request-length.c (3525B)
1 /* 2 * Copyright © 2017 Broadcom 3 * 4 * Permission is hereby granted, free of charge, to any person obtaining a 5 * copy of this software and associated documentation files (the "Software"), 6 * to deal in the Software without restriction, including without limitation 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 8 * and/or sell copies of the Software, and to permit persons to whom the 9 * Software is furnished to do so, subject to the following conditions: 10 * 11 * The above copyright notice and this permission notice (including the next 12 * paragraph) shall be included in all copies or substantial portions of the 13 * Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS 21 * IN THE SOFTWARE. 22 */ 23 24 #include <unistd.h> 25 #include <stdlib.h> 26 #include <poll.h> 27 #include <xcb/xcb.h> 28 #include <xcb/bigreq.h> 29 #include <xcb/xinput.h> 30 31 int main(int argc, char **argv) 32 { 33 xcb_connection_t *c = xcb_connect(NULL, NULL); 34 int fd = xcb_get_file_descriptor(c); 35 36 struct { 37 uint8_t extension; 38 uint8_t opcode; 39 uint16_t length; 40 uint32_t length_bigreq; 41 uint32_t win; 42 int num_masks; 43 uint16_t pad; 44 } xise_req = { 45 .extension = 0, 46 .opcode = XCB_INPUT_XI_SELECT_EVENTS, 47 /* The server triggers BadValue on a zero num_mask */ 48 .num_masks = 0, 49 .win = 0, 50 51 /* This is the value that triggers the bug. */ 52 .length_bigreq = 0, 53 }; 54 55 xcb_query_extension_cookie_t cookie; 56 xcb_query_extension_reply_t *rep; 57 58 cookie = xcb_query_extension(c, 15, "XInputExtension"); 59 rep = xcb_query_extension_reply(c, cookie, NULL); 60 xise_req.extension = rep->major_opcode; 61 62 free(xcb_big_requests_enable_reply(c, xcb_big_requests_enable(c), NULL)); 63 64 /* Manually write out the bad request. XCB can't help us here.*/ 65 write(fd, &xise_req, sizeof(xise_req)); 66 67 /* Block until the server has processed our mess and throws an 68 * error. If we get disconnected, then the server has noticed what we're 69 * up to. If we get an error back from the server, it looked at our fake 70 * request - which shouldn't happen. 71 */ 72 struct pollfd pfd = { 73 .fd = fd, 74 .events = POLLIN, 75 }; 76 poll(&pfd, 1, -1); 77 78 if (pfd.revents & POLLHUP) { 79 /* We got killed by the server for being naughty. Yay! */ 80 return 0; 81 } 82 83 /* We didn't get disconnected, that's bad. If we get a BadValue from our 84 * request, we at least know that the bug triggered. 85 * 86 * If we get anything else back, something else has gone wrong. 87 */ 88 xcb_generic_error_t error; 89 int r = read(fd, &error, sizeof(error)); 90 91 if (r == sizeof(error) && 92 error.error_code == 2 /* BadValue */ && 93 error.major_code == xise_req.extension && 94 error.minor_code == XCB_INPUT_XI_SELECT_EVENTS) 95 return 1; /* Our request was processed, which shouldn't happen */ 96 97 /* Something else bad happened. We got something back but it's not the 98 * error we expected. If this happens, it needs to be investigated. */ 99 100 return 2; 101 }