Drop invalid ABS_MT_TRACKING_ID changes
authorPeter Hutterer <peter.hutterer@who-t.net>
Tue, 1 Apr 2014 07:01:39 +0000 (17:01 +1000)
committerPeter Hutterer <peter.hutterer@who-t.net>
Thu, 3 Apr 2014 03:31:40 +0000 (13:31 +1000)
commit6cbf971b3969de37a2a8e5c6cb02a0648210a6af
tree5ab62d7ba66d46c1f8b46a8f2ba7630e2da4d867
parent27df93737ee4a7d20d913e408d5f9f8d2bb33bad
Drop invalid ABS_MT_TRACKING_ID changes

Follow-up to
commit 41334b5b40cd5456f5f584b55d8888aaafa1f26e
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Thu Mar 6 11:54:00 2014 +1000

    If the tracking ID changes during SYN_DROPPED, terminate the touch first

In normal mode, we may get double tracking ID events in the same slot, but
only if we either have a user-generated event sequence (uinput) or a malicious
device that tries to send data on a slot > dev->num_slots.
Since the client is unlikely to be able to handle these events, discard the
ABS_MT_TRACKING_ID completely. This is a bug somewhere in the stack, so
complain and hobble on along.

Note: the kernel doesn't allow that, but we cap to num_slots anyway, see
66fee1bec4c4b021e1b54adcd775cf6e2aa84869.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
libevdev/libevdev.c
test/test-libevdev-events.c