xinput crashes on wacom properties list

Binary package hint: xinput

$ xinput list
⎡ Virtual core pointer id=2 [master pointer (3)]
⎜ ↳ Virtual core XTEST pointer id=4 [slave pointer (2)]
⎜ ↳ TPPS/2 IBM TrackPoint id=11 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet eraser id=13 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet touch id=14 [slave pointer (2)]
⎜ ↳ Serial Wacom Tablet id=15 [slave pointer (2)]
⎜ ↳ Macintosh mouse button emulation id=16 [slave pointer (2)]
⎣ Virtual core keyboard id=3 [master keyboard (2)]
    ↳ Virtual core XTEST keyboard id=5 [slave keyboard (3)]
    ↳ Power Button id=6 [slave keyboard (3)]
    ↳ Video Bus id=7 [slave keyboard (3)]
    ↳ Sleep Button id=8 [slave keyboard (3)]
    ↳ UVC Camera (17ef:480c) id=9 [slave keyboard (3)]
    ↳ AT Translated Set 2 keyboard id=10 [slave keyboard (3)]
    ↳ ThinkPad Extra Buttons id=12 [slave keyboard (3)]

$ xinput list-props 14
Device 'Serial Wacom Tablet touch':
 Device Enabled (125): 1
 Device Accel Profile (243): 0
 Device Accel Constant Deceleration (244): 1.000000
 Device Accel Adaptive Deceleration (246): 1.000000
 Device Accel Velocity Scaling (247): 10.000000
 Wacom Tablet Area (268): 0, 0, 2631, 1652
 Wacom Rotation (269): 0
 Wacom Serial IDs (271): 227, 0, 3, 0
 Wacom TwinView Resolution (272): 0, 0, 0, 0
 Wacom Display Options (273): -1, 0, 1
 Wacom Screen Area (274): 0, 0, 1280, 800
 Wacom Proximity Threshold (275): 0
 Wacom Capacity (276): -1
 Wacom Pressure Threshold (277): 7
 Wacom Sample and Suppress (278): 2, 4
 Wacom Enable Touch (279): 1
 Wacom Hover Click (280): 1
 Wacom Tool Type (281): "TOUCH" (283)
X Error of failed request: BadAtom (invalid Atom parameter)
  Major opcode of failed request: 17 (X_GetAtomName)
  Atom id in failed request: 0x0
  Serial number of failed request: 57
  Current serial number in output stream: 57
 Wacom Button Actions (282): "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), $

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: xinput 1.5.0-2
ProcVersionSignature: Ubuntu 2.6.32-21.31-generic 2.6.32.11+drm33.2
Uname: Linux 2.6.32-21-generic x86_64
Architecture: amd64
Date: Wed Apr 14 16:09:25 2010
InstallationMedia: Error: [Errno 13] Permission denied: '/var/log/installer/media-info'
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: xinput

This used to work at least on March 12th if not later. I seem to recall using it on the 31st or so.

This also breaks being able to use xinput set-prop for things like 'xinput set-prop 12 "Wacom Rotation" 1'

Something is returning a very invalid Atom number to the end of XIGetProperty list for the Wacom Button Actions (282). This patch adds some defensiveness to xinput to at least not crash, but is not the source of the real problem.

With above patch, xinput list-props 14 shows:

 Wacom Button Actions (282): "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (0), "None" (120946279055360)

note the giant final atom number.

Ah-ha, got it. Atoms are packed as 32bit values, and on 64bit systems, this will mean the last atom in the list copies 4 bytes out of xinput's heap after the end of the data buffer. This patch is a real fix and corrects the dereferenced size so that the resulting atom is zero-extended instead of filling the high half with garbage.

This bug was fixed in the package xinput - 1.5.0-2ubuntu1

---------------
xinput (1.5.0-2ubuntu1) lucid; urgency=low

  * src/property.c: Atoms from XIGetProperty are 32 bit (LP: #563457).
 -- Kees Cook <email address hidden> Wed, 14 Apr 2010 21:48:14 -0700