diff options
| author | marha <marha@users.sourceforge.net> | 2010-08-23 14:15:19 +0000 |
|---|---|---|
| committer | marha <marha@users.sourceforge.net> | 2010-08-23 14:15:19 +0000 |
| commit | a219a0434f082a1d1faca472c14ba8c8e6d0fbc7 (patch) | |
| tree | 41f0fddb8d4af0b7df7212e195d2b81df2c4acdf /xorg-server/render | |
| parent | a6913ef6cbee338f4f0001be4bde3960ce2cdf00 (diff) | |
| parent | a3f15e28f545a51f0a0139c38944ed324bafb94f (diff) | |
| download | vcxsrv-a219a0434f082a1d1faca472c14ba8c8e6d0fbc7.tar.gz vcxsrv-a219a0434f082a1d1faca472c14ba8c8e6d0fbc7.tar.bz2 vcxsrv-a219a0434f082a1d1faca472c14ba8c8e6d0fbc7.zip | |
svn merge ^/branches/released .
Diffstat (limited to 'xorg-server/render')
| -rw-r--r-- | xorg-server/render/render.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/xorg-server/render/render.c b/xorg-server/render/render.c index cbd70cc7e..623d5db33 100644 --- a/xorg-server/render/render.c +++ b/xorg-server/render/render.c @@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client) gi = (xGlyphInfo *) (gids + nglyphs);
bits = (CARD8 *) (gi + nglyphs);
remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
+
+ /* protect against bad nglyphs */
+ if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
+ bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+ err = BadLength;
+ goto bail;
+ }
+
for (i = 0; i < nglyphs; i++)
{
size_t padded_width;
|