Fix crash due to uninitialized VModMap fields.

Backport of commit 81b3b0cce088866dc3cda099d7c8d6655849fd43 Author: Tomas Janousek <tomi@nomi.cz> Date: Wed May 20 15:03:01 2009 +0200 Bug #6428, #16458, #21464: Fix crash due to uninitialized VModMap fields. In ProcXkbGetKbdByName, mrep.firstVModMapKey, .nVModMapKeys and .totalVModMapKeys were not initialized, contained random values and caused accesses to unallocated and later modified memory, causing XkbSizeVirtualModMap and XkbWriteVirtualModMap to see different number of nonzero values, resulting in writes past the end of an array in XkbSendMap. This patch initializes those values sensibly and reverts commits 5c0a2088 and 6dd4fc46, which have been plain non-sense. Signed-off-by: Tomas Janousek <tomi@nomi.cz> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

Fix crash due to uninitialized VModMap fields.
a4fad8f5 · Ulrich Sibiller · 989398af · a4fad8f5
Commit a4fad8f5 authored Dec 17, 2018 by Ulrich Sibiller
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 2 deletions

xkb.c nx-X11/programs/Xserver/xkb/xkb.c +4 -2

No files found.
--- a/nx-X11/programs/Xserver/xkb/xkb.c
+++ b/nx-X11/programs/Xserver/xkb/xkb.c
@@ -1185,7 +1185,7 @@ XkbSizeVirtualModMap(XkbDescPtr xkb,xkbGetMapReply *rep)
 	rep->totalVModMapKeys= 0;
 	return 0;
    }
-    for (nRtrn=i=0;i<rep->nVModMapKeys-1;i++) {
+    for (nRtrn=i=0;i<rep->nVModMapKeys;i++) {
 	if (xkb->server->vmodmap[i+rep->firstVModMapKey]!=0)
 	    nRtrn++;
    }
@@ -5128,7 +5128,7 @@ ProcXkbGetKbdByName(ClientPtr client)
 	    mrep.present = 0;
 	    mrep.totalSyms = mrep.totalActs =
 		mrep.totalKeyBehaviors= mrep.totalKeyExplicit= 
-		mrep.totalModMapKeys= 0;
+		mrep.totalModMapKeys= mrep.totalVModMapKeys= 0;
 	    if (rep.reported&(XkbGBN_TypesMask|XkbGBN_ClientSymbolsMask)) {
 		mrep.present|= XkbKeyTypesMask;
 		mrep.firstType = 0;
@@ -5154,6 +5154,8 @@ ProcXkbGetKbdByName(ClientPtr client)
 			mrep.firstKeyExplicit = finfo.xkb->min_key_code;
 		mrep.nKeyActs = mrep.nKeyBehaviors = 
 			mrep.nKeyExplicit = XkbNumKeys(finfo.xkb);
+		mrep.firstVModMapKey= finfo.xkb->min_key_code;
+		mrep.nVModMapKeys= XkbNumKeys(finfo.xkb);
 	    }
 	    else {
 		mrep.virtualMods= 0;