@samitouri / QOSamiQemu / commits / 4dc8407837

ui/input: do not assert() when tracing invalid input

It's possible to reach an assert() in the input tracing code by sending some out of range input values via D-Bus for ex: #0 0x00007fec8652186c in __pthread_kill_implementation () at /lib64/libc.so.6 #1 0x00007fec864c648e in raise () at /lib64/libc.so.6 #2 0x00007fec864ad7b3 in abort () at /lib64/libc.so.6 #3 0x00007fec864ae804 in __libc_message_impl.cold () at /lib64/libc.so.6 #4 0x00007fec864be345 in __assert_fail () at /lib64/libc.so.6 #5 0x00005597964c551e in qapi_enum_lookup[cold] () #6 0x000055979650514a in qemu_input_event_send_impl () #7 0x0000559796505a4d in qemu_input_queue_btn () #8 0x00007fec85780c19 in dbus_mouse_press () at /usr/bin/../lib64/qemu/ui-dbus.so #9 0x00007fec857912fc in _g_dbus_codegen_marshal_BOOLEAN__OBJECT_UINT.part.0 () at /usr/bin/../lib64/qemu/ui-dbus.so #10 0x00007fec874cce7c in g_closure_invoke () at /lib64/libgobject-2.0.so.0 #11 0x00007fec874eb849 in signal_emit_unlocked_R.isra.0 () at /lib64/libgobject-2.0.so.0 #12 0x00007fec874ec66f in g_signal_emitv () at /lib64/libgobject-2.0.so.0 #13 0x00007fec85797e0a in _qemu_dbus_display1_mouse_skeleton_handle_method_call () at /usr/bin/../lib64/qemu/ui-dbus.so Other paths in input code accept out-of-range values (qemu_input_key_value_to_number etc). Let it pass tracing. Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Marc-André Lureau committed May 3, 2026 at 10:48 UTC 4dc8407837c9825264e12ffb22c4c9991de2c5c7
1 file changed +4 -4
ui/input.c
+4 -4
@@ -207,22 +207,22 @@ static void qemu_input_event_trace(QemuConsole *src, InputEvent *evt)
207 break;
208 case INPUT_EVENT_KIND_BTN:
209 btn = evt->u.btn.data;
210 - name = InputButton_str(btn->button);
210 + name = btn->button < INPUT_BUTTON__MAX ? InputButton_str(btn->button) : "invalid";
211 trace_input_event_btn(idx, name, btn->down);
212 break;
213 case INPUT_EVENT_KIND_REL:
214 move = evt->u.rel.data;
215 - name = InputAxis_str(move->axis);
215 + name = move->axis < INPUT_AXIS__MAX ? InputAxis_str(move->axis) : "invalid";
216 trace_input_event_rel(idx, name, move->value);
217 break;
218 case INPUT_EVENT_KIND_ABS:
219 move = evt->u.abs.data;
220 - name = InputAxis_str(move->axis);
220 + name = move->axis < INPUT_AXIS__MAX ? InputAxis_str(move->axis) : "invalid";
221 trace_input_event_abs(idx, name, move->value);
222 break;
223 case INPUT_EVENT_KIND_MTT:
224 mtt = evt->u.mtt.data;
225 - name = InputAxis_str(mtt->axis);
225 + name = mtt->axis < INPUT_AXIS__MAX ? InputAxis_str(mtt->axis) : "invalid";
226 trace_input_event_mtt(idx, name, mtt->value);
227 break;
228 case INPUT_EVENT_KIND__MAX: