Bug Summary

File:Xi/xipassivegrab.c
Location:line 237, column 5
Description:Potential leak of memory pointed to by 'modifiers_failed'

Annotated Source Code

1/*
2 * Copyright © 2009 Red Hat, Inc.
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
21 * DEALINGS IN THE SOFTWARE.
22 *
23 * Author: Peter Hutterer
24 */
25
26/***********************************************************************
27 *
28 * Request to grab or ungrab input device.
29 *
30 */
31
32#ifdef HAVE_DIX_CONFIG_H1
33#include <dix-config.h>
34#endif
35
36#include "inputstr.h" /* DeviceIntPtr */
37#include "windowstr.h" /* window structure */
38#include <X11/extensions/XI2.h>
39#include <X11/extensions/XI2proto.h>
40#include "swaprep.h"
41
42#include "exglobals.h" /* BadDevice */
43#include "exevents.h"
44#include "xipassivegrab.h"
45#include "dixgrabs.h"
46#include "misc.h"
47#include "inpututils.h"
48
49int
50SProcXIPassiveGrabDevice(ClientPtr client)
51{
52 int i;
53 uint32_t *mods;
54
55 REQUEST(xXIPassiveGrabDeviceReq)xXIPassiveGrabDeviceReq *stuff = (xXIPassiveGrabDeviceReq *)client
->requestBuffer
;
56 REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq)if ((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client->
req_len ) return(16)
;
57
58 swaps(&stuff->length)do { if (sizeof(*(&stuff->length)) != 2) wrong_size();
if (__builtin_constant_p((uintptr_t)(&stuff->length) &
1) && ((uintptr_t)(&stuff->length) & 1) ==
0) *(&stuff->length) = lswaps(*(&stuff->length
)); else swap_uint16((uint16_t *)(&stuff->length)); } while
(0)
;
59 swaps(&stuff->deviceid)do { if (sizeof(*(&stuff->deviceid)) != 2) wrong_size(
); if (__builtin_constant_p((uintptr_t)(&stuff->deviceid
) & 1) && ((uintptr_t)(&stuff->deviceid) &
1) == 0) *(&stuff->deviceid) = lswaps(*(&stuff->
deviceid)); else swap_uint16((uint16_t *)(&stuff->deviceid
)); } while (0)
;
60 swapl(&stuff->grab_window)do { if (sizeof(*(&stuff->grab_window)) != 4) wrong_size
(); if (__builtin_constant_p((uintptr_t)(&stuff->grab_window
) & 3) && ((uintptr_t)(&stuff->grab_window
) & 3) == 0) *(&stuff->grab_window) = lswapl(*(&
stuff->grab_window)); else swap_uint32((uint32_t *)(&stuff
->grab_window)); } while (0)
;
61 swapl(&stuff->cursor)do { if (sizeof(*(&stuff->cursor)) != 4) wrong_size();
if (__builtin_constant_p((uintptr_t)(&stuff->cursor) &
3) && ((uintptr_t)(&stuff->cursor) & 3) ==
0) *(&stuff->cursor) = lswapl(*(&stuff->cursor
)); else swap_uint32((uint32_t *)(&stuff->cursor)); } while
(0)
;
62 swapl(&stuff->time)do { if (sizeof(*(&stuff->time)) != 4) wrong_size(); if
(__builtin_constant_p((uintptr_t)(&stuff->time) &
3) && ((uintptr_t)(&stuff->time) & 3) == 0
) *(&stuff->time) = lswapl(*(&stuff->time)); else
swap_uint32((uint32_t *)(&stuff->time)); } while (0)
;
63 swapl(&stuff->detail)do { if (sizeof(*(&stuff->detail)) != 4) wrong_size();
if (__builtin_constant_p((uintptr_t)(&stuff->detail) &
3) && ((uintptr_t)(&stuff->detail) & 3) ==
0) *(&stuff->detail) = lswapl(*(&stuff->detail
)); else swap_uint32((uint32_t *)(&stuff->detail)); } while
(0)
;
