Commit ced56f32 authored by Carlos Garnacho's avatar Carlos Garnacho Committed by Peter Hutterer

Sync TouchListener memory allocation with population in TouchSetupListeners()

The allocated TouchListener array may fall short by 1 if hitting the worst case
situation where there's an active grab, passive grabs on each window in the
sprite trace and event selection for touch in one of the windows. This may lead
to memory corruptions as the array is overflown.
Signed-off-by: default avatarCarlos Garnacho <carlosg@gnome.org>
Reviewed-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
parent 760be785
......@@ -572,8 +572,8 @@ TouchBuildSprite(DeviceIntPtr sourcedev, TouchPointInfoPtr ti,
return FALSE;
/* Mark which grabs/event selections we're delivering to: max one grab per
* window plus the bottom-most event selection. */
ti->listeners = calloc(sprite->spriteTraceGood + 1, sizeof(*ti->listeners));
* window plus the bottom-most event selection, plus any active grab. */
ti->listeners = calloc(sprite->spriteTraceGood + 2, sizeof(*ti->listeners));
if (!ti->listeners) {
sprite->spriteTraceGood = 0;
return FALSE;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment