diff options
Diffstat (limited to 'libXext/src/XShape.c')
| -rw-r--r-- | libXext/src/XShape.c | 27 |
1 files changed, 16 insertions, 11 deletions
diff --git a/libXext/src/XShape.c b/libXext/src/XShape.c index 6e8fbae9f..d02502004 100644 --- a/libXext/src/XShape.c +++ b/libXext/src/XShape.c @@ -35,6 +35,8 @@ in this Software without prior written authorization from The Open Group. #include <X11/extensions/extutil.h> #include <X11/extensions/shape.h> #include <X11/extensions/shapeproto.h> +#include <limits.h> +#include "eat.h" static XExtensionInfo _shape_info_data; static XExtensionInfo *shape_info = &_shape_info_data; @@ -442,7 +444,7 @@ XRectangle *XShapeGetRectangles ( xShapeGetRectanglesReply rep; XRectangle *rects; xRectangle *xrects; - int i; + unsigned int i; ShapeCheckExtension (dpy, info, (XRectangle *)NULL); @@ -460,20 +462,23 @@ XRectangle *XShapeGetRectangles ( *count = rep.nrects; *ordering = rep.ordering; rects = NULL; - if (*count) { - xrects = (xRectangle *) Xmalloc (*count * sizeof (xRectangle)); - rects = (XRectangle *) Xmalloc (*count * sizeof (XRectangle)); + if (rep.nrects) { + if (rep.nrects < (INT_MAX / sizeof (XRectangle))) { + xrects = Xmalloc (rep.nrects * sizeof (xRectangle)); + rects = Xmalloc (rep.nrects * sizeof (XRectangle)); + } else { + xrects = NULL; + rects = NULL; + } if (!xrects || !rects) { - if (xrects) - Xfree (xrects); - if (rects) - Xfree (rects); - _XEatData (dpy, *count * sizeof (xRectangle)); + Xfree (xrects); + Xfree (rects); + _XEatDataWords (dpy, rep.length); rects = NULL; *count = 0; } else { - _XRead (dpy, (char *) xrects, *count * sizeof (xRectangle)); - for (i = 0; i < *count; i++) { + _XRead (dpy, (char *) xrects, rep.nrects * sizeof (xRectangle)); + for (i = 0; i < rep.nrects; i++) { rects[i].x = (short) cvtINT16toInt (xrects[i].x); rects[i].y = (short) cvtINT16toInt (xrects[i].y); rects[i].width = xrects[i].width; |