x11-base/xorg-server/files/1.12.0-dix-don-t-emulate-scroll-events-for-non-existing-axe.patch

From af88b43f9e604157b74270d609c08bdfa256a792 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 27 Apr 2012 16:31:17 +1000
Subject: [PATCH] dix: don't emulate scroll events for non-existing axes
 (#47281)

Test case:
- create a device with REL_HWHEEL and ABS_X and ABS_Y. evdev 2.7.0 will set
  that up as device with 1 relative axis
- move pointer to VGA1
- xrandr --output VGA1 --off

Warps the pointer to the new spot and calls GPE with the x/y mask bits set.
When running through the loop to check for scroll event, this overruns the
axes and may try to emulate scroll events based on random garbage in the
memory. If that memory contained non-zero for the scroll type but near-zero
for the increment field, the server would hang in an infinite loop.

This was the trigger for this suggested, never-merged, patch here:
http://patchwork.freedesktop.org/patch/9543/

X.Org Bug 47281 <http://bugs.freedesktop.org/show_bug.cgi?id=47281>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
---
 dix/getevents.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/dix/getevents.c b/dix/getevents.c
index 23bbe06..c960d44 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -1577,6 +1577,9 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
     /* Now turn the smooth-scrolling axes back into emulated button presses
      * for legacy clients, based on the integer delta between before and now */
     for (i = 0; i < valuator_mask_size(&mask); i++) {
+        if (i >= pDev->valuator->numAxes)
+            break;
+
         if (!valuator_mask_isset(&mask, i))
             continue;
 
-- 
1.7.7.3