Xext/sync.c | 7 ++----- Xi/exevents.c | 22 ++++++++++++++++++++-- Xi/xichangehierarchy.c | 4 ++++ Xi/xipassivegrab.c | 6 +++++- config/hal.c | 16 +++++++++++++--- config/udev.c | 15 +++++++++++---- configure.ac | 6 +++--- dix/devices.c | 1 + dix/dixfonts.c | 9 ++++++--- dix/getevents.c | 2 ++ dix/inpututils.c | 3 ++- hw/xfree86/common/xf86Helper.c | 7 ++++--- os/utils.c | 27 +++++++++++++++++++++++++++ test/xi2/protocol-xipassivegrabdevice.c | 9 ++++++++- 14 files changed, 108 insertions(+), 26 deletions(-) New commits: commit 300458fb8ad0a7957e941cd65f47d204c7886e22 Author: Matt Dew <marcoz@osource.org> Date: Fri Mar 21 23:49:41 2014 -0600 Bump bersion to 1.15.0.901 diff --git a/configure.ac b/configure.ac index 8f82386..abd4604 100644 --- a/configure.ac +++ b/configure.ac @@ -26,9 +26,9 @@ dnl dnl Process this file with autoconf to create configure. AC_PREREQ(2.60) -AC_INIT([xorg-server], 1.15.0, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server) -RELEASE_DATE="2013-12-27" -RELEASE_NAME="Egg Nog" +AC_INIT([xorg-server], 1.15.0.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server) +RELEASE_DATE="2014-03-21" +RELEASE_NAME="Heart Candy-rc1" AC_CONFIG_SRCDIR([Makefile.am]) AM_INIT_AUTOMAKE([foreign dist-bzip2]) AC_USE_SYSTEM_EXTENSIONS commit c971864565eb114e4b34f17b0d2244e8e6e1e005 Author: Peter Hutterer <peter.hutterer@who-t.net> Date: Wed Feb 26 07:54:56 2014 +1000 config: search for PnPID on all parents (#75513) The PnPID for a device may not be on the immediate parent, so search up the device tree until we find one. X.Org Bug 75513 <http://bugs.freedesktop.org/show_bug.cgi?id=75513> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Tested-by: Benjamin Tissoires <benjamin.tissoires@gmail.com> (cherry picked from commit 795066477ee81b5b82e490eac8bed6b656d01f17) diff --git a/config/hal.c b/config/hal.c index 2ead556..d8e8db7 100644 --- a/config/hal.c +++ b/config/hal.c @@ -184,8 +184,7 @@ device_added(LibHalContext * hal_ctx, const char *udi) parent = get_prop_string(hal_ctx, udi, "info.parent"); if (parent) { int usb_vendor, usb_product; - - attrs.pnp_id = get_prop_string(hal_ctx, parent, "pnp.id"); + char *old_parent; /* construct USB ID in lowercase - "0000:ffff" */ usb_vendor = libhal_device_get_property_int(hal_ctx, parent, @@ -203,7 +202,18 @@ device_added(LibHalContext * hal_ctx, const char *udi) == -1) attrs.usb_id = NULL; - free(parent); + attrs.pnp_id = get_prop_string(hal_ctx, parent, "pnp.id"); + old_parent = parent; + + while (!attrs.pnp_id && + (parent = get_prop_string(hal_ctx, parent, "info.parent"))) { + attrs.pnp_id = get_prop_string(hal_ctx, parent, "pnp.id"); + + free(old_parent); + old_parent = parent; + } + + free(old_parent); } input_options = input_option_new(NULL, "_source", "server/hal"); diff --git a/config/udev.c b/config/udev.c index b55b78e..bcafbd9 100644 --- a/config/udev.c +++ b/config/udev.c @@ -130,10 +130,6 @@ device_added(struct udev_device *udev_device) LOG_PROPERTY(ppath, "NAME", name); } - if (pnp_id) - attrs.pnp_id = strdup(pnp_id); - LOG_SYSATTR(ppath, "id", pnp_id); - /* construct USB ID in lowercase hex - "0000:ffff" */ if (product && sscanf(product, "%*x/%4x/%4x/%*x", &usb_vendor, &usb_model) == 2) { @@ -143,6 +139,17 @@ device_added(struct udev_device *udev_device) else LOG_PROPERTY(ppath, "PRODUCT", product); } + + while (!pnp_id && (parent = udev_device_get_parent(parent))) { + pnp_id = udev_device_get_sysattr_value(parent, "id"); + if (!pnp_id) + continue; + + attrs.pnp_id = strdup(pnp_id); + ppath = udev_device_get_devnode(parent); + LOG_SYSATTR(ppath, "id", pnp_id); + } + } if (!name) name = "(unnamed)"; commit 2cbbe80efc485d2d05b06efe1e2e01f81f3e06f6 Author: Peter Hutterer <peter.hutterer@who-t.net> Date: Thu Feb 20 13:18:05 2014 +1000 Xi: check for invalid modifiers for XI2 passive grabs The other values are checked correctly, but if a modifier was outside the allowed range, it would go unnoticed and cause a out-of-bounds read error for any mask equal or larger than 256. The DetailRec where we store the grab masks is only sized to 8 * sizeof(Mask). Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> (cherry picked from commit 0f10cfd4b903d4db293ec47c8a9a0d8b33965803) diff --git a/Xi/exevents.c b/Xi/exevents.c index 528e105..ad02650 100644 --- a/Xi/exevents.c +++ b/Xi/exevents.c @@ -2183,7 +2183,8 @@ CheckGrabValues(ClientPtr client, GrabParameters *param) return BadValue; } - if (param->grabtype != XI2 && (param->modifiers != AnyModifier) && + if (param->modifiers != AnyModifier && + param->modifiers != XIAnyModifier && (param->modifiers & ~AllModifiersMask)) { client->errorValue = param->modifiers; return BadValue; diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c index 8aba977..700622d 100644 --- a/Xi/xipassivegrab.c +++ b/Xi/xipassivegrab.c @@ -189,6 +189,10 @@ ProcXIPassiveGrabDevice(ClientPtr client) uint8_t status = Success; param.modifiers = *modifiers; + ret = CheckGrabValues(client, ¶m); + if (ret != Success) + goto out; + switch (stuff->grab_type) { case XIGrabtypeButton: status = GrabButton(client, dev, mod_dev, stuff->detail, commit b3656c0b52d57333c64f932676a237d0f3a97f36 Author: Mark Kettenis <kettenis@openbsd.org> Date: Sun Dec 15 14:31:10 2013 +0100 sync: Avoid ridiculously long timeouts On OpenBSD, passing a timeout longer than 100000000 seconds to select(2) will make it fail with EINVAL. As this is original 4.4BSD behaviour it is not inconceivable that other systems suffer from the same problem. And Linux, though not suffering from any 4.4BSD heritage, briefly did something similar: <https://lkml.org/lkml/2012/8/31/263> So avoid calling AdjustWaitForDelay() instead of setting the timeout to (effectively) ULONG_MAX milliseconds. Signed-off-by: Mark Kettenis <kettenis@openbsd.org> Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> (cherry picked from commit ddeca927498c9df3b5e62c7bf05e31e2a3aeaa52) diff --git a/Xext/sync.c b/Xext/sync.c index 2d58ea1..c33b5b5 100644 --- a/Xext/sync.c +++ b/Xext/sync.c @@ -2731,27 +2731,24 @@ IdleTimeBlockHandler(pointer pCounter, struct timeval **wt, pointer LastSelectMa * If we've been idle more than it, and someone wants to know about * that level-triggered, schedule an immediate wakeup. */ - unsigned long timeout = -1; if (XSyncValueLessThan(idle, *greater)) { XSyncValue value; Bool overflow; XSyncValueSubtract(&value, *greater, idle, &overflow); - timeout = min(timeout, XSyncValueLow32(value)); + AdjustWaitForDelay(wt, XSyncValueLow32(value)); } else { for (list = counter->sync.pTriglist; list; list = list->next) { trig = list->pTrigger; if (trig->CheckTrigger(trig, old_idle)) { - timeout = min(timeout, 0); + AdjustWaitForDelay(wt, 0); break; } } } - - AdjustWaitForDelay(wt, timeout); } counter->value = old_idle; /* pop */ commit b332cd20ee14049606e3656490d13a8efa6b23ee Merge: f41ab8c 5e0432f Author: Matt Dew <marcoz@osource.org> Date: Thu Mar 6 22:03:03 2014 -0700 Merge branch 'server-1.15-branch' of git://people.freedesktop.org/~jeremyhu/xserver into server-1.15-branch commit f41ab8c60780ea8f87354e536e5b73cb23878eb7 Author: Peter Hutterer <peter.hutterer@who-t.net> Date: Fri Jan 24 18:32:54 2014 +1000 dix: prevent a driver from initializing or submitting buttons > MAX_BUTTONS The server internally relies on arrays with a MAX_BUTTONS maximum size (which is the max the core protocol can transport). Make sure a driver adheres to that. