diff options
Diffstat (limited to 'libxcb/src/xcb_in.c')
| -rw-r--r-- | libxcb/src/xcb_in.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/libxcb/src/xcb_in.c b/libxcb/src/xcb_in.c index 5506e3088..1eef6caf5 100644 --- a/libxcb/src/xcb_in.c +++ b/libxcb/src/xcb_in.c @@ -919,11 +919,13 @@ int _xcb_in_read(xcb_connection_t *c) #if HAVE_SENDMSG struct cmsghdr *hdr; - for (hdr = CMSG_FIRSTHDR(&msg); hdr; hdr = CMSG_NXTHDR(&msg, hdr)) { - if (hdr->cmsg_level == SOL_SOCKET && hdr->cmsg_type == SCM_RIGHTS) { - int nfd = (hdr->cmsg_len - CMSG_LEN(0)) / sizeof (int); - memcpy(&c->in.in_fd.fd[c->in.in_fd.nfd], CMSG_DATA(hdr), nfd * sizeof (int)); - c->in.in_fd.nfd += nfd; + if (msg.msg_controllen >= sizeof (struct cmsghdr)) { + for (hdr = CMSG_FIRSTHDR(&msg); hdr; hdr = CMSG_NXTHDR(&msg, hdr)) { + if (hdr->cmsg_level == SOL_SOCKET && hdr->cmsg_type == SCM_RIGHTS) { + int nfd = (hdr->cmsg_len - CMSG_LEN(0)) / sizeof (int); + memcpy(&c->in.in_fd.fd[c->in.in_fd.nfd], CMSG_DATA(hdr), nfd * sizeof (int)); + c->in.in_fd.nfd += nfd; + } } } #endif |