diff options
| author | marha <marha@users.sourceforge.net> | 2010-12-28 16:10:20 +0000 |
|---|---|---|
| committer | marha <marha@users.sourceforge.net> | 2010-12-28 16:10:20 +0000 |
| commit | 807c6931fe683fd844ceec1b023232181e6aae03 (patch) | |
| tree | 1a131ed95fe2200d0ad33da8f7755a7ed2364adc /xorg-server/render/render.c | |
| parent | 973099dda7e49e5abe29819a7124b3b1e7bd8b92 (diff) | |
| download | vcxsrv-807c6931fe683fd844ceec1b023232181e6aae03.tar.gz vcxsrv-807c6931fe683fd844ceec1b023232181e6aae03.tar.bz2 vcxsrv-807c6931fe683fd844ceec1b023232181e6aae03.zip | |
xserver and mesa git update 28-12-2010
Diffstat (limited to 'xorg-server/render/render.c')
| -rw-r--r-- | xorg-server/render/render.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/xorg-server/render/render.c b/xorg-server/render/render.c index dd143d6a7..9f1b4701f 100644 --- a/xorg-server/render/render.c +++ b/xorg-server/render/render.c @@ -1084,8 +1084,10 @@ ProcRenderAddGlyphs (ClientPtr client) remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
/* protect against bad nglyphs */
- if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
- bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+ if (gi < ((xGlyphInfo *)stuff) ||
+ gi > ((xGlyphInfo *)((CARD32 *)stuff + client->req_len)) ||
+ bits < ((CARD8 *)stuff) ||
+ bits > ((CARD8 *)((CARD32 *)stuff + client->req_len))) {
err = BadLength;
goto bail;
}
|