xinput crashes on wacom properties list

Bug #563457 reported by Kees Cook on 2010-04-14
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
X.Org X server
Fix Released
Medium
xf86-input-wacom (Ubuntu)
Undecided
Unassigned
Lucid
Undecided
Unassigned
xinput (Ubuntu)
Medium
Kees Cook
Lucid
Medium
Kees Cook

Bug Description

Binary package hint: xinput

$ xinput list
⎡ Virtual core pointer id=2 [master pointer (3)]
⎜ ↳ Virtual core XTEST pointer id=4 [slave pointer (2)]
⎜ ↳ TPPS/2 IBM TrackPoint id=11 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet eraser id=13 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet touch id=14 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet id=15 [slave pointer (2)]
⎜ ↳ Macintosh mouse button emulation id=16 [slave pointer (2)]
⎣ Virtual core keyboard id=3 [master keyboard (2)]
    ↳ Virtual core XTEST keyboard id=5 [slave keyboard (3)]
    ↳ Power Button id=6 [slave keyboard (3)]
    ↳ Video Bus id=7 [slave keyboard (3)]
    ↳ Sleep Button id=8 [slave keyboard (3)]
    ↳ UVC Camera (17ef:480c) id=9 [slave keyboard (3)]
    ↳ AT Translated Set 2 keyboard id=10 [slave keyboard (3)]
    ↳ ThinkPad Extra Buttons id=12 [slave keyboard (3)]

$ xinput list-props 14
Device 'Serial Wacom Tablet touch':
 Device Enabled (125): 1
 Device Accel Profile (243): 0
 Device Accel Constant Deceleration (244): 1.000000
 Device Accel Adaptive Deceleration (246): 1.000000
 Device Accel Velocity Scaling (247): 10.000000
 Wacom Tablet Area (268): 0, 0, 2631, 1652
 Wacom Rotation (269): 0
 Wacom Serial IDs (271): 227, 0, 3, 0
 Wacom TwinView Resolution (272): 0, 0, 0, 0
 Wacom Display Options (273): -1, 0, 1
 Wacom Screen Area (274): 0, 0, 1280, 800
 Wacom Proximity Threshold (275): 0
 Wacom Capacity (276): -1
 Wacom Pressure Threshold (277): 7
 Wacom Sample and Suppress (278): 2, 4
 Wacom Enable Touch (279): 1
 Wacom Hover Click (280): 1
 Wacom Tool Type (281): "TOUCH" (283)
X Error of failed request: BadAtom (invalid Atom parameter)
  Major opcode of failed request: 17 (X_GetAtomName)
  Atom id in failed request: 0x0
  Serial number of failed request: 57
  Current serial number in output stream: 57
 Wacom Button Actions (282): "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), $

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: xinput 1.5.0-2
ProcVersionSignature: Ubuntu 2.6.32-21.31-generic 2.6.32.11+drm33.2
Uname: Linux 2.6.32-21-generic x86_64
Architecture: amd64
Date: Wed Apr 14 16:09:25 2010
InstallationMedia: Error: [Errno 13] Permission denied: '/var/log/installer/media-info'
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: xinput

Related branches

note that since the xorg/app/xinput git tree doesn't have it's own bugzilla category, I used Apps/other here.

Kees Cook (kees) wrote :

Binary package hint: xinput

$ xinput list
⎡ Virtual core pointer id=2 [master pointer (3)]
⎜ ↳ Virtual core XTEST pointer id=4 [slave pointer (2)]
⎜ ↳ TPPS/2 IBM TrackPoint id=11 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet eraser id=13 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet touch id=14 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet id=15 [slave pointer (2)]
⎜ ↳ Macintosh mouse button emulation id=16 [slave pointer (2)]
⎣ Virtual core keyboard id=3 [master keyboard (2)]
    ↳ Virtual core XTEST keyboard id=5 [slave keyboard (3)]
    ↳ Power Button id=6 [slave keyboard (3)]
    ↳ Video Bus id=7 [slave keyboard (3)]
    ↳ Sleep Button id=8 [slave keyboard (3)]
    ↳ UVC Camera (17ef:480c) id=9 [slave keyboard (3)]
    ↳ AT Translated Set 2 keyboard id=10 [slave keyboard (3)]
    ↳ ThinkPad Extra Buttons id=12 [slave keyboard (3)]

