| File: | Xi/xipassivegrab.c |
| Location: | line 237, column 5 |
| Description: | Potential leak of memory pointed to by 'info' |
| 1 | /* | |||
| 2 | * Copyright © 2009 Red Hat, Inc. | |||
| 3 | * | |||
| 4 | * Permission is hereby granted, free of charge, to any person obtaining a | |||
| 5 | * copy of this software and associated documentation files (the "Software"), | |||
| 6 | * to deal in the Software without restriction, including without limitation | |||
| 7 | * the rights to use, copy, modify, merge, publish, distribute, sublicense, | |||
| 8 | * and/or sell copies of the Software, and to permit persons to whom the | |||
| 9 | * Software is furnished to do so, subject to the following conditions: | |||
| 10 | * | |||
| 11 | * The above copyright notice and this permission notice (including the next | |||
| 12 | * paragraph) shall be included in all copies or substantial portions of the | |||
| 13 | * Software. | |||
| 14 | * | |||
| 15 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |||
| 16 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |||
| 17 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL | |||
| 18 | * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |||
| 19 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING | |||
| 20 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER | |||
| 21 | * DEALINGS IN THE SOFTWARE. | |||
| 22 | * | |||
| 23 | * Author: Peter Hutterer | |||
| 24 | */ | |||
| 25 | ||||
| 26 | /*********************************************************************** | |||
| 27 | * | |||
| 28 | * Request to grab or ungrab input device. | |||
| 29 | * | |||
| 30 | */ | |||
| 31 | ||||
| 32 | #ifdef HAVE_DIX_CONFIG_H1 | |||
| 33 | #include <dix-config.h> | |||
| 34 | #endif | |||
| 35 | ||||
| 36 | #include "inputstr.h" /* DeviceIntPtr */ | |||
| 37 | #include "windowstr.h" /* window structure */ | |||
| 38 | #include <X11/extensions/XI2.h> | |||
| 39 | #include <X11/extensions/XI2proto.h> | |||
| 40 | #include "swaprep.h" | |||
| 41 | ||||
| 42 | #include "exglobals.h" /* BadDevice */ | |||
| 43 | #include "exevents.h" | |||
| 44 | #include "xipassivegrab.h" | |||
| 45 | #include "dixgrabs.h" | |||
| 46 | #include "misc.h" | |||
| 47 | #include "inpututils.h" | |||
| 48 | ||||
| 49 | int | |||
| 50 | SProcXIPassiveGrabDevice(ClientPtr client) | |||
| 51 | { | |||
| 52 | int i; | |||
| 53 | uint32_t *mods; | |||
| 54 | ||||
| 55 | REQUEST(xXIPassiveGrabDeviceReq)xXIPassiveGrabDeviceReq *stuff = (xXIPassiveGrabDeviceReq *)client ->requestBuffer; | |||
| 56 | REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq)if ((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client-> req_len ) return(16); | |||
| 57 | ||||
| 58 | swaps(&stuff->length)do { if (sizeof(*(&stuff->length)) != 2) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->length) & 1) && ((uintptr_t)(&stuff->length) & 1) == 0) *(&stuff->length) = lswaps(*(&stuff->length )); else swap_uint16((uint16_t *)(&stuff->length)); } while (0); | |||
