diff options
author | Peter Harris <pharris@opentext.com> | 2017-02-14 15:19:18 +0000 |
---|---|---|
committer | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | 2017-03-20 10:50:57 +0100 |
commit | cbc2d300b984d7ebc789deac0642104f223c2920 (patch) | |
tree | 3fdf213b27c9f6576d9225e3f8fb16e7a1b4388a /nx-X11/programs/Xserver/xkb/ddxCtrls.c | |
parent | 65b6a62bc726b5e4f4833ed1e27733e22fabcfa8 (diff) | |
download | nx-libs-cbc2d300b984d7ebc789deac0642104f223c2920.tar.gz nx-libs-cbc2d300b984d7ebc789deac0642104f223c2920.tar.bz2 nx-libs-cbc2d300b984d7ebc789deac0642104f223c2920.zip |
Fix overflow of ConnectionOutput->size and ->count
commit 4b0d0df34f10a88c10cb23dd50087b59f5c4fece
Author: Peter Harris <pharris@opentext.com>
Date: Mon Nov 17 14:31:24 2014 -0500
Fix overflow of ConnectionOutput->size and ->count
When (long) is larger than (int), and when realloc succeeds with sizes
larger than INT_MAX, ConnectionOutput->size and ConnectionOutput->count
overflow and become negative.
When ConnectionOutput->count is negative, InsertIOV does not actually
insert an IOV, and FlushClient goes into an infinite loop of writev(fd,
iov, 0) [an empty list].
Avoid this situation by killing the client when it has more than INT_MAX
unread bytes of data.
Signed-off-by: Peter Harris <pharris@opentext.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
Backported-to-NX-by: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Diffstat (limited to 'nx-X11/programs/Xserver/xkb/ddxCtrls.c')
0 files changed, 0 insertions, 0 deletions