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Daniel Stone <daniel@fooishbar.org> (cherry picked from commit 87ca80a7196949597113225405f3e4ee03bbee13) diff --git a/dix/devices.c b/dix/devices.c index a680ed8..8b9f5dd 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -1279,6 +1279,7 @@ InitButtonClassDeviceStruct(DeviceIntPtr dev, int numButtons, Atom *labels, BUG_RETURN_VAL(dev == NULL, FALSE); BUG_RETURN_VAL(dev->button != NULL, FALSE); + BUG_RETURN_VAL(numButtons >= MAX_BUTTONS, FALSE); butc = calloc(1, sizeof(ButtonClassRec)); if (!butc) diff --git a/dix/getevents.c b/dix/getevents.c index 14b65ca..23f9c33 100644 --- a/dix/getevents.c +++ b/dix/getevents.c @@ -1654,6 +1654,8 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type, } #endif + BUG_RETURN_VAL(buttons >= MAX_BUTTONS, 0); + /* refuse events from disabled devices */ if (!pDev->enabled) return 0; commit 4447d71b9a74afe91aaf4cc01eae12a44ef09306 Author: Alan Coopersmith <alan.coopersmith@oracle.com> Date: Tue Jan 28 20:27:51 2014 -0800 xf86DeleteScreen: move check for NULL pScrn before first dereference Flagged by cppcheck 1.62: [hw/xfree86/common/xf86Helper.c:220] -> [hw/xfree86/common/xf86Helper.c:231]: (warning) Possible null pointer dereference: pScrn - otherwise it is redundant to check it against null. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Keith Packard <keithp@keithp.com> (cherry picked from commit c1ac89c793614797e08d3d8e7fc9ba55be899130) diff --git a/hw/xfree86/common/xf86Helper.c b/hw/xfree86/common/xf86Helper.c index f1e6783..676cc80 100644 --- a/hw/xfree86/common/xf86Helper.c +++ b/hw/xfree86/common/xf86Helper.c @@ -217,6 +217,10 @@ xf86DeleteScreen(ScrnInfoPtr pScrn) int i; int scrnIndex; Bool is_gpu = FALSE; + + if (!pScrn) + return; + if (pScrn->is_gpu) { /* First check if the screen is valid */ if (xf86NumGPUScreens == 0 || xf86GPUScreens == NULL) @@ -228,9 +232,6 @@ xf86DeleteScreen(ScrnInfoPtr pScrn) return; } - if (!pScrn) - return; - scrnIndex = pScrn->scrnIndex; /* If a FreeScreen function is defined, call it here */ if (pScrn->FreeScreen != NULL) commit 2ac840a14958fe74170518ee2c3a6b2dd88b20bd Author: Alan Coopersmith <alan.coopersmith@oracle.com> Date: Tue Jan 28 20:27:50 2014 -0800 On realloc failure, free font_path_string instead of leaking it Flagged by cppcheck 1.62: [dix/dixfonts.c:1792]: (error) Common realloc mistake: 'font_path_string' nulled but not freed upon failure Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Keith Packard <keithp@keithp.com> (cherry picked from commit e6733ae91b7be52930f22a87de15fa05819ef948) diff --git a/dix/dixfonts.c b/dix/dixfonts.c index 2e34d37..9a686e6 100644 --- a/dix/dixfonts.c +++ b/dix/dixfonts.c @@ -1789,11 +1789,14 @@ GetFontPath(ClientPtr client, int *count, int *length, unsigned char **result) fpe = font_path_elements[i]; len += fpe->name_length + 1; } - font_path_string = (unsigned char *) realloc(font_path_string, len); - if (!font_path_string) + c = realloc(font_path_string, len); + if (c == NULL) { + free(font_path_string); + font_path_string = NULL; return BadAlloc; + } - c = font_path_string; + font_path_string = c; *length = 0; for (i = 0; i < num_fpes; i++) { fpe = font_path_elements[i]; commit 157cc02fc13c998bba70e1652907972015e15e8e Author: Alan Coopersmith <alan.coopersmith@oracle.com> Date: Fri Jan 24 23:42:49 2014 -0800 Check for calloc() failure in add_master() Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> (cherry picked from commit 9fc19168e7ca6308275bf8769d1ccb982f88465b) diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c index e2f4b8a..9e36354 100644 --- a/Xi/xichangehierarchy.c +++ b/Xi/xichangehierarchy.c @@ -143,6 +143,10 @@ add_master(ClientPtr client, xXIAddMasterInfo * c, int flags[MAXDEVICES]) int rc; name = calloc(c->name_len + 1, sizeof(char)); + if (name == NULL) { + rc = BadAlloc; + goto unwind; + } strncpy(name, (char *) &c[1], c->name_len); rc = AllocDevicePair(client, name, &ptr, &keybd, commit f11c5938d732af717aeebbbf3b356138f3411bb7 Author: Peter Hutterer <peter.hutterer@who-t.net> Date: Fri Jan 24 16:51:02 2014 +1000 Xi: fix modifier offset in XIPassiveGrab swapping function The request is followed by mask_len 4-byte units, then followed by the actual modifiers. Also fix up the swapping test, which had the same issue. Reported-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> (cherry picked from commit 76b3be75b62657e346731444736f7e4d200beb5b) Conflicts: test/xi2/protocol-xipassivegrabdevice.c diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c index eccec0a..8aba977 100644 --- a/Xi/xipassivegrab.c +++ b/Xi/xipassivegrab.c @@ -63,7 +63,7 @@ SProcXIPassiveGrabDevice(ClientPtr client) swaps(&stuff->mask_len); swaps(&stuff->num_modifiers); - mods = (uint32_t *) &stuff[1]; + mods = (uint32_t *) &stuff[1] + stuff->mask_len; for (i = 0; i < stuff->num_modifiers; i++, mods++) { swapl(mods); diff --git a/test/xi2/protocol-xipassivegrabdevice.c b/test/xi2/protocol-xipassivegrabdevice.c index 84b386b..dd51757 100644 --- a/test/xi2/protocol-xipassivegrabdevice.c +++ b/test/xi2/protocol-xipassivegrabdevice.c @@ -137,6 +137,7 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req, { int rc; int modifiers; + int mask_len; rc = ProcXIPassiveGrabDevice(&client_request); assert(rc == error); @@ -153,10 +154,11 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req, swaps(&req->deviceid); modifiers = req->num_modifiers; swaps(&req->num_modifiers); + mask_len = req->mask_len; swaps(&req->mask_len); while (modifiers--) { - CARD32 *mod = ((CARD32 *) (req + 1)) + modifiers; + CARD32 *mod = ((CARD32 *) (req + 1)) + mask_len + modifiers; swapl(mod); } @@ -228,6 +230,11 @@ test_XIPassiveGrabDevice(void) request->detail = XIAnyButton; request_XIPassiveGrabDevice(&client_request, request, Success, 0); + /* Set a few random masks to make sure we handle modifiers correctly */ + SetBit(mask, XI_ButtonPress); + SetBit(mask, XI_KeyPress); + SetBit(mask, XI_Enter); + /* some modifiers */ request->num_modifiers = N_MODS; request->length += N_MODS; commit 345b7ead1dd262020e10b4aeb71044d46d16e134 Author: Peter Hutterer <peter.hutterer@who-t.net> Date: Mon Jan 13 17:00:23 2014 +1000 os: restrict display names to digits We call atoi() on the server's display to get the socket but otherwise use the unmodified display for log file name, xkb paths, etc. This results in Xorg :banana being the equivalent of Xorg :0, except for the log files being in /var/log/Xorg.banana.log. I'm not sure there's a good use-case for this behaviour. Check the display for something that looks reasonable, i.e. digits only, but do allow for :0.0 (i.e. digits, followed by a period, followed by one or two digits). Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Keith Packard <keithp@keithp.com> (cherry picked from commit 71baa466b1f6b02fe503f9a3089b7b9d61aa0f80) diff --git a/os/utils.c b/os/utils.c index 608ee6a..3b20a5c 100644 --- a/os/utils.c +++ b/os/utils.c @@ -600,6 +600,10 @@ UseMsg(void) static int VerifyDisplayName(const char *d) { + int i; + int period_found = FALSE; + int after_period = 0; + if (d == (char *) 0) return 0; /* null */ if (*d == '\0') @@ -610,6 +614,29 @@ VerifyDisplayName(const char *d) return 0; /* must not equal "." or ".." */ if (strchr(d, '/') != (char *) 0) return 0; /* very important!!! */ + + /* Since we run atoi() on the display later, only allow + for digits, or exception of :0.0 and similar (two decimal points max) + */ + for (i = 0; i < strlen(d); i++) { + if (!isdigit(d[i])) { + if (d[i] != '.' || period_found) + return 0; + period_found = TRUE; + } else if (period_found) + after_period++; + + if (after_period > 2) + return 0; + } + + /* don't allow for :0. */ + if (period_found && after_period == 0) + return 0; + + if (atol(d) > INT_MAX) + return 0; + return 1; } commit 940d6a8e9d3544696654d5e68c615ab887f81945 Author: Carlos Garnacho <carlosg@gnome.org> Date: Thu Jan 2 21:33:30 2014 +0100 Xi: Ensure DeviceChanged is emitted after grabs are deactivated When a grab on a slave device is deactivated, the master device must be checked, just in case there were events from other devices while the slave device was stolen away by the passive grab. This may introduce misbehaviors on mismatching valuators and device features later on UpdateDeviceState(). Signed-off-by: Carlos Garnacho <carlosg@gnome.org> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> (cherry picked from commit b2d5ee2e3684951b611fd2068d57cc65fd8305a3) diff --git a/Xi/exevents.c b/Xi/exevents.c index dff0a92..528e105 100644 --- a/Xi/exevents.c +++ b/Xi/exevents.c @@ -1783,8 +1783,25 @@ ProcessDeviceEvent(InternalEvent *ev, DeviceIntPtr device) DeliverDeviceEvents(GetSpriteWindow(device), (InternalEvent *) event, NullGrab, NullWindow, device); - if (deactivateDeviceGrab == TRUE) + if (deactivateDeviceGrab == TRUE) { (*device->deviceGrab.DeactivateGrab) (device); + + if (!IsMaster (device) && !IsFloating (device)) { + int flags, num_events = 0; + InternalEvent dce; + + flags = (IsPointerDevice (device)) ? + DEVCHANGE_POINTER_EVENT : DEVCHANGE_KEYBOARD_EVENT; + UpdateFromMaster (&dce, device, flags, &num_events); + BUG_WARN(num_events > 1); + + if (num_events == 1) + ChangeMasterDeviceClasses(GetMaster (device, MASTER_ATTACHED), + &dce.changed_event); + } + + } + event->detail.key = key; } commit 47da6e3f47a55aeeef2c849067dd2d09fc2fe481 Author: Peter Hutterer <peter.hutterer@who-t.net> Date: Fri Jan 24 18:16:54 2014 +1000 dix: fix button state check before changing a button mapping dev->button->down is a bitmask, not a normal array. Use the helper function to check, we technically allow the mapping to change after the physical button has been pressed (but not yet processed yet), so only check BUTTON_PROCESSED. From XSetPointerMapping(3): "If any of the buttons to be altered are logically in the down state, XSetPointerMapping returns MappingBusy, and the mapping is not changed." Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Daniel Stone <daniel@fooishbar.org> (cherry picked from commit 25d10464f440b8b34594b7c988a99a830ea39a29) diff --git a/dix/inpututils.c b/dix/inpututils.c index a10a7c7..e5bcc31 100644 --- a/dix/inpututils.c +++ b/dix/inpututils.c @@ -60,7 +60,8 @@ check_butmap_change(DeviceIntPtr dev, CARD8 *map, int len, CARD32 *errval_out, } for (i = 0; i < len; i++) { - if (dev->button->map[i + 1] != map[i] && dev->button->down[i + 1]) + if (dev->button->map[i + 1] != map[i] && + button_is_down(dev, i + 1, BUTTON_PROCESSED)) return MappingBusy; }