1/*
2 * Copyright © 2017 Broadcom
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
21 * IN THE SOFTWARE.
22 */
23
24#include <unistd.h>
25#include <stdlib.h>
26#include <poll.h>
27#include <xcb/xcb.h>
28#include <xcb/bigreq.h>
29#include <xcb/xinput.h>
30
31int main(int argc, char **argv)
32{
33    xcb_connection_t *c = xcb_connect(NULL, NULL);
34    int fd = xcb_get_file_descriptor(c);
35
36    struct {
37        uint8_t extension;
38        uint8_t opcode;
39        uint16_t length;
40        uint32_t length_bigreq;
41        uint32_t win;
42        int num_masks;
43        uint16_t pad;
44    } xise_req = {
45        .extension = 0,
46        .opcode = XCB_INPUT_XI_SELECT_EVENTS,
47        /* The server triggers BadValue on a zero num_mask */
48        .num_masks = 0,
49        .win = 0,
50
51        /* This is the value that triggers the bug. */
52        .length_bigreq = 0,
53    };
54
55    xcb_query_extension_cookie_t cookie;
56    xcb_query_extension_reply_t *rep;
57
58    cookie = xcb_query_extension(c, 15, "XInputExtension");
59    rep = xcb_query_extension_reply(c, cookie, NULL);
60    xise_req.extension = rep->major_opcode;
61
62    free(xcb_big_requests_enable_reply(c, xcb_big_requests_enable(c), NULL));
63
64    /* Manually write out the bad request.  XCB can't help us here.*/
65    write(fd, &xise_req, sizeof(xise_req));
66
67    /* Block until the server has processed our mess and throws an
68     * error. If we get disconnected, then the server has noticed what we're
69     * up to. If we get an error back from the server, it looked at our fake
70     * request - which shouldn't happen.
71     */
72    struct pollfd pfd = {
73        .fd = fd,
74        .events = POLLIN,
75    };
76    poll(&pfd, 1, -1);
77
78    if (pfd.revents & POLLHUP) {
79        /* We got killed by the server for being naughty. Yay! */
80        return 0;
81    }
82
83    /* We didn't get disconnected, that's bad. If we get a BadValue from our
84     * request, we at least know that the bug triggered.
85     *
86     * If we get anything else back, something else has gone wrong.
87     */
88    xcb_generic_error_t error;
89    int r = read(fd, &error, sizeof(error));
90
91    if (r == sizeof(error) &&
92        error.error_code == 2 /* BadValue */  &&
93        error.major_code == xise_req.extension &&
94        error.minor_code == XCB_INPUT_XI_SELECT_EVENTS)
95        return 1; /* Our request was processed, which shouldn't happen */
96
97    /* Something else bad happened. We got something back but it's not the
98     * error we expected. If this happens, it needs to be investigated. */
99
100    return 2;
101}
102