuff->grab_mode; | |||
133 | return BadValue2; | |||
134 | } | |||
135 | ||||
136 | if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1], | |||
137 | stuff->mask_len * 4) != Success0) | |||
138 | return BadValue2; | |||
139 | ||||
140 | mask.xi2mask = xi2mask_new(); | |||
141 | if (!mask.xi2mask) | |||
142 | return BadAlloc11; | |||
143 | ||||
144 | mask_len = min(xi2mask_mask_size(mask.xi2mask), stuff->mask_len * 4)(((xi2mask_mask_size(mask.xi2mask)) < (stuff->mask_len * 4)) ? (xi2mask_mask_size(mask.xi2mask)) : (stuff->mask_len * 4)); | |||
145 | xi2mask_set_one_mask(mask.xi2mask, stuff->deviceid, | |||
146 | (unsigned char *) &stuff[1], mask_len * 4); | |||
147 | ||||
148 | memset(¶m, 0, sizeof(param))__builtin___memset_chk (¶m, 0, sizeof(param), __builtin_object_size (¶m, 0)); | |||
149 | param.grabtype = XI2; | |||
150 | param.ownerEvents = stuff->owner_events; | |||
151 | param.grabWindow = stuff->grab_window; | |||
152 | param.cursor = stuff->cursor; | |||
153 | ||||
154 | if (IsKeyboardDevice(dev)) { | |||
155 | param.this_device_mode = stuff->grab_mode; | |||
156 | param.other_devices_mode = stuff->paired_device_mode; | |||
157 | } | |||
158 | else { | |||
159 | param.this_device_mode = stuff->paired_device_mode; | |||
160 | param.other_devices_mode = stuff->grab_mode; | |||
161 | } | |||
162 | ||||
163 | if (stuff->cursor != None0L) { | |||
164 | ret = dixLookupResourceByType(&tmp, stuff->cursor, | |||
165 | RT_CURSOR((RESTYPE)5), client, DixUseAccess(1<<24)); | |||
166 | if (ret != Success0) { | |||
167 | client->errorValue = stuff->cursor; | |||
168 | goto out; | |||
169 | } | |||
170 | } | |||
171 | ||||
172 | ret = | |||
173 | dixLookupWindow((WindowPtr *) &tmp, stuff->grab_window, client, | |||
174 | DixSetAttrAccess(1<<5)); | |||
175 | if (ret != Success0) | |||
176 | goto out; | |||
177 | ||||
178 | ret = CheckGrabValues(client, ¶m); | |||
179 | if (ret != Success0) | |||
180 | goto out; | |||
181 | ||||
182 | modifiers = (uint32_t *) &stuff[1] + stuff->mask_len; | |||
183 | modifiers_failed = | |||
184 | calloc(stuff->num_modifiers, sizeof(xXIGrabModifierInfo)); | |||
185 | if (!modifiers_failed) { | |||
186 | ret = BadAlloc11; | |||
187 | goto out; | |||
188 | } | |||
189 | ||||
190 | mod_dev = (IsFloating(dev)) ? dev : GetMaster(dev, MASTER_KEYBOARD2); | |||
191 | ||||
192 | for (i = 0; i < stuff->num_modifiers; i++, modifiers++) { | |||
193 | uint8_t status = Success0; | |||
194 | ||||
195 | param.modifiers = *modifiers; | |||
196 | ret = CheckGrabValues(client, ¶m); | |||
197 | if (ret != Success0) | |||
198 | goto out; | |||
199 | ||||
200 | switch (stuff->grab_type) { | |||
201 | case XIGrabtypeButton0: | |||
202 | status = GrabButton(client, dev, mod_dev, stuff->detail, | |||
203 | ¶m, XI2, &mask); | |||
204 | break; | |||
205 | case XIGrabtypeKeycode1: | |||
206 | status = GrabKey(client, dev, mod_dev, stuff->detail, | |||
207 | ¶m, XI2, &mask); | |||
208 | break; | |||
209 | case XIGrabtypeEnter2: | |||
210 | case XIGrabtypeFocusIn3: | |||
211 | status = GrabWindow(client, dev, stuff->grab_type, ¶m, &mask); | |||
212 | break; | |||
213 | case XIGrabtypeTouchBegin4: | |||
214 | status = GrabTouch(client, dev, mod_dev, ¶m, &mask); | |||
215 | break; | |||
216 | } | |||
217 | ||||
218 | if (status != GrabSuccess0) { | |||
219 | xXIGrabModifierInfo *info = modifiers_failed + rep.num_modifiers; | |||
220 | ||||
221 | info->status = status; | |||
222 | info->modifiers = *modifiers; | |||
223 | if (client->swapped) | |||
224 | swapl(&info->modifiers)do { if (sizeof(*(&info->modifiers)) != 4) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&info->modifiers ) & 3) && ((uintptr_t)(&info->modifiers) & 3) == 0) *(&info->modifiers) = lswapl(*(&info-> modifiers)); else swap_uint32((uint32_t *)(&info->modifiers )); } while (0); | |||
225 | ||||
226 | rep.num_modifiers++; | |||
227 | rep.length += bytes_to_int32(sizeof(xXIGrabModifierInfo)); | |||
228 | } | |||
229 | } | |||
230 | ||||
231 | WriteReplyToClient(client, sizeof(rep), &rep){ if ((client)->swapped) (*ReplySwapVector[((xReq *)(client )->requestBuffer)->reqType]) (client, (int)(sizeof(rep) ), &rep); else WriteToClient(client, (int)(sizeof(rep)), ( &rep)); }; | |||
232 | if (rep.num_modifiers) | |||
233 | WriteToClient(client, rep.length * 4, modifiers_failed); | |||
234 | ||||
235 | free(modifiers_failed); | |||
236 | out: | |||
237 | xi2mask_free(&mask.xi2mask); | |||
| ||||
238 | return ret; | |||
239 | } | |||
240 | ||||
241 | void | |||
242 | SRepXIPassiveGrabDevice(ClientPtr client, int size, | |||
243 | xXIPassiveGrabDeviceReply * rep) | |||
244 | { | |||
245 | swaps(&rep->sequenceNumber)do { if (sizeof(*(&rep->sequenceNumber)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&rep->sequenceNumber ) & 1) && ((uintptr_t)(&rep->sequenceNumber ) & 1) == 0) *(&rep->sequenceNumber) = lswaps(*(& rep->sequenceNumber)); else swap_uint16((uint16_t *)(& rep->sequenceNumber)); } while (0); | |||
246 | swapl(&rep->length)do { if (sizeof(*(&rep->length)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&rep->length) & 3) && ((uintptr_t)(&rep->length) & 3) == 0 ) *(&rep->length) = lswapl(*(&rep->length)); else swap_uint32((uint32_t *)(&rep->length)); } while (0); | |||
247 | swaps(&rep->num_modifiers)do { if (sizeof(*(&rep->num_modifiers)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&rep->num_modifiers ) & 1) && ((uintptr_t)(&rep->num_modifiers ) & 1) == 0) *(&rep->num_modifiers) = lswaps(*(& rep->num_modifiers)); else swap_uint16((uint16_t *)(&rep ->num_modifiers)); } while (0); | |||
248 | ||||
249 | WriteToClient(client, size, rep); | |||
250 | } | |||
251 | ||||
252 | int | |||
253 | SProcXIPassiveUngrabDevice(ClientPtr client) | |||
254 | { | |||
255 | int i; | |||
256 | uint32_t *modifiers; | |||
257 | ||||
258 | REQUEST(xXIPassiveUngrabDeviceReq)xXIPassiveUngrabDeviceReq *stuff = (xXIPassiveUngrabDeviceReq *)client->requestBuffer; | |||
259 | REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq)if ((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len ) return(16); | |||
260 | ||||
261 | swaps(&stuff->length)do { if (sizeof(*(&stuff->length)) != 2) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->length) & 1) && ((uintptr_t)(&stuff->length) & 1) == 0) *(&stuff->length) = lswaps(*(&stuff->length )); else swap_uint16((uint16_t *)(&stuff->length)); } while (0); | |||
262 | swapl(&stuff->grab_window)do { if (sizeof(*(&stuff->grab_window)) != 4) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->grab_window ) & 3) && ((uintptr_t)(&stuff->grab_window ) & 3) == 0) *(&stuff->grab_window) = lswapl(*(& stuff->grab_window)); else swap_uint32((uint32_t *)(&stuff ->grab_window)); } while (0); | |||
263 | swaps(&stuff->deviceid)do { if (sizeof(*(&stuff->deviceid)) != 2) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&stuff->deviceid ) & 1) && ((uintptr_t)(&stuff->deviceid) & 1) == 0) *(&stuff->deviceid) = lswaps(*(&stuff-> deviceid)); else swap_uint16((uint16_t *)(&stuff->deviceid )); } while (0); | |||
264 | swapl(&stuff->detail)do { if (sizeof(*(&stuff->detail)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->detail) & 3) && ((uintptr_t)(&stuff->detail) & 3) == 0) *(&stuff->detail) = lswapl(*(&stuff->detail )); else swap_uint32((uint32_t *)(&stuff->detail)); } while (0); | |||
265 | swaps(&stuff->num_modifiers)do { if (sizeof(*(&stuff->num_modifiers)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->num_modifiers ) & 1) && ((uintptr_t)(&stuff->num_modifiers ) & 1) == 0) *(&stuff->num_modifiers) = lswaps(*(& stuff->num_modifiers)); else swap_uint16((uint16_t *)(& stuff->num_modifiers)); } while (0); | |||
266 | ||||
267 | REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16) | |||
