[oe] xmonobut

[Phil Blundell]

On Tue, 2009-11-03 at 14:51 +0100, Holger Hans Peter Freyther wrote:
> On Monday 28 September 2009 02:16:07 Alain2210 wrote:
> > Hello,
> > 
> > xmonobut segfault. I need this patch to get it works again.
> 
> > -  unsigned char map[6];
> > +  unsigned char map[31];
> ...
> > +      buts = XGetPointerMapping(dpy, map, 32);
> ,,.
> > +      while((rst = XSetPointerMapping(dpy, map, 32)) == MappingBusy);
> 
> 31. vs 32... please send an updated patch

Looking at this patch again, I think it is just broken and (even aside
from the 31/32 thing) should not be applied.

I guess the cause of the original segfault was that "buts" is set to a
value greater than six and hence the XSetPointerMapping() call runs off
the end of the array.  However, the solution presented in the patch,
i.e. just ignoring the return value from XGetPointerMapping()
altogether, doesn't seem too good either since this will cause
XSetPointerMapping() to read uninitialised garbage from the balance of
the array.

A minimal fix for the original crash would probably be to insert
something like:

if (buts > sizeof(map))
  buts = sizeof(map);

after the XGetPointerMapping() call.  A slightly better fix would
perhaps be to make an initial call to XGetPointerMapping() with nmap=0
to find out how many buttons are present, then to dynamically allocate
an array of the right size and read the mapping into it.

p.