aboutsummaryrefslogtreecommitdiff
path: root/xorg-server/render
diff options
context:
space:
mode:
authormarha <marha@users.sourceforge.net>2010-12-29 12:20:21 +0000
committermarha <marha@users.sourceforge.net>2010-12-29 12:20:21 +0000
commit053f5dfd42ade05252e586a282e34906db10828d (patch)
treede215580ce205409a6d810a005c6c5909f3145d1 /xorg-server/render
parent04ceb8c4a0cca3d8682f094d1d6faed8f693afb5 (diff)
parent807c6931fe683fd844ceec1b023232181e6aae03 (diff)
downloadvcxsrv-053f5dfd42ade05252e586a282e34906db10828d.tar.gz
vcxsrv-053f5dfd42ade05252e586a282e34906db10828d.tar.bz2
vcxsrv-053f5dfd42ade05252e586a282e34906db10828d.zip
svn merge ^/branches/released .
Diffstat (limited to 'xorg-server/render')
-rw-r--r--xorg-server/render/render.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/xorg-server/render/render.c b/xorg-server/render/render.c
index dd143d6a7..9f1b4701f 100644
--- a/xorg-server/render/render.c
+++ b/xorg-server/render/render.c
@@ -1084,8 +1084,10 @@ ProcRenderAddGlyphs (ClientPtr client)
remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
/* protect against bad nglyphs */
- if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
- bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+ if (gi < ((xGlyphInfo *)stuff) ||
+ gi > ((xGlyphInfo *)((CARD32 *)stuff + client->req_len)) ||
+ bits < ((CARD8 *)stuff) ||
+ bits > ((CARD8 *)((CARD32 *)stuff + client->req_len))) {
err = BadLength;
goto bail;
}