scjones@thor.UUCP (Larry Jones) (11/09/90)
X Window System Bug Report
xbugs@expo.lcs.mit.edu
VERSION:
R4
CLIENT MACHINE and OPERATING SYSTEM:
N/A
DISPLAY TYPE:
N/A
WINDOW MANAGER:
N/A
AREA:
Xt
SYNOPSIS:
Extension events cause Xt to access past the end of an array and
behave indeterminately.
DESCRIPTION:
During event handling, ConvertTypeToMask in Event.c is called to
get the event mask and grab processing corresponding to an event.
This is done by using the event type to index into a fixed size
array -- if the event is not a core event, the event type is
greater than the number of elements in the array and random values
are returned or a memory access error occurs. In either case, the
event is not dispatched correctly.
REPEAT BY:
Inspection.
SAMPLE FIX:
Since extension events are non-maskable, they should be processed as
such. Table entries 0 and 1 are bogus entries and just happen to
contain appropriate values, so I fudged as follows:
*** Event.c.old Sun Sep 30 09:52:01 1990
--- Event.c Thu Nov 8 18:52:48 1990
***************
*** 754,759 ****
--- 754,761 ----
};
eventType &= 0x7f; /* Events sent with XSendEvent have high bit set. */
+ if (eventType >= sizeof masks / sizeof masks[0])
+ eventType = 0; /* Fake out extension events. */
(*mask) = masks[eventType].mask;
(*grabType) = masks[eventType].grabType;
}
----
Larry Jones UUCP: uunet!sdrc!thor!scjones
SDRC scjones@thor.UUCP
2000 Eastman Dr. BIX: ltl
Milford, OH 45150-2789 AT&T: (513) 576-2070
The living dead don't NEED to solve word problems. -- Calvin