[Xcb] [Bug 68387] xinput2 XIQueryDevice reply not read correctly

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=68387

--- Comment #1 from Ran Benita <ran234 at gmail.com> ---
After discussing this with Daniel Martin on irc, the problem in this specific
instance is the following snippet in the generated xinput.c:

    int
    xcb_input_xi_device_info_sizeof (const void  *_buffer  /**< */)
    {
        char *xcb_tmp = (char *)_buffer;
        [...]
        unsigned int xcb_block_len = 0;
        [...]

        xcb_block_len += sizeof(xcb_input_xi_device_info_t);
        xcb_tmp += xcb_block_len;
        /* name */
        xcb_block_len += (((_aux->name_len + 3) / 4) * 4) * sizeof(char);
        xcb_tmp += xcb_block_len;
        [...]
    }

There's a missing

    xcb_block_len = 0;

above the /* name */ comment, which results in xcb_tmp being incremented by
sizeof(xcb_input_xi_device_info_t) twice, which is of course one too many.

This function xcb_input_xi_device_info_sizeof() is used by
xcb_input_xi_device_info_next(), which is used in the test program, which
therefore doesn't work.

Daniel says the problemtic section in c_client.py is this:
http://cgit.freedesktop.org/xcb/libxcb/tree/src/c_client.py?id=0289348f2c4ed3b1b286c51df19d82c6787c2b36#n1015
But that simply adding a 'xcb_block_len = 0;' there breaks other iterators.

The same issue also affects other requests, like XKB's GetGeometry.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/xcb/attachments/20130821/836f5860/attachment.html>