| 59 | swaps(&stuff->deviceid)do { if (sizeof(*(&stuff->deviceid)) != 2) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&stuff->deviceid ) & 1) && ((uintptr_t)(&stuff->deviceid) & 1) == 0) *(&stuff->deviceid) = lswaps(*(&stuff-> deviceid)); else swap_uint16((uint16_t *)(&stuff->deviceid )); } while (0); | |||
| 60 | swapl(&stuff->grab_window)do { if (sizeof(*(&stuff->grab_window)) != 4) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->grab_window ) & 3) && ((uintptr_t)(&stuff->grab_window ) & 3) == 0) *(&stuff->grab_window) = lswapl(*(& stuff->grab_window)); else swap_uint32((uint32_t *)(&stuff ->grab_window)); } while (0); | |||
| 61 | swapl(&stuff->cursor)do { if (sizeof(*(&stuff->cursor)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->cursor) & 3) && ((uintptr_t)(&stuff->cursor) & 3) == 0) *(&stuff->cursor) = lswapl(*(&stuff->cursor )); else swap_uint32((uint32_t *)(&stuff->cursor)); } while (0); | |||
| 62 | swapl(&stuff->time)do { if (sizeof(*(&stuff->time)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->time) & 3) && ((uintptr_t)(&stuff->time) & 3) == 0 ) *(&stuff->time) = lswapl(*(&stuff->time)); else swap_uint32((uint32_t *)(&stuff->time)); } while (0); | |||
| 63 | swapl(&stuff->detail)do { if (sizeof(*(&stuff->detail)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->detail) & 3) && ((uintptr_t)(&stuff->detail) & 3) == 0) *(&stuff->detail) = lswapl(*(&stuff->detail )); else swap_uint32((uint32_t *)(&stuff->detail)); } while (0); | |||
| 64 | swaps(&stuff->mask_len)do { if (sizeof(*(&stuff->mask_len)) != 2) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&stuff->mask_len ) & 1) && ((uintptr_t)(&stuff->mask_len) & 1) == 0) *(&stuff->mask_len) = lswaps(*(&stuff-> mask_len)); else swap_uint16((uint16_t *)(&stuff->mask_len )); } while (0); | |||
| 65 | swaps(&stuff->num_modifiers)do { if (sizeof(*(&stuff->num_modifiers)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->num_modifiers ) & 1) && ((uintptr_t)(&stuff->num_modifiers ) & 1) == 0) *(&stuff->num_modifiers) = lswaps(*(& stuff->num_modifiers)); else swap_uint16((uint16_t *)(& stuff->num_modifiers)); } while (0); | |||
| 66 | ||||
| 67 | REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) *4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) *4) + 3) >> 2) != (uint64_t) client->req_len)) return(16) | |||
| 68 | ((uint32_t) stuff->mask_len + stuff->num_modifiers) *4)if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) *4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) *4) + 3) >> 2) != (uint64_t) client->req_len)) return(16); | |||
| 69 | mods = (uint32_t *) &stuff[1] + stuff->mask_len; | |||
| 70 | ||||
| 71 | for (i = 0; i < stuff->num_modifiers; i++, mods++) { | |||
| 72 | swapl(mods)do { if (sizeof(*(mods)) != 4) wrong_size(); if (__builtin_constant_p ((uintptr_t)(mods) & 3) && ((uintptr_t)(mods) & 3) == 0) *(mods) = lswapl(*(mods)); else swap_uint32((uint32_t *)(mods)); } while (0); | |||
| 73 | } | |||
| 74 | ||||
| 75 | return ProcXIPassiveGrabDevice(client); | |||
