diff options
| author | marha <marha@users.sourceforge.net> | 2015-01-04 16:25:32 +0100 |
|---|---|---|
| committer | marha <marha@users.sourceforge.net> | 2015-01-04 16:25:32 +0100 |
| commit | 5e5a48ff8cd08f123601cd0625ca62a86675aac9 (patch) | |
| tree | ea1c2cee139e8e1ce389a7f956e9874db1e0a650 /xorg-server/Xi/xiselectev.c | |
| parent | a1011d63ffb5cc4f41bf0f4622ee3f1493d419d9 (diff) | |
| download | vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.tar.gz vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.tar.bz2 vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.zip | |
fontconfig libX11 mesa xserver git update 4 Jan 2015
xserver commit dc777c346d5d452a53b13b917c45f6a1bad2f20b
libX11 commit 446f5f7f41317a85a0cd0efa5e6a1b37bc99fba2
fontconfig commit 4420b27c074821a1d1f9d6ebe822a610176a417d
mesa commit 48094d0e6554a9df36bf00fc2793ade46cf92406
Diffstat (limited to 'xorg-server/Xi/xiselectev.c')
| -rw-r--r-- | xorg-server/Xi/xiselectev.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/xorg-server/Xi/xiselectev.c b/xorg-server/Xi/xiselectev.c index 45a996e4c..168579f5b 100644 --- a/xorg-server/Xi/xiselectev.c +++ b/xorg-server/Xi/xiselectev.c @@ -114,6 +114,7 @@ int SProcXISelectEvents(ClientPtr client) { int i; + int len; xXIEventMask *evmask; REQUEST(xXISelectEventsReq); @@ -122,10 +123,17 @@ SProcXISelectEvents(ClientPtr client) swapl(&stuff->win); swaps(&stuff->num_masks); + len = stuff->length - bytes_to_int32(sizeof(xXISelectEventsReq)); evmask = (xXIEventMask *) &stuff[1]; for (i = 0; i < stuff->num_masks; i++) { + if (len < bytes_to_int32(sizeof(xXIEventMask))) + return BadLength; + len -= bytes_to_int32(sizeof(xXIEventMask)); swaps(&evmask->deviceid); swaps(&evmask->mask_len); + if (len < evmask->mask_len) + return BadLength; + len -= evmask->mask_len; evmask = (xXIEventMask *) (((char *) &evmask[1]) + evmask->mask_len * 4); } |