xserver-xorg-input-synaptics: Changes to 'debian-unstable'

[Julien Cristau <jcristau@alioth.debian.org>]

 ChangeLog        |   30 ++++++++++++++++++++++++++++++
 debian/changelog |    8 ++++++++
 src/synaptics.c  |    2 ++
 3 files changed, 40 insertions(+)

New commits:
commit b050c11c2ff7e9e46e790cd4748aeb9a9e5aa865
Author: Julien Cristau <jcristau@debian.org>
Date:   Mon Oct 1 21:55:11 2012 +0200

    Upload to unstable

diff --git a/ChangeLog b/ChangeLog
index 1c01053..eaef7c9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,33 @@
+commit eae444eb1a85d2401501d29f9a6c654c046f806b
+Author: Peter Hutterer <peter.hutterer@who-t.net>
+Date:   Thu Aug 30 16:38:38 2012 +1000
+
+    Reset num_active_touches on DeviceOff (#52496)
+    
+    When disabling the device, reset num_active_touches to zero. Otherwise,
+    num_active_touches stays at the value it was on DeviceOff(). Future touches
+    add to that value until the index may go past priv->open_slots[].
+    That causes spurious memory corruption on touch ends.
+    
+    And as of 55fc42e7c9b4948cadd4f98ef7b6a3b12e268e3e we ignore pre-existing
+    touches anyway.
+    
+    Test-case:
+    - place num_touches fingers on the touchpad
+    - xinput disable <device>
+    - lift fingers
+    - xinput enable <device>
+    - place finger on device, num_active_touches is now (num_touches + 1)
+    
+    X.Org Bug 52496 <http://bugs.freedesktop.org/show_bug.cgi?id=52496>
+    
+    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
+    (cherry picked from commit a245d42f53096b1ae81e6702729f97ca508e5b5b)
+    
+    Conflicts:
+    	src/synaptics.c
+
 commit d5ff9d8b0b186cf39695df84a10984eac559b746
 Author: Peter Hutterer <peter.hutterer@who-t.net>
 Date:   Tue Jun 12 13:46:34 2012 +1000
diff --git a/debian/changelog b/debian/changelog
index 9801715..614c3e4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+xserver-xorg-input-synaptics (1.6.2-2) unstable; urgency=low
+
+  * Pull latest synaptics-1.6-branch:
+    - Reset num_active_touches on DeviceOff (closes: #681796).  Fixes memory
+      corruption leading to crashes.
+
+ -- Julien Cristau <jcristau@debian.org>  Mon, 01 Oct 2012 21:55:06 +0200
+
 xserver-xorg-input-synaptics (1.6.2-1) unstable; urgency=low
 
   * New upstream release, from the 1.6 branch.

commit eae444eb1a85d2401501d29f9a6c654c046f806b
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Thu Aug 30 16:38:38 2012 +1000

    Reset num_active_touches on DeviceOff (#52496)
    
    When disabling the device, reset num_active_touches to zero. Otherwise,
    num_active_touches stays at the value it was on DeviceOff(). Future touches
    add to that value until the index may go past priv->open_slots[].
    That causes spurious memory corruption on touch ends.
    
    And as of 55fc42e7c9b4948cadd4f98ef7b6a3b12e268e3e we ignore pre-existing
    touches anyway.
    
    Test-case:
    - place num_touches fingers on the touchpad
    - xinput disable <device>
    - lift fingers
    - xinput enable <device>
    - place finger on device, num_active_touches is now (num_touches + 1)
    
    X.Org Bug 52496 <http://bugs.freedesktop.org/show_bug.cgi?id=52496>
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
    (cherry picked from commit a245d42f53096b1ae81e6702729f97ca508e5b5b)
    
    Conflicts:
    	src/synaptics.c

diff --git a/src/synaptics.c b/src/synaptics.c
index cd9f936..a28e984 100644
--- a/src/synaptics.c
+++ b/src/synaptics.c
@@ -1154,6 +1154,7 @@ SynapticsReset(SynapticsPrivate * priv)
     priv->prev_z = 0;
     priv->prevFingers = 0;
 #ifdef HAVE_MULTITOUCH
+    priv->num_active_touches = 0;
     memset(priv->open_slots, 0, priv->num_slots * sizeof(int));
 #endif
 }
@@ -3118,6 +3119,7 @@ UpdateTouchState(InputInfoPtr pInfo, struct SynapticsHwState *hw)
         if (hw->slot_state[i] == SLOTSTATE_OPEN) {
             priv->open_slots[priv->num_active_touches] = i;
             priv->num_active_touches++;
+            BUG_WARN(priv->num_active_touches > priv->num_slots);
         }
         else if (hw->slot_state[i] == SLOTSTATE_CLOSE) {
             Bool found = FALSE;