aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/lib/X11/GetImage.c
diff options
context:
space:
mode:
authorMike Gabriel <mike.gabriel@das-netzwerkteam.de>2016-10-19 22:15:01 +0200
committerMike Gabriel <mike.gabriel@das-netzwerkteam.de>2016-10-19 22:15:01 +0200
commit70ac75f4ab184c21d11b9840a47362610aaef481 (patch)
tree183b9ec7e6897fb2cea7296b461a35ca93dfce6e /nx-X11/lib/X11/GetImage.c
parent6c303d9e4ffd162b8c7f59a4b135e592d923a656 (diff)
parent70e9d346fe34af127d2c827c3678e53d0f4312ae (diff)
downloadnx-libs-70ac75f4ab184c21d11b9840a47362610aaef481.tar.gz
nx-libs-70ac75f4ab184c21d11b9840a47362610aaef481.tar.bz2
nx-libs-70ac75f4ab184c21d11b9840a47362610aaef481.zip
Merge branch 'uli42-pr/libX11_further_backports' into 3.6.x
Attributes GH PR #222: https://github.com/ArcticaProject/nx-libs/pull/222
Diffstat (limited to 'nx-X11/lib/X11/GetImage.c')
-rw-r--r--nx-X11/lib/X11/GetImage.c29
1 files changed, 20 insertions, 9 deletions
diff --git a/nx-X11/lib/X11/GetImage.c b/nx-X11/lib/X11/GetImage.c
index 59fb45eb1..d80f6715f 100644
--- a/nx-X11/lib/X11/GetImage.c
+++ b/nx-X11/lib/X11/GetImage.c
@@ -59,6 +59,7 @@ XImage *XGetImage (
char *data;
unsigned long nbytes;
XImage *image;
+ int planes;
LockDisplay(dpy);
GetReq (GetImage, req);
/*
@@ -91,18 +92,28 @@ XImage *XGetImage (
return (XImage *) NULL;
}
_XReadPad (dpy, data, nbytes);
- if (format == XYPixmap)
- image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
- Ones (plane_mask &
- (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
- format, 0, data, width, height, dpy->bitmap_pad, 0);
- else /* format == ZPixmap */
- image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
- rep.depth, ZPixmap, 0, data, width, height,
- _XGetScanlinePad(dpy, (int) rep.depth), 0);
+ if (format == XYPixmap) {
+ image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
+ Ones (plane_mask &
+ (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
+ format, 0, data, width, height, dpy->bitmap_pad, 0);
+ planes = image->depth;
+ } else { /* format == ZPixmap */
+ image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
+ rep.depth, ZPixmap, 0, data, width, height,
+ _XGetScanlinePad(dpy, (int) rep.depth), 0);
+ planes = 1;
+ }
if (!image)
Xfree(data);
+ if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
+ INT_MAX / image->height <= image->bytes_per_line ||
+ INT_MAX / planes <= image->height * image->bytes_per_line ||
+ nbytes < planes * image->height * image->bytes_per_line) {
+ XDestroyImage(image);
+ image = NULL;
+ }
UnlockDisplay(dpy);
SyncHandle();
return (image);