Check max to see if an event type is valid

There's a gap in the range between EV_SW and EV_LED. Trying to enable one
of those bits will segfault.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>

diff --git a/libevdev/libevdev.c b/libevdev/libevdev.c
index 7bebe32..ca57e26 100644 (file)
--- a/libevdev/libevdev.c
+++ b/libevdev/libevdev.c
@@ -1139,12 +1139,18 @@ libevdev_set_abs_info(struct libevdev *dev, unsigned int code, const struct inpu
 LIBEVDEV_EXPORT int
 libevdev_enable_event_type(struct libevdev *dev, unsigned int type)
 {
+       int max;
+
        if (type > EV_MAX)
                return -1;
 
        if (libevdev_has_event_type(dev, type))
                return 0;
 
+       max = libevdev_event_type_get_max(type);
+       if (max == -1)
+               return -1;
+
        set_bit(dev->bits, type);
 
        if (type == EV_REP) {
@@ -1158,9 +1164,15 @@ libevdev_enable_event_type(struct libevdev *dev, unsigned int type)
 LIBEVDEV_EXPORT int
 libevdev_disable_event_type(struct libevdev *dev, unsigned int type)
 {
+       int max;
+
        if (type > EV_MAX || type == EV_SYN)
                return -1;
 
+       max = libevdev_event_type_get_max(type);
+       if (max == -1)
+               return -1;
+
        clear_bit(dev->bits, type);
 
        return 0;
@@ -1192,7 +1204,7 @@ libevdev_enable_event_code(struct libevdev *dev, unsigned int type,
 
        max = type_to_mask(dev, type, &mask);
 
-       if (code > max)
+       if (code > max || (int)max == -1)
                return -1;
 
        set_bit(mask, code);
@@ -1219,7 +1231,7 @@ libevdev_disable_event_code(struct libevdev *dev, unsigned int type, unsigned in
 
        max = type_to_mask(dev, type, &mask);
 
-       if (code > max)
+       if (code > max || (int)max == -1)
                return -1;
 
        clear_bit(mask, code);

diff --git a/test/test-libevdev-has-event.c b/test/test-libevdev-has-event.c
index 5af3530..3aca23b 100644 (file)
--- a/test/test-libevdev-has-event.c
+++ b/test/test-libevdev-has-event.c
@@ -775,6 +775,9 @@ START_TEST(test_device_enable_bit_invalid)
        ck_assert_int_eq(libevdev_enable_event_code(dev, EV_ABS, ABS_MAX + 1, &abs), -1);
        ck_assert_int_eq(libevdev_enable_event_code(dev, EV_MAX + 1, ABS_MAX + 1, &abs), -1);
        ck_assert_int_eq(libevdev_enable_event_type(dev, EV_MAX + 1), -1);
+       /* there's a gap between EV_SW and EV_LED */
+       ck_assert_int_eq(libevdev_enable_event_type(dev, EV_LED - 1), -1);
+       ck_assert_int_eq(libevdev_enable_event_code(dev, EV_LED - 1, 0, NULL), -1);
 
        ck_assert_int_eq(libevdev_enable_event_code(dev, EV_ABS, ABS_Y, NULL), -1);
        ck_assert_int_eq(libevdev_enable_event_code(dev, EV_REP, REP_DELAY, NULL), -1);
@@ -843,6 +846,9 @@ START_TEST(test_device_disable_bit_invalid)
        rc = test_create_abs_device(&uidev, &dev, 1, &abs, -1);
        ck_assert_msg(rc == 0, "Failed to create uinput device: %s", strerror(-rc));
 
+       /* there's a gap between EV_SW and EV_LED */
+       ck_assert_int_eq(libevdev_disable_event_type(dev, EV_LED - 1), -1);
+       ck_assert_int_eq(libevdev_disable_event_code(dev, EV_LED - 1, 0), -1);
        ck_assert_int_eq(libevdev_disable_event_code(dev, EV_ABS, ABS_MAX + 1), -1);
        ck_assert_int_eq(libevdev_disable_event_code(dev, EV_MAX + 1, ABS_MAX + 1), -1);
        ck_assert_int_eq(libevdev_disable_event_type(dev, EV_MAX + 1), -1);