Description Stefan Eßer 2014-08-31 06:53:15 UTC

The problem is an assumption, that does not hold if the new console driver (vt) is used. 

In x11-drivers/xf86-input-keyboard line 1264ff of bsd_KeyMap.c, an assumption is made, that the character returned will be in the range of 0x00 to 0xff.

#define KD_GET_ENTRY(i,n) \
  eascii_to_x[((keymap.key[i].spcl << (n+1)) & 0x100) + keymap.key[i].map[n]]

[...]

void
KbdGetMapping (InputInfoPtr pInfo, KeySymsPtr pKeySyms, CARD8 *pModMap)
{
  KbdDevPtr pKbd = (KbdDevPtr) pInfo->private;
  KeySym        *k;
  int           i;

#ifndef __bsdi__
  switch (pKbd->consType) {

/*
 * XXX wscons has no GIO_KEYMAP
 */
#if (defined (SYSCONS_SUPPORT) || defined (PCVT_SUPPORT)) && defined(GIO_KEYMAP)
  case SYSCONS:
  case PCVT:
    {
      keymap_t keymap;

      if (ioctl(pInfo->fd, GIO_KEYMAP, &keymap) != -1) {
        for (i = 0; i < keymap.n_keys && i < NUM_KEYCODES; i++)
          if (remap[i]) {
            k = map + (remap[i] << 2);
            k[0] = KD_GET_ENTRY(i,0);           /* non-shifed */
            k[1] = KD_GET_ENTRY(i,1);         /* shifted */
            k[2] = KD_GET_ENTRY(i,4);         /* alt */
            k[3] = KD_GET_ENTRY(i,5);         /* alt - shifted */
            if (k[3] == k[2]) k[3] = NoSymbol;
            if (k[2] == k[1]) k[2] = NoSymbol;
            if (k[1] == k[0]) k[1] = NoSymbol;
            if (k[0] == k[2] && k[1] == k[3])
              k[2] = k[3] = NoSymbol;
          }
      }
    }
    break;
#endif /* SYSCONS || PCVT */

The keymap returned by ioctl(GIO_KEYMAP) used to contain characters 
in the selected locale, which meant it was limited to 8 bit values,
effectively.

Now with Unicode support, larger values (>=0x100) can be found in 
keymap files. In my case, the Euro symbol (0x20ac) was the cause
of an out-of-bounds access to the keymap array in line 1265 of bsd_KbdMap.c (assignment to k[2] for Alt "E").

To reproduce, you need to use the "vt" console driver:

Load any keyboard with Unicode characters beyond 0x100 with kbdcontrol (e.g. kbdcontrol -l de). Then start Xorg and see that it crashes with a segfault when trying to load the keymap.