| 76 | } | |||
| 77 | ||||
| 78 | int | |||
| 79 | ProcXIPassiveGrabDevice(ClientPtr client) | |||
| 80 | { | |||
| 81 | DeviceIntPtr dev, mod_dev; | |||
| 82 | xXIPassiveGrabDeviceReply rep = { | |||
| 83 | .repType = X_Reply1, | |||
| 84 | .RepType = X_XIPassiveGrabDevice54, | |||
| 85 | .sequenceNumber = client->sequence, | |||
| 86 | .length = 0, | |||
| 87 | .num_modifiers = 0 | |||
| 88 | }; | |||
| 89 | int i, ret = Success0; | |||
| 90 | uint32_t *modifiers; | |||
| 91 | xXIGrabModifierInfo *modifiers_failed; | |||
| 92 | GrabMask mask = { 0 }; | |||
| 93 | GrabParameters param; | |||
| 94 | void *tmp; | |||
| 95 | int mask_len; | |||
| 96 | ||||
| 97 | REQUEST(xXIPassiveGrabDeviceReq)xXIPassiveGrabDeviceReq *stuff = (xXIPassiveGrabDeviceReq *)client ->requestBuffer; | |||
| 98 | REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) * 4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) * 4) + 3) >> 2 ) != (uint64_t) client->req_len)) return(16) | |||
| 99 | ((uint32_t) stuff->mask_len + stuff->num_modifiers) * 4)if (((sizeof(xXIPassiveGrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->mask_len + stuff-> num_modifiers) * 4) >> 2) >= client->req_len) || ( (((uint64_t) sizeof(xXIPassiveGrabDeviceReq) + (((uint32_t) stuff ->mask_len + stuff->num_modifiers) * 4) + 3) >> 2 ) != (uint64_t) client->req_len)) return(16); | |||
| 100 | ||||
| 101 | if (stuff->deviceid == XIAllDevices0) | |||
| ||||
| 102 | dev = inputInfo.all_devices; | |||
| 103 | else if (stuff->deviceid == XIAllMasterDevices1) | |||
| 104 | dev = inputInfo.all_master_devices; | |||
| 105 | else { | |||
| 106 | ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess(1<<17)); | |||
| 107 | if (ret != Success0) { | |||
| 108 | client->errorValue = stuff->deviceid; | |||
| 109 | return ret; | |||
| 110 | } | |||
| 111 | } | |||
| 112 | ||||
| 113 | if (stuff->grab_type != XIGrabtypeButton0 && | |||
| 114 | stuff->grab_type != XIGrabtypeKeycode1 && | |||
| 115 | stuff->grab_type != XIGrabtypeEnter2 && | |||
| 116 | stuff->grab_type != XIGrabtypeFocusIn3 && | |||
| 117 | stuff->grab_type != XIGrabtypeTouchBegin4) { | |||
| 118 | client->errorValue = stuff->grab_type; | |||
| 119 | return BadValue2; | |||
| 120 | } | |||
| 121 | ||||
| 122 | if ((stuff->grab_type == XIGrabtypeEnter2 || | |||
| 123 | stuff->grab_type == XIGrabtypeFocusIn3 || | |||
| 124 | stuff->grab_type == XIGrabtypeTouchBegin4) && stuff->detail != 0) { | |||
| 125 | client->errorValue = stuff->detail; | |||
| 126 | return BadValue2; | |||
| 127 | } | |||
| 128 | ||||
| 129 | if (stuff->grab_type == XIGrabtypeTouchBegin4 && | |||
| 130 | (stuff->grab_mode != XIGrabModeTouch2 || | |||
| 131 | stuff->paired_device_mode != GrabModeAsync1)) { | |||
| 132 | client->errorValue = stuff->grab_mode; | |||
| 133 | return BadValue2; | |||
| 134 | } | |||
| 135 | ||||
| 136 | if (XICheckInvalidMaskBits(client, (unsigned char *) &stuff[1], | |||
| 137 | stuff->mask_len * 4) != Success0) | |||
| 138 | return BadValue2; | |||
