The request is followed by mask_len 4-byte units, then followed by the actual modifiers.
Reported-by: Alan Coopersmith <[email protected]> Signed-off-by: Peter Hutterer <[email protected]> --- Xi/xipassivegrab.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c index eccec0a..8aba977 100644 --- a/Xi/xipassivegrab.c +++ b/Xi/xipassivegrab.c @@ -63,7 +63,7 @@ SProcXIPassiveGrabDevice(ClientPtr client) swaps(&stuff->mask_len); swaps(&stuff->num_modifiers); - mods = (uint32_t *) &stuff[1]; + mods = (uint32_t *) &stuff[1] + stuff->mask_len; for (i = 0; i < stuff->num_modifiers; i++, mods++) { swapl(mods); -- 1.8.4.2 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
