Comment 17 for bug 1172094

Revision history for this message
In , Bugs-i (bugs-i) wrote :

After suspending/resuming I notice this error repeated a whole lot of times
on xorg 1.13rc4 + synaptics 1.6.2 (with finger on touchpad while suspending/resuming by closing lid and pressing power button to wake up):

==3097== Invalid write of size 4
==3097== at 0xAEBFE95: UpdateTouchState.isra.12 (synaptics.c:3132)
==3097== by 0xAEC1532: HandleState (synaptics.c:3224)
==3097== by 0xAEC3F73: ReadInput (synaptics.c:1725)
==3097== by 0x19B656: xf86SigioReadInput (xf86Events.c:298)
==3097== by 0x1C4C97: xf86SIGIO (sigio.c:110)
==3097== by 0x56D9CAF: ??? (in /lib/x86_64-linux-gnu/libpthread-2.15.so)
==3097== by 0x56D8D0D: __read_nocancel (syscall-template.S:82)
==3097== by 0x2B8525: _XSERVTransSocketRead (unistd.h:45)
==3097== by 0x2B2FC0: ReadRequestFromClient (io.c:332)
==3097== by 0x15D878: Dispatch (dispatch.c:399)
==3097== by 0x14C559: main (main.c:295)
==3097== Address 0xaae8da8 is 0 bytes after a block of size 8 alloc'd
==3097== at 0x4C2B6CD: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==3097== by 0xAEC0F13: DeviceControl (synaptics.c:1277)
==3097== by 0x153082: ActivateDevice (devices.c:547)
==3097== by 0x1AA30D: xf86NewInputDevice (xf86Xinput.c:858)
==3097== by 0x1C0655: device_added (udev.c:231)
==3097== by 0x1C0CB2: config_udev_init (udev.c:386)
==3097== by 0x1BFC08: config_init (config.c:48)
==3097== by 0x19DB4D: InitInput (xf86Init.c:989)
==3097== by 0x14C518: main (main.c:265)

I guess if it happens multiple times it could get out of bounds enough to cause overflow..