Bug 326967

Summary: static array overrun calcomp driver
Product: [openSUSE] openSUSE 10.3 Reporter: Dirk Mueller <dmueller>
Component: X.OrgAssignee: Stefan Dirsch <sndirsch>
Status: RESOLVED FIXED QA Contact: E-mail List <xorg-maintainer-bugs>
Severity: Normal    
Priority: P5 - None CC: rguenther
Version: Beta 3   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Dirk Mueller 2007-09-20 21:40:05 UTC 
xf86-input-calcomp-1.1.1/src/xf86Calcomp.c:412



                    x = priv->packet[2] + priv->packet[1] * 128
                                         +(priv->packet[0] & 0x03) *128*128;
                    y = priv->packet[5] + priv->packet[4]*128 +priv->packet[3]*128*128;
                    y = priv->max_y -y;


priv->packet[5] is out of bounds.
Comment 1 Stefan Dirsch 2007-09-20 21:57:11 UTC 
Yes, CALCOMP_PACKET_SIZE needs to be changed accordingly.
Comment 2 Stefan Dirsch 2007-09-21 05:58:43 UTC 
fixed.