64 swaps(&stuff->mask_len)do { if (sizeof(*(&stuff->mask_len)) != 2) wrong_size(
); if (__builtin_constant_p((uintptr_t)(&stuff->mask_len
) & 1) && ((uintptr_t)(&stuff->mask_len) &
1) == 0) *(&stuff->mask_len) = lswaps(*(&stuff->
mask_len)); else swap_uint16((uint16_t *)(&stuff->mask_len
)); } while (0)
;
65 swaps(&stuff->num_modifiers)do { if (sizeof(*(&stuff->num_modifiers)) != 2) wrong_size
(); if (__builtin_constant_p((uintptr_t)(&stuff->num_modifiers
) & 1) && ((uintptr_t)(&stuff->num_modifiers
) & 1) == 0) *(&stuff->num_modifiers) = lswaps(*(&
stuff->num_modifiers)); else swap_uint16((uint16_t *)(&
stuff->num_modifiers)); } while (0)
;
66
67 REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->mask_len + stuff->
num_modifiers) *4) >> 2) >= client->req_len) || (
(((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff
->mask_len + stuff->num_modifiers) *4) + 3) >> 2)
!= (uint64_t) client->req_len)) return(16)
68 ((uint32_t) stuff->mask_len + stuff->num_modifiers) *4)if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->mask_len + stuff->
num_modifiers) *4) >> 2) >= client->req_len) || (
(((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff
->mask_len + stuff->num_modifiers) *4) + 3) >> 2)
!= (uint64_t) client->req_len)) return(16)
;
69 mods = (uint32_t *) &stuff[1] + stuff->mask_len;
70
71 for (i = 0; i < stuff->num_modifiers; i++, mods++) {
72 swapl(mods)do { if (sizeof(*(mods)) != 4) wrong_size(); if (__builtin_constant_p
((uintptr_t)(mods) & 3) && ((uintptr_t)(mods) &
3) == 0) *(mods) = lswapl(*(mods)); else swap_uint32((uint32_t
*)(mods)); } while (0)
;
73 }
74
75 return ProcXIPassiveGrabDevice(client);
76}
77
78int
79ProcXIPassiveGrabDevice(ClientPtr client)
80{
81 DeviceIntPtr dev, mod_dev;
82 xXIPassiveGrabDeviceReply rep = {
83 .repType = X_Reply1,
84 .RepType = X_XIPassiveGrabDevice54,
85 .sequenceNumber = client->sequence,
86 .length = 0,
87 .num_modifiers = 0
88 };
89 int i, ret = Success0;
90 uint32_t *modifiers;
91 xXIGrabModifierInfo *modifiers_failed;
92 GrabMask mask = { 0 };
93 GrabParameters param;
94 void *tmp;
95 int mask_len;
96
97 REQUEST(xXIPassiveGrabDeviceReq)xXIPassiveGrabDeviceReq *stuff = (xXIPassiveGrabDeviceReq *)client
->requestBuffer
;
98 REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->mask_len + stuff->
num_modifiers) * 4) >> 2) >= client->req_len) || (
(((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff
->mask_len + stuff->num_modifiers) * 4) + 3) >> 2
) != (uint64_t) client->req_len)) return(16)
99 ((uint32_t) stuff->mask_len + stuff->num_modifiers) * 4)if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->mask_len + stuff->
num_modifiers) * 4) >> 2) >= client->req_len) || (
(((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff
->mask_len + stuff->num_modifiers) * 4) + 3) >> 2
) != (uint64_t) client->req_len)) return(16)
;
100
101 if (stuff->deviceid == XIAllDevices0)
1
Taking false branch
102 dev = inputInfo.all_devices;
103 else if (stuff->deviceid == XIAllMasterDevices1)
2
Taking false branch
104 dev = inputInfo.all_master_devices;
