diff options
| author | marha <marha@users.sourceforge.net> | 2015-01-04 16:25:32 +0100 |
|---|---|---|
| committer | marha <marha@users.sourceforge.net> | 2015-01-04 16:25:32 +0100 |
| commit | 5e5a48ff8cd08f123601cd0625ca62a86675aac9 (patch) | |
| tree | ea1c2cee139e8e1ce389a7f956e9874db1e0a650 /xorg-server/Xi/xigrabdev.c | |
| parent | a1011d63ffb5cc4f41bf0f4622ee3f1493d419d9 (diff) | |
| download | vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.tar.gz vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.tar.bz2 vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.zip | |
fontconfig libX11 mesa xserver git update 4 Jan 2015
xserver commit dc777c346d5d452a53b13b917c45f6a1bad2f20b
libX11 commit 446f5f7f41317a85a0cd0efa5e6a1b37bc99fba2
fontconfig commit 4420b27c074821a1d1f9d6ebe822a610176a417d
mesa commit 48094d0e6554a9df36bf00fc2793ade46cf92406
Diffstat (limited to 'xorg-server/Xi/xigrabdev.c')
| -rw-r--r-- | xorg-server/Xi/xigrabdev.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/xorg-server/Xi/xigrabdev.c b/xorg-server/Xi/xigrabdev.c index 63d95bc1c..e2a2ae333 100644 --- a/xorg-server/Xi/xigrabdev.c +++ b/xorg-server/Xi/xigrabdev.c @@ -47,6 +47,11 @@ int SProcXIGrabDevice(ClientPtr client) { REQUEST(xXIGrabDeviceReq); + /* + * Check here for at least the length of the struct we swap, then + * let ProcXIGrabDevice check the full size after we swap mask_len. + */ + REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq); swaps(&stuff->length); swaps(&stuff->deviceid); @@ -71,7 +76,7 @@ ProcXIGrabDevice(ClientPtr client) unsigned int pointer_mode; REQUEST(xXIGrabDeviceReq); - REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq); + REQUEST_FIXED_SIZE(xXIGrabDeviceReq, ((size_t) stuff->mask_len) * 4); ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess); if (ret != Success) @@ -131,6 +136,7 @@ int SProcXIUngrabDevice(ClientPtr client) { REQUEST(xXIUngrabDeviceReq); + REQUEST_SIZE_MATCH(xXIUngrabDeviceReq); swaps(&stuff->length); swaps(&stuff->deviceid); @@ -148,6 +154,7 @@ ProcXIUngrabDevice(ClientPtr client) TimeStamp time; REQUEST(xXIUngrabDeviceReq); + REQUEST_SIZE_MATCH(xXIUngrabDeviceReq); ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGetAttrAccess); if (ret != Success) |