AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xcb: fix mouse event compression with certain configurations

Browse Source 
The bug was that we are accessing memory beyond 32 bytes. It is
not safe to cast xcb_generic_event_t to Xlib's XI2 structs before
we have memmoved bits to the expected layout (for details see
QXcbConnection::xi2PrepareXIGenericDeviceEvent). We do this memmove
later in the stack, when processing the XI2 events. Here at the
compression step we can simply extract the necessary sourceId by
reading the sourceId offset in the data.

Task-number: QTBUG-68033
Change-Id: I6962bbb8f8b0834d6f780f62017fefa2de7f47df
Reviewed-by: Mikhail Svetkin <mikhail.svetkin@qt.io>
Reviewed-by: Laszlo Agocs <laszlo.agocs@qt.io>
This commit is contained in:
Gatis Paeglis 2018-06-06 11:32:39 +02:00 committed by Jani Heikkinen
parent fc5da399c3
commit 02be685084
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/plugins/platforms/xcb/qxcbconnection.cpp
View File

@ -1683,12 +1683,14 @@ bool QXcbConnection::compressEvent(xcb_generic_event_t *event, int currentIndex,
if (!hasXInput2())
return false;
// compress XI_Motion, but not from tablet devices
// compress XI_Motion
if (isXIType(event, m_xiOpCode, XI_Motion)) {
#if QT_CONFIG(tabletevent)
xXIDeviceEvent *xdev = reinterpret_cast<xXIDeviceEvent *>(event);
// Xlib's XI2 events need memmove, see xi2PrepareXIGenericDeviceEvent()
auto sourceId = *reinterpret_cast<uint16_t *>(reinterpret_cast<char *>(&xdev->sourceid) + 4);
if (!QCoreApplication::testAttribute(Qt::AA_CompressTabletEvents) &&
const_cast<QXcbConnection *>(this)->tabletDataForDevice(xdev->sourceid))
const_cast<QXcbConnection *>(this)->tabletDataForDevice(sourceId))
return false;
#endif // QT_CONFIG(tabletevent)
for (int j = nextIndex; j < eventqueue->size(); ++j) {