1*4882a593Smuzhiyun /*
2*4882a593Smuzhiyun * Copyright © 2017 Broadcom
3*4882a593Smuzhiyun *
4*4882a593Smuzhiyun * Permission is hereby granted, free of charge, to any person obtaining a
5*4882a593Smuzhiyun * copy of this software and associated documentation files (the "Software"),
6*4882a593Smuzhiyun * to deal in the Software without restriction, including without limitation
7*4882a593Smuzhiyun * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8*4882a593Smuzhiyun * and/or sell copies of the Software, and to permit persons to whom the
9*4882a593Smuzhiyun * Software is furnished to do so, subject to the following conditions:
10*4882a593Smuzhiyun *
11*4882a593Smuzhiyun * The above copyright notice and this permission notice (including the next
12*4882a593Smuzhiyun * paragraph) shall be included in all copies or substantial portions of the
13*4882a593Smuzhiyun * Software.
14*4882a593Smuzhiyun *
15*4882a593Smuzhiyun * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16*4882a593Smuzhiyun * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17*4882a593Smuzhiyun * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18*4882a593Smuzhiyun * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19*4882a593Smuzhiyun * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20*4882a593Smuzhiyun * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21*4882a593Smuzhiyun * IN THE SOFTWARE.
22*4882a593Smuzhiyun */
23*4882a593Smuzhiyun
24*4882a593Smuzhiyun #include <unistd.h>
25*4882a593Smuzhiyun #include <stdlib.h>
26*4882a593Smuzhiyun #include <poll.h>
27*4882a593Smuzhiyun #include <xcb/xcb.h>
28*4882a593Smuzhiyun #include <xcb/bigreq.h>
29*4882a593Smuzhiyun #include <xcb/xinput.h>
30*4882a593Smuzhiyun
main(int argc,char ** argv)31*4882a593Smuzhiyun int main(int argc, char **argv)
32*4882a593Smuzhiyun {
33*4882a593Smuzhiyun xcb_connection_t *c = xcb_connect(NULL, NULL);
34*4882a593Smuzhiyun int fd = xcb_get_file_descriptor(c);
35*4882a593Smuzhiyun
36*4882a593Smuzhiyun struct {
37*4882a593Smuzhiyun uint8_t extension;
38*4882a593Smuzhiyun uint8_t opcode;
39*4882a593Smuzhiyun uint16_t length;
40*4882a593Smuzhiyun uint32_t length_bigreq;
41*4882a593Smuzhiyun uint32_t win;
42*4882a593Smuzhiyun int num_masks;
43*4882a593Smuzhiyun uint16_t pad;
44*4882a593Smuzhiyun } xise_req = {
45*4882a593Smuzhiyun .extension = 0,
46*4882a593Smuzhiyun .opcode = XCB_INPUT_XI_SELECT_EVENTS,
47*4882a593Smuzhiyun /* The server triggers BadValue on a zero num_mask */
48*4882a593Smuzhiyun .num_masks = 0,
49*4882a593Smuzhiyun .win = 0,
50*4882a593Smuzhiyun
51*4882a593Smuzhiyun /* This is the value that triggers the bug. */
52*4882a593Smuzhiyun .length_bigreq = 0,
53*4882a593Smuzhiyun };
54*4882a593Smuzhiyun
55*4882a593Smuzhiyun xcb_query_extension_cookie_t cookie;
56*4882a593Smuzhiyun xcb_query_extension_reply_t *rep;
57*4882a593Smuzhiyun
58*4882a593Smuzhiyun cookie = xcb_query_extension(c, 15, "XInputExtension");
59*4882a593Smuzhiyun rep = xcb_query_extension_reply(c, cookie, NULL);
60*4882a593Smuzhiyun xise_req.extension = rep->major_opcode;
61*4882a593Smuzhiyun
62*4882a593Smuzhiyun free(xcb_big_requests_enable_reply(c, xcb_big_requests_enable(c), NULL));
63*4882a593Smuzhiyun
64*4882a593Smuzhiyun /* Manually write out the bad request. XCB can't help us here.*/
65*4882a593Smuzhiyun write(fd, &xise_req, sizeof(xise_req));
66*4882a593Smuzhiyun
67*4882a593Smuzhiyun /* Block until the server has processed our mess and throws an
68*4882a593Smuzhiyun * error. If we get disconnected, then the server has noticed what we're
69*4882a593Smuzhiyun * up to. If we get an error back from the server, it looked at our fake
70*4882a593Smuzhiyun * request - which shouldn't happen.
71*4882a593Smuzhiyun */
72*4882a593Smuzhiyun struct pollfd pfd = {
73*4882a593Smuzhiyun .fd = fd,
74*4882a593Smuzhiyun .events = POLLIN,
75*4882a593Smuzhiyun };
76*4882a593Smuzhiyun poll(&pfd, 1, -1);
77*4882a593Smuzhiyun
78*4882a593Smuzhiyun if (pfd.revents & POLLHUP) {
79*4882a593Smuzhiyun /* We got killed by the server for being naughty. Yay! */
80*4882a593Smuzhiyun return 0;
81*4882a593Smuzhiyun }
82*4882a593Smuzhiyun
83*4882a593Smuzhiyun /* We didn't get disconnected, that's bad. If we get a BadValue from our
84*4882a593Smuzhiyun * request, we at least know that the bug triggered.
85*4882a593Smuzhiyun *
86*4882a593Smuzhiyun * If we get anything else back, something else has gone wrong.
87*4882a593Smuzhiyun */
88*4882a593Smuzhiyun xcb_generic_error_t error;
89*4882a593Smuzhiyun int r = read(fd, &error, sizeof(error));
90*4882a593Smuzhiyun
91*4882a593Smuzhiyun if (r == sizeof(error) &&
92*4882a593Smuzhiyun error.error_code == 2 /* BadValue */ &&
93*4882a593Smuzhiyun error.major_code == xise_req.extension &&
94*4882a593Smuzhiyun error.minor_code == XCB_INPUT_XI_SELECT_EVENTS)
95*4882a593Smuzhiyun return 1; /* Our request was processed, which shouldn't happen */
96*4882a593Smuzhiyun
97*4882a593Smuzhiyun /* Something else bad happened. We got something back but it's not the
98*4882a593Smuzhiyun * error we expected. If this happens, it needs to be investigated. */
99*4882a593Smuzhiyun
100*4882a593Smuzhiyun return 2;
101*4882a593Smuzhiyun }
102