| 139 | ||||
| 140 | mask.xi2mask = xi2mask_new(); | |||
| 141 | if (!mask.xi2mask) | |||
| 142 | return BadAlloc11; | |||
| 143 | ||||
| 144 | mask_len = min(xi2mask_mask_size(mask.xi2mask), stuff->mask_len * 4)(((xi2mask_mask_size(mask.xi2mask)) < (stuff->mask_len * 4)) ? (xi2mask_mask_size(mask.xi2mask)) : (stuff->mask_len * 4)); | |||
| 145 | xi2mask_set_one_mask(mask.xi2mask, stuff->deviceid, | |||
| 146 | (unsigned char *) &stuff[1], mask_len * 4); | |||
| 147 | ||||
| 148 | memset(¶m, 0, sizeof(param))__builtin___memset_chk (¶m, 0, sizeof(param), __builtin_object_size (¶m, 0)); | |||
| 149 | param.grabtype = XI2; | |||
| 150 | param.ownerEvents = stuff->owner_events; | |||
| 151 | param.grabWindow = stuff->grab_window; | |||
| 152 | param.cursor = stuff->cursor; | |||
| 153 | ||||
| 154 | if (IsKeyboardDevice(dev)) { | |||
| 155 | param.this_device_mode = stuff->grab_mode; | |||
| 156 | param.other_devices_mode = stuff->paired_device_mode; | |||
| 157 | } | |||
| 158 | else { | |||
| 159 | param.this_device_mode = stuff->paired_device_mode; | |||
| 160 | param.other_devices_mode = stuff->grab_mode; | |||
| 161 | } | |||
| 162 | ||||
| 163 | if (stuff->cursor != None0L) { | |||
| 164 | ret = dixLookupResourceByType(&tmp, stuff->cursor, | |||
| 165 | RT_CURSOR((RESTYPE)5), client, DixUseAccess(1<<24)); | |||
| 166 | if (ret != Success0) { | |||
| 167 | client->errorValue = stuff->cursor; | |||
| 168 | goto out; | |||
| 169 | } | |||
| 170 | } | |||
| 171 | ||||
| 172 | ret = | |||
| 173 | dixLookupWindow((WindowPtr *) &tmp, stuff->grab_window, client, | |||
| 174 | DixSetAttrAccess(1<<5)); | |||
| 175 | if (ret != Success0) | |||
| 176 | goto out; | |||
| 177 | ||||
| 178 | ret = CheckGrabValues(client, ¶m); | |||
| 179 | if (ret != Success0) | |||
| 180 | goto out; | |||
| 181 | ||||
| 182 | modifiers = (uint32_t *) &stuff[1] + stuff->mask_len; | |||
| 183 | modifiers_failed = | |||
| 184 | calloc(stuff->num_modifiers, sizeof(xXIGrabModifierInfo)); | |||
| 185 | if (!modifiers_failed) { | |||
| 186 | ret = BadAlloc11; | |||
| 187 | goto out; | |||
| 188 | } | |||
| 189 | ||||
| 190 | mod_dev = (IsFloating(dev)) ? dev : GetMaster(dev, MASTER_KEYBOARD2); | |||
| 191 | ||||
| 192 | for (i = 0; i < stuff->num_modifiers; i++, modifiers++) { | |||
| 193 | uint8_t status = Success0; | |||
| 194 | ||||
| 195 | param.modifiers = *modifiers; | |||
| 196 | ret = CheckGrabValues(client, ¶m); | |||
| 197 | if (ret != Success0) | |||
| 198 | goto out; | |||
| 199 | ||||
| 200 | switch (stuff->grab_type) { | |||
| 201 | case XIGrabtypeButton0: | |||
| 202 | status = GrabButton(client, dev, mod_dev, stuff->detail, | |||
| 203 | ¶m, XI2, &mask); | |||
| 204 | break; | |||
| 205 | case XIGrabtypeKeycode1: | |||
| 206 | status = GrabKey(client, dev, mod_dev, stuff->detail, | |||
| 207 | ¶m, XI2, &mask); | |||
| 208 | break; | |||
| 209 | case XIGrabtypeEnter2: | |||
| 210 | case XIGrabtypeFocusIn3: | |||
| 211 | status = GrabWindow(client, dev, stuff->grab_type, ¶m, &mask); | |||
