fontconfig libX11 mesa xserver git update 4 Jan 2015

xserver          commit dc777c346d5d452a53b13b917c45f6a1bad2f20b
libX11           commit 446f5f7f41317a85a0cd0efa5e6a1b37bc99fba2
fontconfig       commit 4420b27c074821a1d1f9d6ebe822a610176a417d
mesa             commit 48094d0e6554a9df36bf00fc2793ade46cf92406

1 files changed, 7 insertions, 2 deletions

diff --git a/xorg-server/glx/indirect_util.c b/xorg-server/glx/indirect_util.c
index 926e57c78..9ba28157c 100644
--- a/xorg-server/glx/indirect_util.c
+++ b/xorg-server/glx/indirect_util.c
@@ -73,12 +73,17 @@ __glXGetAnswerBuffer(__GLXclientState * cl, size_t required_size,
                      void *local_buffer, size_t local_size, unsigned alignment)
 {
     void *buffer = local_buffer;
-    const unsigned mask = alignment - 1;
+    const intptr_t mask = alignment - 1;
 
     if (local_size < required_size) {
-        const size_t worst_case_size = required_size + alignment;
+        size_t worst_case_size;
         intptr_t temp_buf;
 
+        if (required_size < SIZE_MAX - alignment)
+            worst_case_size = required_size + alignment;
+        else
+            return NULL;
+
         if (cl->returnBufSize < worst_case_size) {
             void *temp = realloc(cl->returnBuf, worst_case_size);