aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/lib/X11
diff options
context:
space:
mode:
Diffstat (limited to 'nx-X11/lib/X11')
-rw-r--r--nx-X11/lib/X11/ModMap.c10
-rw-r--r--nx-X11/lib/X11/XlibInt.c8
2 files changed, 15 insertions, 3 deletions
diff --git a/nx-X11/lib/X11/ModMap.c b/nx-X11/lib/X11/ModMap.c
index 04cd676eb..3c6971c77 100644
--- a/nx-X11/lib/X11/ModMap.c
+++ b/nx-X11/lib/X11/ModMap.c
@@ -65,9 +65,9 @@ XGetModifierMapping(register Display *dpy)
/*
* Returns:
- * 0 Success
- * 1 Busy - one or more old or new modifiers are down
- * 2 Failed - one or more new modifiers unacceptable
+ * MappingSuccess (0) Success
+ * MappingBusy (1) Busy - one or more old or new modifiers are down
+ * MappingFailed (2) Failed - one or more new modifiers unacceptable
*/
int
XSetModifierMapping(
@@ -80,6 +80,10 @@ XSetModifierMapping(
LockDisplay(dpy);
GetReqExtra(SetModifierMapping, mapSize, req);
+ if (!req) {
+ UnlockDisplay(dpy);
+ return MappingFailed;
+ }
req->numKeyPerModifier = modifier_map->max_keypermod;
diff --git a/nx-X11/lib/X11/XlibInt.c b/nx-X11/lib/X11/XlibInt.c
index 564d318fc..deab8b3ad 100644
--- a/nx-X11/lib/X11/XlibInt.c
+++ b/nx-X11/lib/X11/XlibInt.c
@@ -3980,6 +3980,14 @@ void *_XGetRequest(Display *dpy, CARD8 type, size_t len)
if (dpy->bufptr + len > dpy->bufmax)
_XFlush(dpy);
+ /* Request still too large, so do not allow it to overflow. */
+ if (dpy->bufptr + len > dpy->bufmax) {
+ fprintf(stderr,
+ "Xlib: request %d length %zd would exceed buffer size.\n",
+ type, len);
+ /* Changes failure condition from overflow to NULL dereference. */
+ return NULL;
+ }
if (len % 4)
fprintf(stderr,