From dc749a457d62b330051e9fb709960951e05de41b Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 31 Mar 2013 12:22:35 -0700
Subject: _XkbReadGetMapReply: reject maxKeyCodes smaller than the minKeyCode

Various other bounds checks in the code assume this is true, so
enforce it when we first get the data from the X server.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
---
 nx-X11/lib/X11/XKBGetMap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nx-X11/lib/X11/XKBGetMap.c b/nx-X11/lib/X11/XKBGetMap.c
index ea2e6b512..5eb1d41bf 100644
--- a/nx-X11/lib/X11/XKBGetMap.c
+++ b/nx-X11/lib/X11/XKBGetMap.c
@@ -485,6 +485,8 @@ unsigned	mask;
 
     if ( xkb->device_spec == XkbUseCoreKbd )
 	xkb->device_spec= rep->deviceID;
+    if ( rep->maxKeyCode < rep->minKeyCode )
+	return BadImplementation;
     xkb->min_key_code = rep->minKeyCode;
     xkb->max_key_code = rep->maxKeyCode;
 
-- 
cgit v1.2.3