diff options
| -rw-r--r-- | nx-X11/programs/Xserver/dbe/dbe.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/nx-X11/programs/Xserver/dbe/dbe.c b/nx-X11/programs/Xserver/dbe/dbe.c index c0d6131b7..5a1e9b00b 100644 --- a/nx-X11/programs/Xserver/dbe/dbe.c +++ b/nx-X11/programs/Xserver/dbe/dbe.c @@ -725,8 +725,8 @@ ProcDbeSwapBuffers(client) DbeSwapInfoPtr swapInfo; xDbeSwapInfo *dbeSwapInfo; int error; - register int i, j; - int nStuff; + unsigned int i, j; + unsigned int nStuff; REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq); @@ -734,11 +734,13 @@ ProcDbeSwapBuffers(client) if (nStuff == 0) { + REQUEST_SIZE_MATCH(xDbeSwapBuffersReq); return(Success); } if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec)) return BadAlloc; + REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, nStuff * sizeof(xDbeSwapInfo)); /* Get to the swap info appended to the end of the request. */ dbeSwapInfo = (xDbeSwapInfo *)&stuff[1]; @@ -1289,7 +1291,7 @@ SProcDbeSwapBuffers(client) ClientPtr client; { REQUEST(xDbeSwapBuffersReq); - register int i, n; + unsigned int i, n; xDbeSwapInfo *pSwapInfo; @@ -1297,6 +1299,9 @@ SProcDbeSwapBuffers(client) REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq); swapl(&stuff->n, n); + if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec)) + return BadAlloc; + REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo)); if (stuff->n != 0) { |