summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Hutterer <peter.hutterer@who-t.net>2016-04-27 09:01:16 +1000
committerPeter Hutterer <peter.hutterer@who-t.net>2016-04-27 09:11:03 +1000
commit33dc3d7128456d51b1fe6228096e6b714a3e900b (patch)
tree9998ec78601be35345431707b99a1a634711b471
parent7b0a65d989117d1b071101221ff1b97c1b4d1946 (diff)
downloadxorg-driver-xf86-input-evdev-33dc3d7128456d51b1fe6228096e6b714a3e900b.tar.gz
Prevent buffer overrun accessing btn_labels
We go up to BTN_JOYSTICK, hence group can have a value of up to including 15. The actual btn_labels only has 6 elements though. Found by coverity. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-rw-r--r--src/evdev.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/evdev.c b/src/evdev.c
index 0fcb0bb..2c88343 100644
--- a/src/evdev.c
+++ b/src/evdev.c
@@ -2790,6 +2790,9 @@ static void EvdevInitButtonLabels(EvdevPtr pEvdev, int natoms, Atom *atoms)
int group = (button % 0x100)/16;
int idx = button - ((button/16) * 16);
+ if (group >= ArrayLength(btn_labels))
+ break;
+
if (!libevdev_has_event_code(pEvdev->dev, EV_KEY, button))
continue;