filter: validate custom acceleration function's points size

Adds min and max size limit for custom acceleration function's points.
Adds tests to make sure validation works properly.

Signed-off-by: Yinon Burgansky <51504-Yinon@users.noreply.gitlab.freedesktop.org>

diff --git a/src/filter-custom.c b/src/filter-custom.c
index 57cdea0e1b36672ec70f12e39c7bc91e3abb65f5..0172f7c0505379eebd01cf94e2a202b7e60607bf 100644 (file)
--- a/src/filter-custom.c
+++ b/src/filter-custom.c
@@ -49,6 +49,12 @@ create_custom_accel_function(double step, const double *points, size_t npoints)
        if (step <= 0 || step > LIBINPUT_ACCEL_STEP_MAX)
                return NULL;
 
+       for (size_t idx = 0; idx < npoints; idx++) {
+               if (points[idx] < LIBINPUT_ACCEL_POINT_MIN_VALUE ||
+                   points[idx] > LIBINPUT_ACCEL_POINT_MAX_VALUE)
+                       return NULL;
+       }
+
        struct custom_accel_function *cf = zalloc(sizeof(*cf) + npoints * sizeof(*points));
        cf->last_time = 0;
        cf->step = step;

diff --git a/src/libinput-private.h b/src/libinput-private.h
index 042ef07fd1703c3ce8bc75aff5457f7fe0753544..298d542226c505457879cea548d3ea6e2905fc1b 100644 (file)
--- a/src/libinput-private.h
+++ b/src/libinput-private.h
@@ -244,6 +244,16 @@ struct libinput_device_config_send_events {
  */
 #define LIBINPUT_ACCEL_NPOINTS_MAX 64
 
+/**
+ * Custom acceleration function min point value
+ */
+#define LIBINPUT_ACCEL_POINT_MIN_VALUE 0
+
+/**
+ * Custom acceleration function max point value
+ */
+#define LIBINPUT_ACCEL_POINT_MAX_VALUE 10000
+
 /**
  * Custom acceleration function max step size
  */

diff --git a/src/libinput.c b/src/libinput.c
index 37451fa12475826fd40dd938dbe52a9012732d9c..c40266d7c4c37e33154472d19e30b4130a73c38d 100644 (file)
--- a/src/libinput.c
+++ b/src/libinput.c
@@ -4267,6 +4267,12 @@ libinput_config_accel_set_points(struct libinput_config_accel *config,
        if (npoints < LIBINPUT_ACCEL_NPOINTS_MIN || npoints > LIBINPUT_ACCEL_NPOINTS_MAX)
                return LIBINPUT_CONFIG_STATUS_INVALID;
 
+       for (size_t idx = 0; idx < npoints; idx++) {
+               if (points[idx] < LIBINPUT_ACCEL_POINT_MIN_VALUE ||
+                   points[idx] > LIBINPUT_ACCEL_POINT_MAX_VALUE)
+                       return LIBINPUT_CONFIG_STATUS_INVALID;
+       }
+
        struct libinput_config_accel_custom_func *func = libinput_config_accel_custom_func_create();
 
        func->step = step;

diff --git a/test/test-pointer.c b/test/test-pointer.c
index c9f2e344b5c42cf415936c01da45b0f399c68e6f..f8eb1eff2367641d8381f68bf3e581714e8091ce 100644 (file)
--- a/test/test-pointer.c
+++ b/test/test-pointer.c
@@ -2281,12 +2281,25 @@ START_TEST(pointer_accel_config)
        struct libinput_device *device = dev->libinput_device;
        enum libinput_config_status status;
        enum libinput_config_accel_profile profile;
-       double custom_speed[] = {0.1234, -0.567, 0.89};
-       double custom_step[] = {0.5, 0.003, 2.7};
-       double custom_npoints = 4;
-       double custom_points[3][4] = {{1.0, 2.0, 2.5, 2.6},
-                                     {0.1, 0.3, 0.4, 0.45},
-                                     {1.0, 3.0, 4.5, 4.5}};
+       enum libinput_config_status valid = LIBINPUT_CONFIG_STATUS_SUCCESS,
+                                   invalid = LIBINPUT_CONFIG_STATUS_INVALID;
+       enum libinput_config_accel_type fallback = LIBINPUT_ACCEL_TYPE_FALLBACK,
+                                       motion = LIBINPUT_ACCEL_TYPE_MOTION;
+       struct custom_config_test {
+               enum libinput_config_accel_type accel_type;
+               double step;
+               double points[4];
+               enum libinput_config_status expected_status;
+       } tests[] = {
+               { fallback,  0.5, { 1.0, 2.0, 2.5, 2.6 },  valid },
+               { motion,  0.003, { 0.1, 0.3, 0.4, 0.45 }, valid },
+               { fallback,  2.7, { 1.0, 3.0, 4.5, 4.5 },  valid },
+               { motion,      0, { 1.0, 2.0, 2.5, 2.6 },  invalid },
+               { fallback,   -1, { 1.0, 2.0, 2.5, 2.6 },  invalid },
+               { motion,   1e10, { 1.0, 2.0, 2.5, 2.6 },  invalid },
+               { fallback,    1, { 1.0, 2.0, -2.5, 2.6 }, invalid },
+               { motion,      1, { 1.0, 2.0, 1e10, 2.6 }, invalid },
+       };
 
        ck_assert(libinput_device_config_accel_is_available(device));
 
@@ -2298,14 +2311,13 @@ START_TEST(pointer_accel_config)
        ck_assert_ptr_nonnull(config_custom_default);
        ck_assert_ptr_nonnull(config_custom_changed);
 
-
-       for (size_t idx = 0; idx < ARRAY_LENGTH(custom_speed); idx++) {
+       ARRAY_FOR_EACH(tests, t) {
                status = libinput_config_accel_set_points(config_custom_changed,
-                                                         LIBINPUT_ACCEL_TYPE_FALLBACK,
-                                                         custom_step[idx],
-                                                         custom_npoints,
-                                                         custom_points[idx]);
-               ck_assert_int_eq(status, LIBINPUT_CONFIG_STATUS_SUCCESS);
+                                                         t->accel_type,
+                                                         t->step,
+                                                         ARRAY_LENGTH(t->points),
+                                                         t->points);
+               ck_assert_int_eq(status, t->expected_status);
 
                status = libinput_device_config_accel_apply(device, config_custom_changed);
                ck_assert_int_eq(status, LIBINPUT_CONFIG_STATUS_SUCCESS);