diff options
author | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | 2016-10-13 14:02:51 +0200 |
---|---|---|
committer | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | 2016-10-13 14:02:51 +0200 |
commit | 133c91f732c6259fa9099100cd5b781d5b1cbfa1 (patch) | |
tree | 478aa88a8c42cbcb8221dd6680a16131556b49be /nx-X11/lib/X11/GetFPath.c | |
parent | 051d521f6e20761ba6831cecd91883da960fa931 (diff) | |
parent | a9f623f0a63372ca0705e8394fadf514dec55b1c (diff) | |
download | nx-libs-133c91f732c6259fa9099100cd5b781d5b1cbfa1.tar.gz nx-libs-133c91f732c6259fa9099100cd5b781d5b1cbfa1.tar.bz2 nx-libs-133c91f732c6259fa9099100cd5b781d5b1cbfa1.zip |
Merge branch 'uli42-pr/libX11_debian_backports' into 3.6.x
Attributes GH PR #215: https://github.com/ArcticaProject/nx-libs/pull/215
Diffstat (limited to 'nx-X11/lib/X11/GetFPath.c')
-rw-r--r-- | nx-X11/lib/X11/GetFPath.c | 36 |
1 files changed, 22 insertions, 14 deletions
diff --git a/nx-X11/lib/X11/GetFPath.c b/nx-X11/lib/X11/GetFPath.c index 7d497c92e..abd4a5dbd 100644 --- a/nx-X11/lib/X11/GetFPath.c +++ b/nx-X11/lib/X11/GetFPath.c @@ -28,15 +28,18 @@ in this Software without prior written authorization from The Open Group. #include <config.h> #endif #include "Xlibint.h" +#include <limits.h> char **XGetFontPath( register Display *dpy, int *npaths) /* RETURN */ { xGetFontPathReply rep; - register long nbytes; - char **flist; - char *ch; + unsigned long nbytes; + char **flist = NULL; + char *ch = NULL; + char *chend; + int count = 0; register unsigned i; register int length; register xReq *req; @@ -46,16 +49,17 @@ char **XGetFontPath( (void) _XReply (dpy, (xReply *) &rep, 0, xFalse); if (rep.nPaths) { - flist = (char **) - Xmalloc((unsigned) rep.nPaths * sizeof (char *)); - nbytes = (long)rep.length << 2; - ch = (char *) Xmalloc ((unsigned) (nbytes + 1)); + flist = Xmalloc(rep.nPaths * sizeof (char *)); + if (rep.length < (LONG_MAX >> 2)) { + nbytes = (unsigned long) rep.length << 2; + ch = Xmalloc (nbytes + 1); /* +1 to leave room for last null-terminator */ + } if ((! flist) || (! ch)) { if (flist) Xfree((char *) flist); if (ch) Xfree(ch); - _XEatData(dpy, (unsigned long) nbytes); + _XEatDataWords(dpy, rep.length); UnlockDisplay(dpy); SyncHandle(); return (char **) NULL; @@ -65,16 +69,20 @@ char **XGetFontPath( /* * unpack into null terminated strings. */ + chend = ch + (nbytes + 1); length = *ch; for (i = 0; i < rep.nPaths; i++) { - flist[i] = ch+1; /* skip over length */ - ch += length + 1; /* find next length ... */ - length = *ch; - *ch = '\0'; /* and replace with null-termination */ + if (ch + length < chend) { + flist[i] = ch+1; /* skip over length */ + ch += length + 1; /* find next length ... */ + length = *ch; + *ch = '\0'; /* and replace with null-termination */ + count++; + } else + flist[i] = NULL; } } - else flist = NULL; - *npaths = rep.nPaths; + *npaths = count; UnlockDisplay(dpy); SyncHandle(); return (flist); |