Merge branch 'uli42-pr/update_libX11_2022' into 3.6.x

Attributes GH PR #1037: https://github.com/ArcticaProject/nx-libs/pull/1037

1 files changed, 11 insertions, 7 deletions

diff --git a/nx-X11/lib/src/FontInfo.c b/nx-X11/lib/src/FontInfo.c
index a2d12c2ec..0e4ae097b 100644
--- a/nx-X11/lib/src/FontInfo.c
+++ b/nx-X11/lib/src/FontInfo.c
@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
 #include <config.h>
 #endif
 #include "Xlibint.h"
+#include "reallocarray.h"
 #include <limits.h>
 
 #if defined(XF86BIGFONT)
@@ -57,10 +58,13 @@ XFontStruct **info)	/* RETURN */
     register xListFontsReq *req;
     int j;
 
+    if (pattern != NULL && strlen(pattern) >= USHRT_MAX)
+        return NULL;
+
     LockDisplay(dpy);
     GetReq(ListFontsWithInfo, req);
     req->maxNames = maxNames;
-    nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
+    nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;
     req->length += (nbytes + 3) >> 2;
     _XSend (dpy, pattern, nbytes);
     /* use _XSend instead of Data, since subsequent _XReply will flush buffer */
@@ -91,22 +95,22 @@ XFontStruct **info)	/* RETURN */
 		XFontStruct * tmp_finfo;
 		char ** tmp_flist;
 
-		tmp_finfo = Xrealloc (finfo, sizeof(XFontStruct) * size);
+		tmp_finfo = Xreallocarray (finfo, size, sizeof(XFontStruct));
 		if (tmp_finfo)
 		    finfo = tmp_finfo;
 		else
 		    goto badmem;
 
-		tmp_flist = Xrealloc (flist, sizeof(char *) * (size+1));
+		tmp_flist = Xreallocarray (flist, size + 1, sizeof(char *));
 		if (tmp_flist)
 		    flist = tmp_flist;
 		else
 		    goto badmem;
 	    }
 	    else {
-		if (! (finfo = Xmalloc(sizeof(XFontStruct) * size)))
+		if (! (finfo = Xmallocarray(size, sizeof(XFontStruct))))
 		    goto clearwire;
-		if (! (flist = Xmalloc(sizeof(char *) * (size+1)))) {
+		if (! (flist = Xmallocarray(size + 1, sizeof(char *)))) {
 		    Xfree(finfo);
 		    goto clearwire;
 		}
@@ -137,8 +141,8 @@ XFontStruct **info)	/* RETURN */
 	    /* nFontProps is a CARD16 */
 	    nbytes = reply.nFontProps * SIZEOF(xFontProp);
 	    if ((nbytes >> 2) <= reply_left) {
-		size_t pbytes = reply.nFontProps * sizeof(XFontProp);
-		fs->properties = Xmalloc (pbytes);
+		fs->properties = Xmallocarray (reply.nFontProps,
+                                               sizeof(XFontProp));
 	    }
 	    if (! fs->properties)
 		goto badmem;