Fix an abort if the device speed is NaN
authorOlivier Fourdan <ofourdan@redhat.com>
Thu, 5 Feb 2015 13:33:31 +0000 (14:33 +0100)
committerPeter Hutterer <peter.hutterer@who-t.net>
Fri, 6 Feb 2015 00:26:04 +0000 (10:26 +1000)
commitf420c54a991f714d9821e054ae70f06cfc8894db
treed7460240546677893b4208703d90c6a3a9e85e63
parent65b5647076f72731e3e49dd4ddfbbb09fdb48351
Fix an abort if the device speed is NaN

When using libinput with xf86-input-libinput, the device speed is
represented as a float passed via X properties.

If a buggy client gives a broken value, the conversions that occur
can cause the value of speed to be NaN (not a number), aka infinity.

In C, any comparison with NaN always gives false, whatever the value.

So that test in libinput_device_config_accel_set_speed():

   (speed < 1.0 || speed > 1.0)

will necessarily return FALSE, defeating the test of range.

However, since since any comparison with NaN is false, the
opposite assert() in accelerator_set_speed():

   (speed >= 1.0 && speed <= 1.0)

will be false as well, thus triggering the abort() and the crash of
the entire X server along with it.

The solution is to use the same construct in both routines, so that
it fails gracefully in libinput_device_config_accel_set_speed().

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
src/libinput.c
test/pointer.c