diff options
| author | Thomas Klausner <wiz@NetBSD.org> | 2013-06-25 18:34:32 +0200 |
|---|---|---|
| committer | Ulrich Sibiller <uli42@gmx.de> | 2016-10-19 21:40:27 +0200 |
| commit | ac3d26251f8de17839dbdada457ffcd670338d0a (patch) | |
| tree | 7ac7dd5f34d7ba40df25b550028f2baead126532 /nx-X11/lib/X11/Font.c | |
| parent | 61fdf93ef56818c081fb775a17fdc513315957c3 (diff) | |
| download | nx-libs-ac3d26251f8de17839dbdada457ffcd670338d0a.tar.gz nx-libs-ac3d26251f8de17839dbdada457ffcd670338d0a.tar.bz2 nx-libs-ac3d26251f8de17839dbdada457ffcd670338d0a.zip | |
Fix out-of-range comparison in _XF86BigfontQueryFont
clang complained (correctly):
warning: comparison of constant 768614336404564650 with expression
of type 'CARD32' (aka 'unsigned int') is always true
[-Wtautological-constant-out-of-range-compare]
[While LONG_MAX is correct, since it's used in size_t math, the
numbers have to be limited to 32-bit range to be usable by 32-bit
clients, and values beyond that range are far more likely to be
bugs in the data from the server than valid numbers of characters
in a font. -alan- ]
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
Diffstat (limited to 'nx-X11/lib/X11/Font.c')
| -rw-r--r-- | nx-X11/lib/X11/Font.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/nx-X11/lib/X11/Font.c b/nx-X11/lib/X11/Font.c index d48b7d0ff..26f29d301 100644 --- a/nx-X11/lib/X11/Font.c +++ b/nx-X11/lib/X11/Font.c @@ -588,7 +588,7 @@ _XF86BigfontQueryFont ( if (!(extcodes->serverCapabilities & CAP_VerifiedLocal)) { struct shmid_ds buf; if (!(shmctl(reply.shmid, IPC_STAT, &buf) >= 0 - && reply.nCharInfos < (LONG_MAX / sizeof(XCharStruct)) + && reply.nCharInfos < (INT_MAX / sizeof(XCharStruct)) && buf.shm_segsz >= reply.shmsegoffset + reply.nCharInfos * sizeof(XCharStruct) + sizeof(CARD32) && *(CARD32 *)(addr + reply.shmsegoffset + reply.nCharInfos * sizeof(XCharStruct)) == extcodes->serverSignature)) { shmdt(addr); |