diff options
Diffstat (limited to 'nx-X11/programs/Xserver/Xi/sendexev.c')
| -rw-r--r-- | nx-X11/programs/Xserver/Xi/sendexev.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/nx-X11/programs/Xserver/Xi/sendexev.c b/nx-X11/programs/Xserver/Xi/sendexev.c index c005aecab..9b441f2d8 100644 --- a/nx-X11/programs/Xserver/Xi/sendexev.c +++ b/nx-X11/programs/Xserver/Xi/sendexev.c @@ -87,7 +87,7 @@ SProcXSendExtensionEvent(client) register ClientPtr client; { register char n; - register long *p; + CARD32 *p; register int i; xEvent eventT; xEvent *eventP; @@ -98,6 +98,11 @@ SProcXSendExtensionEvent(client) REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); swapl(&stuff->destination, n); swaps(&stuff->count, n); + + if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + + (stuff->num_events * (sizeof(xEvent) >> 2))) + return BadLength; + eventP = (xEvent *) &stuff[1]; for (i=0; i<stuff->num_events; i++,eventP++) { @@ -108,12 +113,8 @@ SProcXSendExtensionEvent(client) *eventP = eventT; } - p = (long *) (((xEvent *) &stuff[1]) + stuff->num_events); - for (i=0; i<stuff->count; i++) - { - swapl(p, n); - p++; - } + p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events); + SwapLongs(p, stuff->count); return(ProcXSendExtensionEvent(client)); } |