xserver randrproto libxtrans fontconfig libxcb xcb-proto mesa git update 26 Jan 2014

xserver          commit c1ce807d9f18f215332d7eeb844e8c640f71c53c
libxcb           commit e7263931aff3e3450dc938ad465a7577f943549f
libxcb/xcb-proto commit d898fd39ad6c82207eb78666b2daad982dd757b5
randrproto       commit a4a6694c059d74247c16527eef4a0ec9f56bbef6
libxtrans        commit e1e6121a1638d43d9929589b4723da2b38cb6b44
fontconfig       commit e2b406053c2937799da8636c56b72a77998bcab0
mesa             commit 07149f0252c52b4ac58b6df4e307fd786b49b490

1 files changed, 16 insertions, 0 deletions

diff --git a/xorg-server/hw/xquartz/applewm.c b/xorg-server/hw/xquartz/applewm.c
index 4409d4bf6..cc91c9608 100644
--- a/xorg-server/hw/xquartz/applewm.c
+++ b/xorg-server/hw/xquartz/applewm.c
@@ -378,6 +378,13 @@ ProcAppleWMSetWindowMenu(register ClientPtr client)
     items = malloc(sizeof(char *) * nitems);
     shortcuts = malloc(sizeof(char) * nitems);
 
+    if (!items || !shortcuts) {
+        free(items);
+        free(shortcuts);
+
+        return BadAlloc;
+    }
+
     max_len = (stuff->length << 2) - sizeof(xAppleWMSetWindowMenuReq);
     bytes = (char *)&stuff[1];
 
@@ -391,6 +398,15 @@ ProcAppleWMSetWindowMenu(register ClientPtr client)
                 break;
         }
     }
+
+    /* Check if we bailed out of the above loop due to a request that was too long */
+    if (j < nitems) {
+        free(items);
+        free(shortcuts);
+
+        return BadRequest;
+    }
+
     X11ApplicationSetWindowMenu(nitems, items, shortcuts);
     free(items);
     free(shortcuts);