[PATCH] Xext: avoid null-pointer dereference in XTestFakeInput (#59937)

Peter Hutterer peter.hutterer at who-t.net
Mon Jan 28 16:43:41 PST 2013


From: Alan Coopersmith <alan.coopersmith at oracle.com>

dv is still NULL at this point, so return firstValuator instead (which is
the same value dv->firstValuator would be once initialized)

X.Org Bug 59937 <http://bugs.freedesktop.org/show_bug.cgi?id=59937>

Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
---
 Xext/xtest.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Xext/xtest.c b/Xext/xtest.c
index 868ed9a..0768d9c 100644
--- a/Xext/xtest.c
+++ b/Xext/xtest.c
@@ -156,7 +156,6 @@ ProcXTestFakeInput(ClientPtr client)
     DeviceIntPtr dev = NULL;
     WindowPtr root;
     Bool extension = FALSE;
-    deviceValuator *dv = NULL;
     ValuatorMask mask;
     int valuators[MAX_VALUATORS] = { 0 };
     int numValuators = 0;
@@ -241,14 +240,14 @@ ProcXTestFakeInput(ClientPtr client)
         }
 
         if (nev > 1 && !dev->valuator) {
-            client->errorValue = dv->first_valuator;
+            client->errorValue = firstValuator;
             return BadValue;
         }
 
         /* check validity of valuator events */
         base = firstValuator;
         for (n = 1; n < nev; n++) {
-            dv = (deviceValuator *) (ev + n);
+            deviceValuator *dv = (deviceValuator *) (ev + n);
             if (dv->type != DeviceValuator) {
                 client->errorValue = dv->type;
                 return BadValue;
-- 
1.8.1



More information about the xorg-devel mailing list