diff options
Diffstat (limited to 'xorg-server/dix/dispatch.c')
| -rw-r--r-- | xorg-server/dix/dispatch.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/xorg-server/dix/dispatch.c b/xorg-server/dix/dispatch.c index 28a54de76..67dbce6e1 100644 --- a/xorg-server/dix/dispatch.c +++ b/xorg-server/dix/dispatch.c @@ -2002,6 +2002,9 @@ ProcPutImage(ClientPtr client) tmpImage = (char *) &stuff[1];
lengthProto = length;
+ if (lengthProto >= (INT32_MAX / stuff->height))
+ return BadLength;
+
if ((bytes_to_int32(lengthProto * stuff->height) +
bytes_to_int32(sizeof(xPutImageReq))) != client->req_len)
return BadLength;
|