[Wayland-bugs] [Bug 104939] Tablet tools without ABS_Z cause a crash when updating rotation

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=104939

            Bug ID: 104939
           Summary: Tablet tools without ABS_Z cause a crash when updating
                    rotation
           Product: Wayland
           Version: unspecified
          Hardware: Other
                OS: All
            Status: ASSIGNED
          Severity: normal
          Priority: medium
         Component: libinput
          Assignee: wayland-bugs at lists.freedesktop.org
          Reporter: peter.hutterer at who-t.net

This affects tablets that are not listed in libwacom, specifically, tablets
where libwacom does not provide the stylus axis information.

On tablet init, we check the event codes. A tablet may have ABS_Z and thus have
rotation. Or it has BTN_TOOL_MOUSE + ABS_TILT_X/Y and thus have rotation. On
init, all axes are marked as 'changed' to ensure we send the data in the first
event. For non-libwacom tablets, the tool has the same bits set as the tablet
provides, so if mouse+tilt is there, we have rotation on all tools. But the
code itself relies on ABS_Z for rotation on all the styli (except mouse/lense).

In the case of Aiptek tablets we do have mouse+tilt but we *don't* have ABS_Z.
If the first tool that comes into proximity is *not* the mouse/lens tool [1],
we try to update the rotation by accessing ABS_Z. This leads to a null-pointer
dereference in tablet_update_artpen_rotation() on the very first event.

See https://bugzilla.redhat.com/show_bug.cgi?id=1535755.

It doesn't matter that the tool never sends the actual events - because all
axes are marked as 'changed' on proximity in, we always access the axis on the
first event and crash.

[1] see also Bug 104911

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/wayland-bugs/attachments/20180204/0def0f53/attachment.html>