Bug#696110: X segfaults in lnxACPIGetEventFromOs when ACPI event has less than 4 parameters
Control: forwarded -1 https://bugs.freedesktop.org/show_bug.cgi?id=55329
On Mon, Dec 17, 2012 at 07:47:19PM +0100, Julien Cristau wrote:
> On Sun, Dec 16, 2012 at 21:44:17 +0100, Evgeni Golov wrote:
>
> > after the "recent" upgrade of acpid [1], the Xorg on my ThinkPad X61 Tablet
> > started to segfault while moving the screen from Laptop to Tablet and back.
> > A short backtrace (attached) and chat with ron in #debian-x revieled the
> > adding of two new ACPI messages to acpid [2] as the evil.
> >
> > acpid now sends "video/tabletmode TBLT off" and "video/tabletmode TBLT on"
> > when I move my screen. This is fine, until you read the source of
> > lnxACPIGetEventFromOs in hw/xfree86/os-support/linux/lnx_acpi.c. The code
> > just expects the video/* message to have four parameters, but the new ones
> > acpid send have only three, resulting in a strtoul on NULL and a segfault.
> >
> Can't this be fixed in acpid? Are there other consumers for these
> events that expect a different format?
Hi Julien,
well, yeah, acpid could be patched back to drop these two events and
yes this will stop the Xorg on my tablet from crashing. But this would
just hide the real problem again as Xorg should really try to check
whether the acpi event is in a sane format before trying to parse it.
The code is just waiting for explode on another occurence otherwise.
Short Google search gives at least:
- the upstream bug for that issue [1]
- an entry in the ArchLinux forums about the same issue
I cannot find any current consumers of the feature in acpid, but I do
think it is useful as it gives a generic interface to catch tablet
rotation (there was an event for that on IBM hardware before, but that
was IBM specific).
Greets
Evgeni
[1] https://bugs.freedesktop.org/show_bug.cgi?id=55329
[2] https://bbs.archlinux.org/viewtopic.php?id=150290
--
Bruce Schneier can read and understand Perl programs.
Reply to: