diff options
Diffstat (limited to 'xorg-server/dix/dispatch.c')
| -rw-r--r-- | xorg-server/dix/dispatch.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/xorg-server/dix/dispatch.c b/xorg-server/dix/dispatch.c index d844a0942..9044ac786 100644 --- a/xorg-server/dix/dispatch.c +++ b/xorg-server/dix/dispatch.c @@ -2000,6 +2000,9 @@ ProcPutImage(ClientPtr client) tmpImage = (char *) &stuff[1]; lengthProto = length; + if (stuff->height != 0 && lengthProto >= (INT32_MAX / stuff->height)) + return BadLength; + if ((bytes_to_int32(lengthProto * stuff->height) + bytes_to_int32(sizeof(xPutImageReq))) != client->req_len) return BadLength; |