105 else {
106 ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess(1<<17));
107 if (ret != Success0) {
3
Assuming 'ret' is equal to 0
4
Taking false branch
108 client->errorValue = stuff->deviceid;
109 return ret;
110 }
111 }
112
113 if (stuff->grab_type != XIGrabtypeButton0 &&
114 stuff->grab_type != XIGrabtypeKeycode1 &&
115 stuff->grab_type != XIGrabtypeEnter2 &&
116 stuff->grab_type != XIGrabtypeFocusIn3 &&
117 stuff->grab_type != XIGrabtypeTouchBegin4) {
118 client->errorValue = stuff->grab_type;
119 return BadValue2;
120 }
121
122 if ((stuff->grab_type == XIGrabtypeEnter2 ||
123 stuff->grab_type == XIGrabtypeFocusIn3 ||
124 stuff->grab_type == XIGrabtypeTouchBegin4) && stuff->detail != 0) {
125 client->errorValue = stuff->detail;
126 return BadValue2;
127 }
128
129 if (stuff->grab_type == XIGrabtypeTouchBegin4 &&
130 (stuff->grab_mode != XIGrabModeTouch2 ||
131 stuff->paired_device_mode != GrabModeAsync1)) {
132 client->errorValue = stuff->grab_mode;
133 return BadValue2;
134 }
135
136 if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1],
5
Taking false branch
137 stuff->mask_len * 4) != Success0)
138 return BadValue2;
139
140 mask.xi2mask = xi2mask_new();
141 if (!mask.xi2mask)
6
Taking false branch
142 return BadAlloc11;
143
144 mask_len = min(xi2mask_mask_size(mask.xi2mask), stuff->mask_len * 4)(((xi2mask_mask_size(mask.xi2mask)) < (stuff->mask_len *
4)) ? (xi2mask_mask_size(mask.xi2mask)) : (stuff->mask_len
* 4))
;
145 xi2mask_set_one_mask(mask.xi2mask, stuff->deviceid,
146 (unsigned char *) &stuff[1], mask_len * 4);
147
148 memset(&param, 0, sizeof(param))__builtin___memset_chk (&param, 0, sizeof(param), __builtin_object_size
(&param, 0))
;
149 param.grabtype = XI2;
150 param.ownerEvents = stuff->owner_events;
151 param.grabWindow = stuff->grab_window;
152 param.cursor = stuff->cursor;
153
154 if (IsKeyboardDevice(dev)) {
7
Taking false branch
155 param.this_device_mode = stuff->grab_mode;
156 param.other_devices_mode = stuff->paired_device_mode;
157 }
158 else {
159 param.this_device_mode = stuff->paired_device_mode;
160 param.other_devices_mode = stuff->grab_mode;
161 }
162
163 if (stuff->cursor != None0L) {
8
Taking false branch
164 ret = dixLookupResourceByType(&tmp, stuff->cursor,
165 RT_CURSOR((RESTYPE)5), client, DixUseAccess(1<<24));
166 if (ret != Success0) {
167 client->errorValue = stuff->cursor;
168 goto out;
169 }
170 }
171
172 ret =
173 dixLookupWindow((WindowPtr *) &tmp, stuff->grab_window, client,
174 DixSetAttrAccess(1<<5));
175 if (ret != Success0)
9
Assuming 'ret' is equal to 0
10
Taking false branch
176 goto out;
177
178 ret = CheckGrabValues(client, &param);
179 if (ret != Success0)
11
Assuming 'ret' is equal to 0
12
Taking false branch
180 goto out;
181
182 modifiers = (uint32_t *) &stuff[1] + stuff->mask_len;
183 modifiers_failed =
184 calloc(stuff->num_modifiers, sizeof(xXIGrabModifierInfo));
13
Memory is allocated
185 if (!modifiers_failed) {
14
Assuming 'modifiers_failed' is non-null
15
Taking false branch
186 ret = BadAlloc11;
187 goto out;
188 }
189
190 mod_dev = (IsFloating(dev)) ? dev : GetMaster(dev, MASTER_KEYBOARD2);
16
'?' condition is true
191
192 for (i = 0; i < stuff->num_modifiers; i++, modifiers++) {
17
Loop condition is true. Entering loop body
193 uint8_t status = Success0;
194
195 param.modifiers = *modifiers;
196 ret = CheckGrabValues(client, &param);
197 if (ret != Success0)
18
Assuming 'ret' is not equal to 0
19
Taking true branch
198 goto out;
20
Control jumps to line 237
199
200 switch (stuff->grab_type) {
201 case XIGrabtypeButton0:
202 status = GrabButton(client, dev, mod_dev, stuff->detail,
203 &param, XI2, &mask);
204 break;
205 case XIGrabtypeKeycode1:
206 status = GrabKey(client, dev, mod_dev, stuff->detail,
207 &param, XI2, &mask);
208 break;
209 case XIGrabtypeEnter2:
210 case XIGrabtypeFocusIn3:
211 status = GrabWindow(client, dev, stuff->grab_type, &param, &mask);
212 break;
213 case XIGrabtypeTouchBegin4:
214 status = GrabTouch(client, dev, mod_dev, &param, &mask);
215 break;
216 }
217
218 if (status != GrabSuccess0) {
219 xXIGrabModifierInfo *info = modifiers_failed + rep.num_modifiers;
220
221 info->status = status;
222 info->modifiers = *modifiers;
223 if (client->swapped)
224 swapl(&info->modifiers)do { if (sizeof(*(&info->modifiers)) != 4) wrong_size(
); if (__builtin_constant_p((uintptr_t)(&info->modifiers
) & 3) && ((uintptr_t)(&info->modifiers) &
3) == 0) *(&info->modifiers) = lswapl(*(&info->
modifiers)); else swap_uint32((uint32_t *)(&info->modifiers
)); } while (0)
;
225
226 rep.num_modifiers++;
227 rep.length += bytes_to_int32(sizeof(xXIGrabModifierInfo));
228 }
229 }
230
231 WriteReplyToClient(client, sizeof(rep), &rep){ if ((client)->swapped) (*ReplySwapVector[((xReq *)(client
)->requestBuffer)->reqType]) (client, (int)(sizeof(rep)
), &rep); else WriteToClient(client, (int)(sizeof(rep)), (
&rep)); }
;
232 if (rep.num_modifiers)
233 WriteToClient(client, rep.length * 4, modifiers_failed);
234
235 free(modifiers_failed);
236 out:
237 xi2mask_free(&mask.xi2mask);
21
Potential leak of memory pointed to by 'modifiers_failed'
238 return ret;
239}
240
241void
242SRepXIPassiveGrabDevice(ClientPtr client, int size,
243 xXIPassiveGrabDeviceReply * rep)
244{
245 swaps(&rep->sequenceNumber)do { if (sizeof(*(&rep->sequenceNumber)) != 2) wrong_size
(); if (__builtin_constant_p((uintptr_t)(&rep->sequenceNumber
) & 1) && ((uintptr_t)(&rep->sequenceNumber
) & 1) == 0) *(&rep->sequenceNumber) = lswaps(*(&
rep->sequenceNumber)); else swap_uint16((uint16_t *)(&
rep->sequenceNumber)); } while (0)
;
246 swapl(&rep->length)do { if (sizeof(*(&rep->length)) != 4) wrong_size(); if
(__builtin_constant_p((uintptr_t)(&rep->length) &
3) && ((uintptr_t)(&rep->length) & 3) == 0
) *(&rep->length) = lswapl(*(&rep->length)); else
swap_uint32((uint32_t *)(&rep->length)); } while (0)
;
247 swaps(&rep->num_modifiers)do { if (sizeof(*(&rep->num_modifiers)) != 2) wrong_size
(); if (__builtin_constant_p((uintptr_t)(&rep->num_modifiers
) & 1) && ((uintptr_t)(&rep->num_modifiers
) & 1) == 0) *(&rep->num_modifiers) = lswaps(*(&