$ xinput list-props 14
Device 'Serial Wacom Tablet touch':
 Device Enabled (125): 1
 Device Accel Profile (243): 0
 Device Accel Constant Deceleration (244): 1.000000
 Device Accel Adaptive Deceleration (246): 1.000000
 Device Accel Velocity Scaling (247): 10.000000
 Wacom Tablet Area (268): 0, 0, 2631, 1652
 Wacom Rotation (269): 0
 Wacom Serial IDs (271): 227, 0, 3, 0
 Wacom TwinView Resolution (272): 0, 0, 0, 0
 Wacom Display Options (273): -1, 0, 1
 Wacom Screen Area (274): 0, 0, 1280, 800
 Wacom Proximity Threshold (275): 0
 Wacom Capacity (276): -1
 Wacom Pressure Threshold (277): 7
 Wacom Sample and Suppress (278): 2, 4
 Wacom Enable Touch (279): 1
 Wacom Hover Click (280): 1
 Wacom Tool Type (281): "TOUCH" (283)
X Error of failed request: BadAtom (invalid Atom parameter)
  Major opcode of failed request: 17 (X_GetAtomName)
  Atom id in failed request: 0x0
  Serial number of failed request: 57
  Current serial number in output stream: 57
 Wacom Button Actions (282): "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), $

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: xinput 1.5.0-2
ProcVersionSignature: Ubuntu 2.6.32-21.31-generic 2.6.32.11+drm33.2
Uname: Linux 2.6.32-21-generic x86_64
Architecture: amd64
Date: Wed Apr 14 16:09:25 2010
InstallationMedia: Error: [Errno 13] Permission denied: '/var/log/installer/media-info'
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: xinput

Kees Cook (kees) wrote :
tags: added: regression-potential
Brian Murray (brian-murray) wrote :

This used to work at least on March 12th if not later. I seem to recall using it on the 31st or so.

This also breaks being able to use xinput set-prop for things like 'xinput set-prop 12 "Wacom Rotation" 1'

Kees Cook (kees) wrote :

Something is returning a very invalid Atom number to the end of XIGetProperty list for the Wacom Button Actions (282). This patch adds some defensiveness to xinput to at least not crash, but is not the source of the real problem.

Kees Cook (kees) wrote :

With above patch, xinput list-props 14 shows:

 Wacom Button Actions (282): "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (120946279055360)

note the giant final atom number.

Kees Cook (kees) on 2010-04-15
Changed in xf86-input-wacom (Ubuntu):
status: New → Invalid
Changed in xinput (Ubuntu):
status: New → Triaged
status: Triaged → Invalid
Kees Cook (kees) on 2010-04-15
Changed in xinput (Ubuntu):
status: Invalid → Triaged
Kees Cook (kees) wrote :

Ah-ha, got it. Atoms are packed as 32bit values, and on 64bit systems, this will mean the last atom in the list copies 4 bytes out of xinput's heap after the end of the data buffer. This patch is a real fix and corrects the dereferenced size so that the resulting atom is zero-extended instead of filling the high half with garbage.

Changed in xinput (Ubuntu Lucid):
importance: Undecided → Medium
milestone: none → ubuntu-10.04
assignee: nobody → Kees Cook (kees)
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package xinput - 1.5.0-2ubuntu1

---------------
xinput (1.5.0-2ubuntu1) lucid; urgency=low

  * src/property.c: Atoms from XIGetProperty are 32 bit (LP: #563457).
 -- Kees Cook <email address hidden> Wed, 14 Apr 2010 21:48:14 -0700

Changed in xinput (Ubuntu Lucid):
status: Triaged → Fix Released

i'm pretty sure the first hunk isn't needed since Xlib will return long arrays for 32-bit values (even on 64-bit). The conversion is done internally, hence the code should work as-is. the xi2 code looks good though.

you can easily test the above if you change the inputproto.pc file on your machine to announce version 1.5. then run configure again and it'll build without the xi2 bits - using xi1's property requests instead.

I haven't had a chance to test this, but since the xi2 stuff is correct, can we commit it?

Thanks for the patch, committed (in half)

commit 87ec8d42c7f8e4e0613bcbe59fb2db991e1e4acb
Author: Kees Cook <email address hidden>
Date: Wed Apr 14 21:19:48 2010 -0700

    Atoms from XIGetProperty are 32bits (#27657)

Changed in xorg-server:
importance: Unknown → Medium
status: Unknown → Fix Released
Changed in xorg-server:
importance: Medium → Unknown
Changed in xorg-server:
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.