ratbagd: put in a check for invalid -1 sent down the wire

Before we send something as "u" down DBus, check that it's not -1, a commonly
used error code in libratbag. If so, return a dbus error instead and log where
this occured so we can fix it.

This should at least help spot these errors quickly while at the same time
hopefully not crashing piper anymore.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

ratbagd/ratbagd-button.c

@@ -58,6 +58,8 @@ static int ratbagd_button_get_type(sd_bus *bus,
 
 	t = ratbag_button_get_type(button->lib_button);
 
+	verify_unsigned_int(t);
+
 	return sd_bus_message_append(reply, "u", t);
 }
 
@@ -74,6 +76,8 @@ static int ratbagd_button_get_button(sd_bus *bus,
 
 	b = ratbag_button_get_button(button->lib_button);
 
+	verify_unsigned_int(b);
+
 	return sd_bus_message_append(reply, "u", b);
 }
 
@@ -134,6 +138,8 @@ static int ratbagd_button_get_special(sd_bus *bus,
 		special = RATBAG_BUTTON_ACTION_SPECIAL_UNKNOWN;
 	}
 
+	verify_unsigned_int(special);
+
 	return sd_bus_message_append(reply, "u", special);
 }
 
@@ -218,6 +224,9 @@ static int ratbagd_button_get_macro(sd_bus *bus,
 			abort();
 		}
 
+		verify_unsigned_int(type);
+		verify_unsigned_int(value);
+
 		r = sd_bus_message_append(reply, "(uu)", type, value);
 		if (r < 0)
 			return r;
@@ -300,6 +309,8 @@ static int ratbagd_button_get_action_type(sd_bus *bus,
 	if (type == RATBAG_BUTTON_ACTION_TYPE_KEY)
 		type = RATBAG_BUTTON_ACTION_TYPE_UNKNOWN;
 
+	verify_unsigned_int(type);
+
 	return sd_bus_message_append(reply, "u", type);
 }
 
@@ -329,6 +340,7 @@ static int ratbagd_button_get_action_types(sd_bus *bus,
 		if (!ratbag_button_has_action_type(button->lib_button, *t))
 			continue;
 
+		verify_unsigned_int(*t);
 		r = sd_bus_message_append(reply, "u", *t);
 		if (r < 0)
 			return r;

ratbagd/ratbagd-led.c

@@ -78,6 +78,9 @@ static int ratbagd_led_get_mode(sd_bus *bus,
 	enum ratbag_led_mode mode;
 
 	mode = ratbag_led_get_mode(led->lib_led);
+
+	verify_unsigned_int(mode);
+
 	return sd_bus_message_append(reply, "u", mode);
 }
 
@@ -124,6 +127,8 @@ static int ratbagd_led_get_type(sd_bus *bus,
 
 	type = ratbag_led_get_type(led->lib_led);
 
+	verify_unsigned_int(type);
+
 	return sd_bus_message_append(reply, "u", type);
 }
 
@@ -191,6 +196,9 @@ static int ratbagd_led_get_effect_duration(sd_bus *bus,
 	int rate;
 
 	rate = ratbag_led_get_effect_duration(led->lib_led);
+
+	verify_unsigned_int(rate);
+
 	return sd_bus_message_append(reply, "u", rate);
 }
 
@@ -239,6 +247,9 @@ static int ratbagd_led_get_brightness(sd_bus *bus,
 	unsigned int brightness;
 
 	brightness = ratbag_led_get_brightness(led->lib_led);
+
+	verify_unsigned_int(brightness);
+
 	return sd_bus_message_append(reply, "u", brightness);
 }
 

ratbagd/ratbagd-resolution.c

@@ -214,6 +214,7 @@ ratbagd_resolution_get_resolutions(sd_bus *bus,
 	assert(ndpis <= ARRAY_LENGTH(dpis));
 
 	for (unsigned int i = 0; i < ndpis; i++) {
+		verify_unsigned_int(dpis[i]);
 		r = sd_bus_message_append(reply, "u", dpis[i]);
 		if (r < 0)
 			return r;
@@ -238,6 +239,9 @@ ratbagd_resolution_get_resolution(sd_bus *bus,
 	xres = ratbag_resolution_get_dpi_x(lib_resolution);
 	yres = ratbag_resolution_get_dpi_y(lib_resolution);
 
+	verify_unsigned_int(xres);
+	verify_unsigned_int(yres);
+
 	return sd_bus_message_append(reply, "(uu)", xres, yres);
 }
 
@@ -293,6 +297,7 @@ ratbagd_resolution_get_report_rate(sd_bus *bus,
 	int rate;
 
 	rate = ratbag_resolution_get_report_rate(lib_resolution);
+	verify_unsigned_int(rate);
 	return sd_bus_message_append(reply, "u", rate);
 }
 
@@ -320,6 +325,7 @@ ratbagd_resolution_get_report_rates(sd_bus *bus,
 	assert(nrates <= ARRAY_LENGTH(rates));
 
 	for (unsigned int i = 0; i < nrates; i++) {
+		verify_unsigned_int(rates[i]);
 		r = sd_bus_message_append(reply, "u", rates[i]);
 		if (r < 0)
 			return r;

ratbagd/ratbagd.h

@@ -176,6 +176,19 @@ struct ratbagd_device *ratbagd_device_next(struct ratbagd_device *device);
 	     (_device);						\
 	     _device = (_safe),				\
 	     _safe = (_safe) ? ratbagd_device_next(_safe) : NULL)
+
+/* Verify that _val is not -1. This traps DBus API errors where we end up
+ * sending a valid-looking index across and then fail on the other side.
+ *
+ * do {} while(0) so we can terminate with a ; without the compiler
+ * complaining about an empty statement;
+ * */
+#define verify_unsigned_int(_val) \
+	do { if ((int)_val == -1) { \
+		log_error("%s:%d - %s: expected unsigned int, got -1\n", __FILE__, __LINE__, __func__); \
+		return -EINVAL; \
+	} } while(0)
+
 /*
  * Context
  */