| 212 | break; | |||
| 213 | case XIGrabtypeTouchBegin4: | |||
| 214 | status = GrabTouch(client, dev, mod_dev, ¶m, &mask); | |||
| 215 | break; | |||
| 216 | } | |||
| 217 | ||||
| 218 | if (status != GrabSuccess0) { | |||
| 219 | xXIGrabModifierInfo *info = modifiers_failed + rep.num_modifiers; | |||
| 220 | ||||
| 221 | info->status = status; | |||
| 222 | info->modifiers = *modifiers; | |||
| 223 | if (client->swapped) | |||
| 224 | swapl(&info->modifiers)do { if (sizeof(*(&info->modifiers)) != 4) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&info->modifiers ) & 3) && ((uintptr_t)(&info->modifiers) & 3) == 0) *(&info->modifiers) = lswapl(*(&info-> modifiers)); else swap_uint32((uint32_t *)(&info->modifiers )); } while (0); | |||
| 225 | ||||
| 226 | rep.num_modifiers++; | |||
| 227 | rep.length += bytes_to_int32(sizeof(xXIGrabModifierInfo)); | |||
| 228 | } | |||
| 229 | } | |||
| 230 | ||||
| 231 | WriteReplyToClient(client, sizeof(rep), &rep){ if ((client)->swapped) (*ReplySwapVector[((xReq *)(client )->requestBuffer)->reqType]) (client, (int)(sizeof(rep) ), &rep); else WriteToClient(client, (int)(sizeof(rep)), ( &rep)); }; | |||
| 232 | if (rep.num_modifiers) | |||
| 233 | WriteToClient(client, rep.length * 4, modifiers_failed); | |||
| 234 | ||||
| 235 | free(modifiers_failed); | |||
| 236 | out: | |||
| 237 | xi2mask_free(&mask.xi2mask); | |||
| ||||
| 238 | return ret; | |||
| 239 | } | |||
| 240 | ||||
| 241 | void | |||
| 242 | SRepXIPassiveGrabDevice(ClientPtr client, int size, | |||
| 243 | xXIPassiveGrabDeviceReply * rep) | |||
| 244 | { | |||
| 245 | swaps(&rep->sequenceNumber)do { if (sizeof(*(&rep->sequenceNumber)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&rep->sequenceNumber ) & 1) && ((uintptr_t)(&rep->sequenceNumber ) & 1) == 0) *(&rep->sequenceNumber) = lswaps(*(& rep->sequenceNumber)); else swap_uint16((uint16_t *)(& rep->sequenceNumber)); } while (0); | |||
| 246 | swapl(&rep->length)do { if (sizeof(*(&rep->length)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&rep->length) & 3) && ((uintptr_t)(&rep->length) & 3) == 0 ) *(&rep->length) = lswapl(*(&rep->length)); else swap_uint32((uint32_t *)(&rep->length)); } while (0); | |||
| 247 | swaps(&rep->num_modifiers)do { if (sizeof(*(&rep->num_modifiers)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&rep->num_modifiers ) & 1) && ((uintptr_t)(&rep->num_modifiers ) & 1) == 0) *(&rep->num_modifiers) = lswaps(*(& rep->num_modifiers)); else swap_uint16((uint16_t *)(&rep ->num_modifiers)); } while (0); | |||
| 248 | ||||
| 249 | WriteToClient(client, size, rep); | |||
| 250 | } | |||
| 251 | ||||
| 252 | int | |||
| 253 | SProcXIPassiveUngrabDevice(ClientPtr client) | |||
| 254 | { | |||
| 255 | int i; | |||
| 256 | uint32_t *modifiers; | |||
| 257 | ||||
| 258 | REQUEST(xXIPassiveUngrabDeviceReq)xXIPassiveUngrabDeviceReq *stuff = (xXIPassiveUngrabDeviceReq *)client->requestBuffer; | |||
| 259 | REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq)if ((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len ) return(16); | |||
