diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-03-31 12:22:35 -0700 |
|---|---|---|
| committer | Ulrich Sibiller <uli42@gmx.de> | 2016-10-12 09:34:39 +0200 |
| commit | dc749a457d62b330051e9fb709960951e05de41b (patch) | |
| tree | 98b4d8a557002e1cabad5aff9abfbb86824553a1 | |
| parent | 37f8d3eb8ec4a44bebaac7893e5881bd59b5440c (diff) | |
| download | nx-libs-dc749a457d62b330051e9fb709960951e05de41b.tar.gz nx-libs-dc749a457d62b330051e9fb709960951e05de41b.tar.bz2 nx-libs-dc749a457d62b330051e9fb709960951e05de41b.zip | |
_XkbReadGetMapReply: reject maxKeyCodes smaller than the minKeyCode
Various other bounds checks in the code assume this is true, so
enforce it when we first get the data from the X server.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
| -rw-r--r-- | nx-X11/lib/X11/XKBGetMap.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/nx-X11/lib/X11/XKBGetMap.c b/nx-X11/lib/X11/XKBGetMap.c index ea2e6b512..5eb1d41bf 100644 --- a/nx-X11/lib/X11/XKBGetMap.c +++ b/nx-X11/lib/X11/XKBGetMap.c @@ -485,6 +485,8 @@ unsigned mask; if ( xkb->device_spec == XkbUseCoreKbd ) xkb->device_spec= rep->deviceID; + if ( rep->maxKeyCode < rep->minKeyCode ) + return BadImplementation; xkb->min_key_code = rep->minKeyCode; xkb->max_key_code = rep->maxKeyCode; |