Skip to content

Commit 5f3cd22

Browse files
committed
port fix for a segfault: stefan11111/kdrive@0aa5ca4
This fixes an incorrect loop condtion, as it is possible to skip over NUM_PROT when incrementing This causes a segfault in kdrive, when km->i_prot would have to loop, instead continuing to read out of bounds. I couldn't get tinyx to also segfault, but that doesn't mean it's impossible. It might happen on different hardware.
1 parent feab72c commit 5f3cd22

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

kdrive/linux/mouse.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -729,6 +729,9 @@ static void MouseFirstProtocol(Kmouse * km, char *prot)
729729
for (i = 0; i < NUM_PROT; i++)
730730
ErrorF(" %s", kmouseProts[i]->name);
731731
ErrorF("\n");
732+
km->i_prot = 0;
733+
km->prot = kmouseProts[km->i_prot];
734+
ErrorF("Falling back to %s\n", km->prot->name);
732735
} else {
733736
km->prot = kmouseProts[km->i_prot];
734737
if (km->tty && !km->prot->tty)
@@ -754,7 +757,7 @@ static void MouseNextProtocol(Kmouse * km)
754757
do {
755758
if (!km->prot)
756759
km->i_prot = 0;
757-
else if (++km->i_prot == NUM_PROT)
760+
else if (++km->i_prot >= NUM_PROT)
758761
km->i_prot = 0;
759762
km->prot = kmouseProts[km->i_prot];
760763
} while (km->prot->tty != km->tty);

0 commit comments

Comments
 (0)