| 260 | ||||
| 261 | swaps(&stuff->length)do { if (sizeof(*(&stuff->length)) != 2) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->length) & 1) && ((uintptr_t)(&stuff->length) & 1) == 0) *(&stuff->length) = lswaps(*(&stuff->length )); else swap_uint16((uint16_t *)(&stuff->length)); } while (0); | |||
| 262 | swapl(&stuff->grab_window)do { if (sizeof(*(&stuff->grab_window)) != 4) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->grab_window ) & 3) && ((uintptr_t)(&stuff->grab_window ) & 3) == 0) *(&stuff->grab_window) = lswapl(*(& stuff->grab_window)); else swap_uint32((uint32_t *)(&stuff ->grab_window)); } while (0); | |||
| 263 | swaps(&stuff->deviceid)do { if (sizeof(*(&stuff->deviceid)) != 2) wrong_size( ); if (__builtin_constant_p((uintptr_t)(&stuff->deviceid ) & 1) && ((uintptr_t)(&stuff->deviceid) & 1) == 0) *(&stuff->deviceid) = lswaps(*(&stuff-> deviceid)); else swap_uint16((uint16_t *)(&stuff->deviceid )); } while (0); | |||
| 264 | swapl(&stuff->detail)do { if (sizeof(*(&stuff->detail)) != 4) wrong_size(); if (__builtin_constant_p((uintptr_t)(&stuff->detail) & 3) && ((uintptr_t)(&stuff->detail) & 3) == 0) *(&stuff->detail) = lswapl(*(&stuff->detail )); else swap_uint32((uint32_t *)(&stuff->detail)); } while (0); | |||
| 265 | swaps(&stuff->num_modifiers)do { if (sizeof(*(&stuff->num_modifiers)) != 2) wrong_size (); if (__builtin_constant_p((uintptr_t)(&stuff->num_modifiers ) & 1) && ((uintptr_t)(&stuff->num_modifiers ) & 1) == 0) *(&stuff->num_modifiers) = lswaps(*(& stuff->num_modifiers)); else swap_uint16((uint16_t *)(& stuff->num_modifiers)); } while (0); | |||
| 266 | ||||
| 267 | REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16) | |||
| 268 | ((uint32_t) stuff->num_modifiers) << 2)if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16); | |||
| 269 | modifiers = (uint32_t *) &stuff[1]; | |||
| 270 | ||||
| 271 | for (i = 0; i < stuff->num_modifiers; i++, modifiers++) | |||
| 272 | swapl(modifiers)do { if (sizeof(*(modifiers)) != 4) wrong_size(); if (__builtin_constant_p ((uintptr_t)(modifiers) & 3) && ((uintptr_t)(modifiers ) & 3) == 0) *(modifiers) = lswapl(*(modifiers)); else swap_uint32 ((uint32_t *)(modifiers)); } while (0); | |||
| 273 | ||||
| 274 | return ProcXIPassiveUngrabDevice(client); | |||
| 275 | } | |||
| 276 | ||||
| 277 | int | |||
| 278 | ProcXIPassiveUngrabDevice(ClientPtr client) | |||
| 279 | { | |||
| 280 | DeviceIntPtr dev, mod_dev; | |||
| 281 | WindowPtr win; | |||
| 282 | GrabPtr tempGrab; | |||
| 283 | uint32_t *modifiers; | |||
| 284 | int i, rc; | |||
| 285 | ||||
| 286 | REQUEST(xXIPassiveUngrabDeviceReq)xXIPassiveUngrabDeviceReq *stuff = (xXIPassiveUngrabDeviceReq *)client->requestBuffer; | |||
| 287 | REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16) | |||
| 288 | ((uint32_t) stuff->num_modifiers) << 2)if (((sizeof(xXIPassiveUngrabDeviceReq) >> 2) > client ->req_len) || (((((uint32_t) stuff->num_modifiers) << 2) >> 2) >= client->req_len) || ((((uint64_t) sizeof (xXIPassiveUngrabDeviceReq) + (((uint32_t) stuff->num_modifiers ) << 2) + 3) >> 2) != (uint64_t) client->req_len )) return(16); | |||
