Skip site navigation (1)Skip section navigation (2) 
Date:      Sun, 31 Aug 2014 06:53:15 +0000
From:      bugzilla-noreply@freebsd.org
To:        freebsd-ports-bugs@FreeBSD.org
Subject:   [Bug 193192] New: vt keymaps with Unicode characters crash X server on start
Message-ID:  <bug-193192-13@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193192

            Bug ID: 193192
           Summary: vt keymaps with Unicode characters crash X server on
                    start
           Product: Ports Tree
           Version: Latest
          Hardware: Any
                OS: Any
            Status: Needs Triage
          Severity: Affects Many People
          Priority: Normal
         Component: Individual Port(s)
          Assignee: freebsd-ports-bugs@FreeBSD.org
          Reporter: se@FreeBSD.org

The problem is an assumption, that does not hold if the new console driver (vt)
is used. 

In x11-drivers/xf86-input-keyboard line 1264ff of bsd_KeyMap.c, an assumption
is made, that the character returned will be in the range of 0x00 to 0xff.

#define KD_GET_ENTRY(i,n) \
  eascii_to_x[((keymap.key[i].spcl << (n+1)) & 0x100) + keymap.key[i].map[n]]

[...]

void
KbdGetMapping (InputInfoPtr pInfo, KeySymsPtr pKeySyms, CARD8 *pModMap)
{
  KbdDevPtr pKbd = (KbdDevPtr) pInfo->private;
  KeySym        *k;
  int           i;

#ifndef __bsdi__
  switch (pKbd->consType) {

/*
 * XXX wscons has no GIO_KEYMAP
 */
#if (defined (SYSCONS_SUPPORT) || defined (PCVT_SUPPORT)) &&
defined(GIO_KEYMAP)
  case SYSCONS:
  case PCVT:
    {
      keymap_t keymap;

      if (ioctl(pInfo->fd, GIO_KEYMAP, &keymap) != -1) {
        for (i = 0; i < keymap.n_keys && i < NUM_KEYCODES; i++)
          if (remap[i]) {
            k = map + (remap[i] << 2);
            k[0] = KD_GET_ENTRY(i,0);           /* non-shifed */
            k[1] = KD_GET_ENTRY(i,1);         /* shifted */
            k[2] = KD_GET_ENTRY(i,4);         /* alt */
            k[3] = KD_GET_ENTRY(i,5);         /* alt - shifted */
            if (k[3] == k[2]) k[3] = NoSymbol;
            if (k[2] == k[1]) k[2] = NoSymbol;
            if (k[1] == k[0]) k[1] = NoSymbol;
            if (k[0] == k[2] && k[1] == k[3])
              k[2] = k[3] = NoSymbol;
          }
      }
    }
    break;
#endif /* SYSCONS || PCVT */

The keymap returned by ioctl(GIO_KEYMAP) used to contain characters 
in the selected locale, which meant it was limited to 8 bit values,
effectively.

Now with Unicode support, larger values (>=0x100) can be found in 
keymap files. In my case, the Euro symbol (0x20ac) was the cause
of an out-of-bounds access to the keymap array in line 1265 of bsd_KbdMap.c
(assignment to k[2] for Alt "E").

To reproduce, you need to use the "vt" console driver:

Load any keyboard with Unicode characters beyond 0x100 with kbdcontrol (e.g.
kbdcontrol -l de). Then start Xorg and see that it crashes with a segfault when
trying to load the keymap.

-- 
You are receiving this mail because:
You are the assignee for the bug.

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-193192-13>