rep->num_modifiers)); else swap_uint16((uint16_t *)(&rep
->num_modifiers)); } while (0)
;
248
249 WriteToClient(client, size, rep);
250}
251
252int
253SProcXIPassiveUngrabDevice(ClientPtr client)
254{
255 int i;
256 uint32_t *modifiers;
257
258 REQUEST(xXIPassiveUngrabDeviceReq)xXIPassiveUngrabDeviceReq *stuff = (xXIPassiveUngrabDeviceReq
*)client->requestBuffer
;
259 REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq)if ((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client
->req_len ) return(16)
;
260
261 swaps(&stuff->length)do { if (sizeof(*(&stuff->length)) != 2) wrong_size();
if (__builtin_constant_p((uintptr_t)(&stuff->length) &
1) && ((uintptr_t)(&stuff->length) & 1) ==
0) *(&stuff->length) = lswaps(*(&stuff->length
)); else swap_uint16((uint16_t *)(&stuff->length)); } while
(0)
;
262 swapl(&stuff->grab_window)do { if (sizeof(*(&stuff->grab_window)) != 4) wrong_size
(); if (__builtin_constant_p((uintptr_t)(&stuff->grab_window
) & 3) && ((uintptr_t)(&stuff->grab_window
) & 3) == 0) *(&stuff->grab_window) = lswapl(*(&
stuff->grab_window)); else swap_uint32((uint32_t *)(&stuff
->grab_window)); } while (0)
;
263 swaps(&stuff->deviceid)do { if (sizeof(*(&stuff->deviceid)) != 2) wrong_size(
); if (__builtin_constant_p((uintptr_t)(&stuff->deviceid
) & 1) && ((uintptr_t)(&stuff->deviceid) &
1) == 0) *(&stuff->deviceid) = lswaps(*(&stuff->
deviceid)); else swap_uint16((uint16_t *)(&stuff->deviceid
)); } while (0)
;
264 swapl(&stuff->detail)do { if (sizeof(*(&stuff->detail)) != 4) wrong_size();
if (__builtin_constant_p((uintptr_t)(&stuff->detail) &
3) && ((uintptr_t)(&stuff->detail) & 3) ==
0) *(&stuff->detail) = lswapl(*(&stuff->detail
)); else swap_uint32((uint32_t *)(&stuff->detail)); } while
(0)
;
265 swaps(&stuff->num_modifiers)do { if (sizeof(*(&stuff->num_modifiers)) != 2) wrong_size
(); if (__builtin_constant_p((uintptr_t)(&stuff->num_modifiers
) & 1) && ((uintptr_t)(&stuff->num_modifiers
) & 1) == 0) *(&stuff->num_modifiers) = lswaps(*(&
stuff->num_modifiers)); else swap_uint16((uint16_t *)(&
stuff->num_modifiers)); } while (0)
;
266
267 REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->num_modifiers) <<
2) >> 2) >= client->req_len) || ((((uint64_t) sizeof
(xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers
) << 2) + 3) >> 2) != (uint64_t) client->req_len
)) return(16)
268 ((uint32_t) stuff->num_modifiers) << 2)if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->num_modifiers) <<
2) >> 2) >= client->req_len) || ((((uint64_t) sizeof
(xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers
) << 2) + 3) >> 2) != (uint64_t) client->req_len
)) return(16)
;
269 modifiers = (uint32_t *) &stuff[1];
270
271 for (i = 0; i < stuff->num_modifiers; i++, modifiers++)
272 swapl(modifiers)do { if (sizeof(*(modifiers)) != 4) wrong_size(); if (__builtin_constant_p
((uintptr_t)(modifiers) & 3) && ((uintptr_t)(modifiers
) & 3) == 0) *(modifiers) = lswapl(*(modifiers)); else swap_uint32
((uint32_t *)(modifiers)); } while (0)
;
273
274 return ProcXIPassiveUngrabDevice(client);
