Commit 2df83bb1 authored by Alan Coopersmith's avatar Alan Coopersmith

Add request length checking test cases for some Xinput 2.x requests

Signed-off-by: Alan Coopersmith's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer's avatarPeter Hutterer <peter.hutterer@who-t.net>
parent d153a85f
......@@ -124,6 +124,11 @@ test_XIGetClientPointer(void)
request.win = INVALID_WINDOW_ID;
request_XIGetClientPointer(&client_request, &request, BadWindow);
printf("Testing invalid length\n");
client_request.req_len -= 4;
request_XIGetClientPointer(&client_request, &request, BadLength);
client_request.req_len += 4;
test_data.cp_is_set = FALSE;
printf("Testing window None, unset ClientPointer.\n");
......
......@@ -139,6 +139,7 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req,
int local_modifiers;
int mask_len;
client_request.req_len = req->length;
rc = ProcXIPassiveGrabDevice(&client_request);
assert(rc == error);
......@@ -190,6 +191,13 @@ test_XIPassiveGrabDevice(void)
request_XIPassiveGrabDevice(&client_request, request, BadDevice,
request->deviceid);
printf("Testing invalid length\n");
request->length -= 2;
request_XIPassiveGrabDevice(&client_request, request, BadLength,
client_request.errorValue);
/* re-init request since swapped length test leaves some values swapped */
request_init(request, XIPassiveGrabDevice);
request->grab_window = CLIENT_WINDOW_ID;
request->deviceid = XIAllMasterDevices;
printf("Testing invalid grab types\n");
......
......@@ -201,6 +201,10 @@ test_XIQueryPointer(void)
test_data.dev = devices.mouse;
request.deviceid = devices.mouse->id;
request_XIQueryPointer(&client_request, &request, Success);
/* test REQUEST_SIZE_MATCH */
client_request.req_len -= 4;
request_XIQueryPointer(&client_request, &request, BadLength);
}
int
......
......@@ -198,6 +198,9 @@ test_XIWarpPointer(void)
request_XIWarpPointer(&client_request, &request, Success);
/* FIXME: src_x/y checks */
client_request.req_len -= 2; /* invalid length */
request_XIWarpPointer(&client_request, &request, BadLength);
}
int
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment