aboutsummaryrefslogtreecommitdiff
path: root/nx-X11
diff options
context:
space:
mode:
Diffstat (limited to 'nx-X11')
-rw-r--r--nx-X11/lib/X11/GetProp.c25
1 files changed, 16 insertions, 9 deletions
diff --git a/nx-X11/lib/X11/GetProp.c b/nx-X11/lib/X11/GetProp.c
index a80c19c50..a9c357d69 100644
--- a/nx-X11/lib/X11/GetProp.c
+++ b/nx-X11/lib/X11/GetProp.c
@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h>
#endif
#include "Xlibint.h"
+#include <limits.h>
int
XGetWindowProperty(
@@ -66,8 +67,17 @@ XGetWindowProperty(
*prop = (unsigned char *) NULL;
if (reply.propertyType != None) {
- long nbytes, netbytes;
- switch (reply.format) {
+ unsigned long nbytes, netbytes;
+ int format = reply.format;
+
+ /*
+ * Protect against both integer overflow and just plain oversized
+ * memory allocation - no server should ever return this many props.
+ */
+ if (reply.nItems >= (INT_MAX >> 4))
+ format = -1; /* fall through to default error case */
+
+ switch (format) {
/*
* One extra byte is malloced than is needed to contain the property
* data, but this last byte is null terminated and convenient for
@@ -76,24 +86,21 @@ XGetWindowProperty(
*/
case 8:
nbytes = netbytes = reply.nItems;
- if (nbytes + 1 > 0 &&
- (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)))
+ if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
_XReadPad (dpy, (char *) *prop, netbytes);
break;
case 16:
nbytes = reply.nItems * sizeof (short);
netbytes = reply.nItems << 1;
- if (nbytes + 1 > 0 &&
- (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)))
+ if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
_XRead16Pad (dpy, (short *) *prop, netbytes);
break;
case 32:
nbytes = reply.nItems * sizeof (long);
netbytes = reply.nItems << 2;
- if (nbytes + 1 > 0 &&
- (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1)))
+ if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
_XRead32 (dpy, (long *) *prop, netbytes);
break;
@@ -115,7 +122,7 @@ XGetWindowProperty(
break;
}
if (! *prop) {
- _XEatData(dpy, (unsigned long) netbytes);
+ _XEatDataWords(dpy, reply.length);
UnlockDisplay(dpy);
SyncHandle();
return(BadAlloc); /* not Success */