diff options
Diffstat (limited to 'nx-X11/lib/X11/ListExt.c')
| -rw-r--r-- | nx-X11/lib/X11/ListExt.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/nx-X11/lib/X11/ListExt.c b/nx-X11/lib/X11/ListExt.c index e925c4773..0516e4596 100644 --- a/nx-X11/lib/X11/ListExt.c +++ b/nx-X11/lib/X11/ListExt.c @@ -42,7 +42,7 @@ char **XListExtensions( register unsigned i; register int length; register xReq *req; - unsigned long rlen; + unsigned long rlen = 0; LockDisplay(dpy); GetEmptyReq (ListExtensions, req); @@ -55,15 +55,15 @@ char **XListExtensions( if (rep.nExtensions) { list = Xmalloc (rep.nExtensions * sizeof (char *)); - if (rep.length < (LONG_MAX >> 2)) { + if (rep.length > 0 && rep.length < (INT_MAX >> 2)) { rlen = rep.length << 2; ch = Xmalloc (rlen + 1); /* +1 to leave room for last null-terminator */ } if ((!list) || (!ch)) { - if (list) Xfree((char *) list); - if (ch) Xfree((char *) ch); + Xfree(list); + Xfree(ch); _XEatDataWords(dpy, rep.length); UnlockDisplay(dpy); SyncHandle(); @@ -80,9 +80,13 @@ char **XListExtensions( if (ch + length < chend) { list[i] = ch+1; /* skip over length */ ch += length + 1; /* find next length ... */ - length = *ch; - *ch = '\0'; /* and replace with null-termination */ - count++; + if (ch <= chend) { + length = *ch; + *ch = '\0'; /* and replace with null-termination */ + count++; + } else { + list[i] = NULL; + } } else list[i] = NULL; } @@ -99,7 +103,7 @@ XFreeExtensionList (char **list) { if (list != NULL) { Xfree (list[0]-1); - Xfree ((char *)list); + Xfree (list); } return 1; } |