XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-04-14 17:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

xkb: fix swapping bug in ProcXkbGetKbdByName()

Browse Source 
We've been adding the individual sub-packet's payload bytes *after*
the swapping, which is leading to totally wrong sizes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult
2025-08-14 16:25:02 +02:00
committed by Enrico Weigelt
parent e40749beb3
commit 39dfed90fd
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
xkb/xkb.c
View File

@@ -6056,6 +6056,8 @@ ProcXkbGetKbdByName(ClientPtr client)
char *buf = payload_walk + sizeof(mrep);
XkbAssembleMap(client, new, mrep, buf);
const size_t mrep_length = mrep.length; /* save before swapping */
if (client->swapped) {
swaps(&mrep.sequenceNumber);
swapl(&mrep.length);
@@ -6065,13 +6067,15 @@ ProcXkbGetKbdByName(ClientPtr client)
}
memcpy(payload_walk, &mrep, sizeof(mrep));
payload_walk = buf + (mrep.length * 4) - (sizeof(mrep) - sizeof(xGenericReply));
payload_walk = buf + (mrep_length * 4) - (sizeof(mrep) - sizeof(xGenericReply));
}
if (reported & XkbGBN_CompatMapMask) {
char *buf = payload_walk + sizeof(crep);
XkbAssembleCompatMap(client, new->compat, crep, buf);
const size_t crep_length = crep.length; /* save before swapping */
if (client->swapped) {
swaps(&crep.sequenceNumber);
swapl(&crep.length);
@@ -6081,13 +6085,15 @@ ProcXkbGetKbdByName(ClientPtr client)
}
memcpy(payload_walk, &crep, sizeof(crep));
payload_walk = buf + (crep.length * 4) - (sizeof(crep) - sizeof(xGenericReply));
payload_walk = buf + (crep_length * 4) - (sizeof(crep) - sizeof(xGenericReply));
}
if (reported & XkbGBN_IndicatorMapMask) {
char *buf = payload_walk + sizeof(irep);
XkbAssembleIndicatorMap(client, new->indicators, irep, buf);
const size_t irep_length = irep.length;
if (client->swapped) {
swaps(&irep.sequenceNumber);
swapl(&irep.length);
@@ -6096,13 +6102,15 @@ ProcXkbGetKbdByName(ClientPtr client)
}
memcpy(payload_walk, &irep, sizeof(irep));
payload_walk = buf + (irep.length * 4) - (sizeof(irep) - sizeof(xGenericReply));
payload_walk = buf + (irep_length * 4) - (sizeof(irep) - sizeof(xGenericReply));
}
if (reported & (XkbGBN_KeyNamesMask | XkbGBN_OtherNamesMask)) {
char *buf = payload_walk + sizeof(nrep);
XkbAssembleNames(client, new, nrep, buf);
const size_t nrep_length = nrep.length; /* save before swapping */
if (client->swapped) {
swaps(&nrep.sequenceNumber);
swapl(&nrep.length);
@@ -6112,13 +6120,15 @@ ProcXkbGetKbdByName(ClientPtr client)
}
memcpy(payload_walk, &nrep, sizeof(nrep));
payload_walk = buf + (nrep.length * 4) - (sizeof(nrep) - sizeof(xGenericReply));
payload_walk = buf + (nrep_length * 4) - (sizeof(nrep) - sizeof(xGenericReply));
}
if (reported & XkbGBN_GeometryMask) {
char *buf = payload_walk + sizeof(grep);
XkbAssembleGeometry(client, new->geom, grep, buf);
const size_t grep_length = grep.length; /* save before swapping */
if (client->swapped) {
swaps(&grep.sequenceNumber);
swapl(&grep.length);
@@ -6134,7 +6144,7 @@ ProcXkbGetKbdByName(ClientPtr client)
}
memcpy(payload_walk, &grep, sizeof(grep));
payload_walk = buf + (grep.length * 4) - (sizeof(grep) - sizeof(xGenericReply));
payload_walk = buf + (grep_length * 4) - (sizeof(grep) - sizeof(xGenericReply));
}
WriteToClient(client, sizeof(xkbGetKbdByNameReply), &rep);