aboutsummaryrefslogtreecommitdiff
path: root/xorg-server/render/render.c
diff options
context:
space:
mode:
authormarha <marha@users.sourceforge.net>2010-08-20 17:34:23 +0000
committermarha <marha@users.sourceforge.net>2010-08-20 17:34:23 +0000
commit4f6c97b1d78e2ab5857560a5af9b47ed8790978a (patch)
tree4c02fe5cec5d893f99edd6ad9bb69a9f975478ca /xorg-server/render/render.c
parent00666832a756014eef48c4f5bd8484cc1299bdf0 (diff)
downloadvcxsrv-4f6c97b1d78e2ab5857560a5af9b47ed8790978a.tar.gz
vcxsrv-4f6c97b1d78e2ab5857560a5af9b47ed8790978a.tar.bz2
vcxsrv-4f6c97b1d78e2ab5857560a5af9b47ed8790978a.zip
xserver git update 20/8/2010
Diffstat (limited to 'xorg-server/render/render.c')
-rw-r--r--xorg-server/render/render.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/xorg-server/render/render.c b/xorg-server/render/render.c
index cbd70cc7e..623d5db33 100644
--- a/xorg-server/render/render.c
+++ b/xorg-server/render/render.c
@@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client)
gi = (xGlyphInfo *) (gids + nglyphs);
bits = (CARD8 *) (gi + nglyphs);
remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
+
+ /* protect against bad nglyphs */
+ if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
+ bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+ err = BadLength;
+ goto bail;
+ }
+
for (i = 0; i < nglyphs; i++)
{
size_t padded_width;