aboutsummaryrefslogtreecommitdiff
path: root/libX11/src/xkb/XKBGeom.c
diff options
context:
space:
mode:
Diffstat (limited to 'libX11/src/xkb/XKBGeom.c')
-rw-r--r--libX11/src/xkb/XKBGeom.c15
1 files changed, 11 insertions, 4 deletions
diff --git a/libX11/src/xkb/XKBGeom.c b/libX11/src/xkb/XKBGeom.c
index 283bc6426..1116bc67f 100644
--- a/libX11/src/xkb/XKBGeom.c
+++ b/libX11/src/xkb/XKBGeom.c
@@ -360,12 +360,16 @@ Status rtrn;
}
ol->num_points= olWire->nPoints;
}
- if (shapeWire->primaryNdx!=XkbNoShape)
+ if ((shapeWire->primaryNdx!=XkbNoShape) &&
+ (shapeWire->primaryNdx < shapeWire->nOutlines))
shape->primary= &shape->outlines[shapeWire->primaryNdx];
- else shape->primary= NULL;
- if (shapeWire->approxNdx!=XkbNoShape)
+ else
+ shape->primary= NULL;
+ if ((shapeWire->approxNdx!=XkbNoShape) &&
+ (shapeWire->approxNdx < shapeWire->nOutlines))
shape->approx= &shape->outlines[shapeWire->approxNdx];
- else shape->approx= NULL;
+ else
+ shape->approx= NULL;
XkbComputeShapeBounds(shape);
}
return Success;
@@ -611,6 +615,9 @@ XkbGeometryPtr geom;
if (status==Success)
status= _XkbReadGeomKeyAliases(&buf,geom,rep);
left= _XkbFreeReadBuffer(&buf);
+ if ((rep->baseColorNdx > geom->num_colors) ||
+ (rep->labelColorNdx > geom->num_colors))
+ status = BadLength;
if ((status!=Success) || left || buf.error) {
if (status==Success)
status= BadLength;