| 289 | ||||
| 290 | if (stuff->deviceid == XIAllDevices0) | |||
| 291 | dev = inputInfo.all_devices; | |||
| 292 | else if (stuff->deviceid == XIAllMasterDevices1) | |||
| 293 | dev = inputInfo.all_master_devices; | |||
| 294 | else { | |||
| 295 | rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess(1<<17)); | |||
| 296 | if (rc != Success0) | |||
| 297 | return rc; | |||
| 298 | } | |||
| 299 | ||||
| 300 | if (stuff->grab_type != XIGrabtypeButton0 && | |||
| 301 | stuff->grab_type != XIGrabtypeKeycode1 && | |||
| 302 | stuff->grab_type != XIGrabtypeEnter2 && | |||
| 303 | stuff->grab_type != XIGrabtypeFocusIn3 && | |||
| 304 | stuff->grab_type != XIGrabtypeTouchBegin4) { | |||
| 305 | client->errorValue = stuff->grab_type; | |||
| 306 | return BadValue2; | |||
| 307 | } | |||
| 308 | ||||
| 309 | if ((stuff->grab_type == XIGrabtypeEnter2 || | |||
| 310 | stuff->grab_type == XIGrabtypeFocusIn3 || | |||
| 311 | stuff->grab_type == XIGrabtypeTouchBegin4) && stuff->detail != 0) { | |||
| 312 | client->errorValue = stuff->detail; | |||
| 313 | return BadValue2; | |||
| 314 | } | |||
| 315 | ||||
| 316 | rc = dixLookupWindow(&win, stuff->grab_window, client, DixSetAttrAccess(1<<5)); | |||
| 317 | if (rc != Success0) | |||
| 318 | return rc; | |||
| 319 | ||||
| 320 | mod_dev = (IsFloating(dev)) ? dev : GetMaster(dev, MASTER_KEYBOARD2); | |||
| 321 | ||||
| 322 | tempGrab = AllocGrab(NULL((void*)0)); | |||
| 323 | if (!tempGrab) | |||
| 324 | return BadAlloc11; | |||
| 325 | ||||
| 326 | tempGrab->resource = client->clientAsMask; | |||
| 327 | tempGrab->device = dev; | |||
| 328 | tempGrab->window = win; | |||
| 329 | switch (stuff->grab_type) { | |||
| 330 | case XIGrabtypeButton0: | |||
| 331 | tempGrab->type = XI_ButtonPress4; | |||
| 332 | break; | |||
| 333 | case XIGrabtypeKeycode1: | |||
| 334 | tempGrab->type = XI_KeyPress2; | |||
| 335 | break; | |||
| 336 | case XIGrabtypeEnter2: | |||
| 337 | tempGrab->type = XI_Enter7; | |||
| 338 | break; | |||
| 339 | case XIGrabtypeFocusIn3: | |||
| 340 | tempGrab->type = XI_FocusIn9; | |||
| 341 | break; | |||
| 342 | case XIGrabtypeTouchBegin4: | |||
| 343 | tempGrab->type = XI_TouchBegin18; | |||
| 344 | break; | |||
| 345 | } | |||
| 346 | tempGrab->grabtype = XI2; | |||
| 347 | tempGrab->modifierDevice = mod_dev; | |||
| 348 | tempGrab->modifiersDetail.pMask = NULL((void*)0); | |||
| 349 | tempGrab->detail.exact = stuff->detail; | |||
| 350 | tempGrab->detail.pMask = NULL((void*)0); | |||
| 351 | ||||
| 352 | modifiers = (uint32_t *) &stuff[1]; | |||
| 353 | ||||
| 354 | for (i = 0; i < stuff->num_modifiers; i++, modifiers++) { | |||
| 355 | tempGrab->modifiersDetail.exact = *modifiers; | |||
| 356 | DeletePassiveGrabFromList(tempGrab); | |||
| 357 | } | |||
| 358 | ||||
| 359 | FreeGrab(tempGrab); | |||
| 360 | ||||
| 361 | return Success0; | |||
| 362 | } |