diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2016-04-27 09:01:16 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2016-04-27 09:11:03 +1000 |
| commit | 33dc3d7128456d51b1fe6228096e6b714a3e900b (patch) | |
| tree | 9998ec78601be35345431707b99a1a634711b471 | |
| parent | Don't reset the other axis on wheel emulation scroll buildup (diff) | |
| download | xf86-input-evdev-33dc3d7128456d51b1fe6228096e6b714a3e900b.tar.gz xf86-input-evdev-33dc3d7128456d51b1fe6228096e6b714a3e900b.tar.bz2 xf86-input-evdev-33dc3d7128456d51b1fe6228096e6b714a3e900b.zip | |
Prevent buffer overrun accessing btn_labels
We go up to BTN_JOYSTICK, hence group can have a value of up to including 15.
The actual btn_labels only has 6 elements though.
Found by coverity.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
| -rw-r--r-- | src/evdev.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/evdev.c b/src/evdev.c index 0fcb0bb..2c88343 100644 --- a/src/evdev.c +++ b/src/evdev.c @@ -2790,6 +2790,9 @@ static void EvdevInitButtonLabels(EvdevPtr pEvdev, int natoms, Atom *atoms) int group = (button % 0x100)/16; int idx = button - ((button/16) * 16); + if (group >= ArrayLength(btn_labels)) + break; + if (!libevdev_has_event_code(pEvdev->dev, EV_KEY, button)) continue; |