268 | ((uint32_t) stuff->num_modifiers) << 2)if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16); | |||
269 | modifiers = (uint32_t *) &stuff[1]; | |||
270 | ||||
271 | for (i = 0; i < stuff->num_modifiers; i++, modifiers++) | |||
272 | swapl(modifiers)do { if (sizeof(*(modifiers)) != 4) wrong_size(); if (__builtin_constant_p ((uintptr_t)(modifiers) & 3) && ((uintptr_t)(modifiers ) & 3) == 0) *(modifiers) = lswapl(*(modifiers)); else swap_uint32 ((uint32_t *)(modifiers)); } while (0); | |||
273 | ||||
274 | return ProcXIPassiveUngrabDevice(client); | |||
275 | } | |||
276 | ||||
277 | int | |||
278 | ProcXIPassiveUngrabDevice(ClientPtr client) | |||
279 | { | |||
280 | DeviceIntPtr dev, mod_dev; | |||
281 | WindowPtr win; | |||
282 | GrabPtr tempGrab; | |||
283 | uint32_t *modifiers; | |||
284 | int i, rc; | |||
285 | ||||
286 | REQUEST(xXIPassiveUngrabDeviceReq)xXIPassiveUngrabDeviceReq *stuff = (xXIPassiveUngrabDeviceReq *)client->requestBuffer; | |||
287 | REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16) | |||
288 | ((uint32_t) stuff->num_modifiers) << 2)if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16); | |||
289 | ||||
290 | if (stuff->deviceid == XIAllDevices0) | |||
291 | dev = inputInfo.all_devices; | |||
292 | else if (stuff->deviceid == XIAllMasterDevices1) | |||
293 | dev = inputInfo.all_master_devices; | |||
294 | else { | |||
295 | rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess(1<<17)); | |||
296 | if (rc != Success0) | |||
297 | return rc; | |||
298 | } | |||
299 | ||||
300 | if (stuff->grab_type != XIGrabtypeButton0 && | |||
301 | stuff->grab_type != XIGrabtypeKeycode1 && | |||
302 | stuff->grab_type != XIGrabtypeEnter2 && | |||
303 | stuff->grab_type != XIGrabtypeFocusIn3 && | |||
304 | stuff->grab_type != XIGrabtypeTouchBegin4) { | |||
305 | client->errorValue = stuff->grab_type; | |||
306 | return BadValue2; | |||
307 | } | |||
308 | ||||
309 | if ((stuff->grab_type == XIGrabtypeEnter2 || | |||
310 | stuff->grab_type == XIGrabtypeFocusIn3 || | |||
311 | stuff->grab_type == XIGrabtypeTouchBegin4) && stuff->detail != 0) { | |||
312 | client->errorValue = stuff->detail; | |||
313 | return BadValue2; | |||
314 | } | |||
315 | ||||
316 | rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess(1<<5)); | |||
317 | if (rc != Success0) | |||
318 | return rc; | |||
319 | ||||
320 | mod_dev = (IsFloating(dev)) ? dev : GetMaster(dev, MASTER_KEYBOARD2); | |||
321 | ||||
322 | tempGrab = AllocGrab(NULL((void*)0)); | |||
323 | if (!tempGrab) | |||
324 | return BadAlloc11; | |||
325 | ||||
326 | tempGrab->resource = client->clientAsMask; | |||
327 | tempGrab->device = dev; | |||
328 | tempGrab->window = win; | |||
329 | switch (stuff->grab_type) { | |||
330 | case XIGrabtypeButton0: | |||
331 | tempGrab->type = XI_ButtonPress4; | |||
332 | break; | |||
333 | case XIGrabtypeKeycode1: | |||
334 | tempGrab->type = XI_KeyPress2; | |||
335 | break; | |||
336 | case XIGrabtypeEnter2: | |||
337 | tempGrab->type = XI_Enter7; | |||
338 | break; | |||
339 | case XIGrabtypeFocusIn3: | |||
340 | tempGrab->type = XI_FocusIn9; | |||
341 | break; | |||
342 | case XIGrabtypeTouchBegin4: | |||
343 | tempGrab->type = XI_TouchBegin18; | |||
344 | break; | |||
345 | } | |||
346 | tempGrab->grabtype = XI2; | |||
347 | tempGrab->modifierDevice = mod_dev; | |||
348 | tempGrab->modifiersDetail.pMask = NULL((void*)0); | |||
349 | tempGrab->detail.exact = stuff->detail; | |||
350 | tempGrab->detail.pMask = NULL((void*)0); | |||
351 | ||||
352 | modifiers = (uint32_t *) &stuff[1]; | |||
353 | ||||
354 | for (i = 0; i < stuff->num_modifiers; i++, modifiers++) { | |||
355 | tempGrab->modifiersDetail.exact = *modifiers; | |||
356 | DeletePassiveGrabFromList(tempGrab); | |||
357 | } | |||
358 | ||||
359 | FreeGrab(tempGrab); | |||
360 | ||||
361 | return Success0; | |||
362 | } |