275}
276
277int
278ProcXIPassiveUngrabDevice(ClientPtr client)
279{
280 DeviceIntPtr dev, mod_dev;
281 WindowPtr win;
282 GrabPtr tempGrab;
283 uint32_t *modifiers;
284 int i, rc;
285
286 REQUEST(xXIPassiveUngrabDeviceReq)xXIPassiveUngrabDeviceReq *stuff = (xXIPassiveUngrabDeviceReq
*)client->requestBuffer
;
287 REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->num_modifiers) <<
2) >> 2) >= client->req_len) || ((((uint64_t) sizeof
(xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers
) << 2) + 3) >> 2) != (uint64_t) client->req_len
)) return(16)
288 ((uint32_t) stuff->num_modifiers) << 2)if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client
->req_len) || (((((uint32_t) stuff->num_modifiers) <<
2) >> 2) >= client->req_len) || ((((uint64_t) sizeof
(xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers
) << 2) + 3) >> 2) != (uint64_t) client->req_len
)) return(16)
;
289
290 if (stuff->deviceid == XIAllDevices0)
291 dev = inputInfo.all_devices;
292 else if (stuff->deviceid == XIAllMasterDevices1)
293 dev = inputInfo.all_master_devices;
294 else {
295 rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess(1<<17));
296 if (rc != Success0)
297 return rc;
298 }
299
300 if (stuff->grab_type != XIGrabtypeButton0 &&
301 stuff->grab_type != XIGrabtypeKeycode1 &&
302 stuff->grab_type != XIGrabtypeEnter2 &&
303 stuff->grab_type != XIGrabtypeFocusIn3 &&
304 stuff->grab_type != XIGrabtypeTouchBegin4) {
305 client->errorValue = stuff->grab_type;
306 return BadValue2;
307 }
308
309 if ((stuff->grab_type == XIGrabtypeEnter2 ||
310 stuff->grab_type == XIGrabtypeFocusIn3 ||
311 stuff->grab_type == XIGrabtypeTouchBegin4) && stuff->detail != 0) {
312 client->errorValue = stuff->detail;
313 return BadValue2;
314 }
315
316 rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess(1<<5));
317 if (rc != Success0)
318 return rc;
319
320 mod_dev = (IsFloating(dev)) ? dev : GetMaster(dev, MASTER_KEYBOARD2);
321
322 tempGrab = AllocGrab(NULL((void*)0));
323 if (!tempGrab)
324 return BadAlloc11;
325
326 tempGrab->resource = client->clientAsMask;
327 tempGrab->device = dev;
328 tempGrab->window = win;
329 switch (stuff->grab_type) {
330 case XIGrabtypeButton0:
331 tempGrab->type = XI_ButtonPress4;
332 break;
333 case XIGrabtypeKeycode1:
334 tempGrab->type = XI_KeyPress2;
335 break;
336 case XIGrabtypeEnter2:
337 tempGrab->type = XI_Enter7;
338 break;
339 case XIGrabtypeFocusIn3:
340 tempGrab->type = XI_FocusIn9;
341 break;
342 case XIGrabtypeTouchBegin4:
343 tempGrab->type = XI_TouchBegin18;
344 break;
345 }
346 tempGrab->grabtype = XI2;
347 tempGrab->modifierDevice = mod_dev;
348 tempGrab->modifiersDetail.pMask = NULL((void*)0);
349 tempGrab->detail.exact = stuff->detail;
350 tempGrab->detail.pMask = NULL((void*)0);
351
352 modifiers = (uint32_t *) &stuff[1];
353
354 for (i = 0; i < stuff->num_modifiers; i++, modifiers++) {
355 tempGrab->modifiersDetail.exact = *modifiers;
356 DeletePassiveGrabFromList(tempGrab);
357 }
358
359 FreeGrab(tempGrab);
360
361 return Success0;
362}