diff options
| author | marha <marha@users.sourceforge.net> | 2015-01-04 16:25:32 +0100 |
|---|---|---|
| committer | marha <marha@users.sourceforge.net> | 2015-01-04 16:25:32 +0100 |
| commit | 5e5a48ff8cd08f123601cd0625ca62a86675aac9 (patch) | |
| tree | ea1c2cee139e8e1ce389a7f956e9874db1e0a650 /xorg-server/dix/dispatch.c | |
| parent | a1011d63ffb5cc4f41bf0f4622ee3f1493d419d9 (diff) | |
| download | vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.tar.gz vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.tar.bz2 vcxsrv-5e5a48ff8cd08f123601cd0625ca62a86675aac9.zip | |
fontconfig libX11 mesa xserver git update 4 Jan 2015
xserver commit dc777c346d5d452a53b13b917c45f6a1bad2f20b
libX11 commit 446f5f7f41317a85a0cd0efa5e6a1b37bc99fba2
fontconfig commit 4420b27c074821a1d1f9d6ebe822a610176a417d
mesa commit 48094d0e6554a9df36bf00fc2793ade46cf92406
Diffstat (limited to 'xorg-server/dix/dispatch.c')
| -rw-r--r-- | xorg-server/dix/dispatch.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/xorg-server/dix/dispatch.c b/xorg-server/dix/dispatch.c index d844a0942..9044ac786 100644 --- a/xorg-server/dix/dispatch.c +++ b/xorg-server/dix/dispatch.c @@ -2000,6 +2000,9 @@ ProcPutImage(ClientPtr client) tmpImage = (char *) &stuff[1]; lengthProto = length; + if (stuff->height != 0 && lengthProto >= (INT32_MAX / stuff->height)) + return BadLength; + if ((bytes_to_int32(lengthProto * stuff->height) + bytes_to_int32(sizeof(xPutImageReq))) != client->req_len) return BadLength; |