aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/lib
diff options
context:
space:
mode:
authorAlan Coopersmith <alan.coopersmith@oracle.com>2013-03-31 12:22:35 -0700
committerUlrich Sibiller <uli42@gmx.de>2016-10-12 09:34:39 +0200
commitdc749a457d62b330051e9fb709960951e05de41b (patch)
tree98b4d8a557002e1cabad5aff9abfbb86824553a1 /nx-X11/lib
parent37f8d3eb8ec4a44bebaac7893e5881bd59b5440c (diff)
downloadnx-libs-dc749a457d62b330051e9fb709960951e05de41b.tar.gz
nx-libs-dc749a457d62b330051e9fb709960951e05de41b.tar.bz2
nx-libs-dc749a457d62b330051e9fb709960951e05de41b.zip
_XkbReadGetMapReply: reject maxKeyCodes smaller than the minKeyCode
Various other bounds checks in the code assume this is true, so enforce it when we first get the data from the X server. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Julien Cristau <jcristau@debian.org> Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
Diffstat (limited to 'nx-X11/lib')
-rw-r--r--nx-X11/lib/X11/XKBGetMap.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/nx-X11/lib/X11/XKBGetMap.c b/nx-X11/lib/X11/XKBGetMap.c
index ea2e6b512..5eb1d41bf 100644
--- a/nx-X11/lib/X11/XKBGetMap.c
+++ b/nx-X11/lib/X11/XKBGetMap.c
@@ -485,6 +485,8 @@ unsigned mask;
if ( xkb->device_spec == XkbUseCoreKbd )
xkb->device_spec= rep->deviceID;
+ if ( rep->maxKeyCode < rep->minKeyCode )
+ return BadImplementation;
xkb->min_key_code = rep->minKeyCode;
xkb->max_key_code = rep->maxKeyCode;