Ubuntu
xinput package

  1. Bug #563457
  2. Comment #0

Comment 0 for bug 563457

Revision history for this message
In , Kees Cook (kees) wrote :

Created an attachment (id=35047)
fix Atom width

https://launchpad.net/bugs/563457

$ xinput list-props 14
...
 Wacom Button Actions (282): "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), X Error of failed request: BadAtom (invalid Atom parameter)
  Major opcode of failed request: 17 (X_GetAtomName)
  Atom id in failed request: 0x0
  Serial number of failed request: 57
  Current serial number in output stream: 57

Atoms are packed as 32bit values, and on 64bit systems, this will mean the last atom in the list copies 4 bytes out of xinput's heap after the end of the data buffer. This patch corrects the dereferenced size so that the resulting atom is zero-extended instead of filling the high half with garbage.