From 5e5a48ff8cd08f123601cd0625ca62a86675aac9 Mon Sep 17 00:00:00 2001 From: marha Date: Sun, 4 Jan 2015 16:25:32 +0100 Subject: fontconfig libX11 mesa xserver git update 4 Jan 2015 xserver commit dc777c346d5d452a53b13b917c45f6a1bad2f20b libX11 commit 446f5f7f41317a85a0cd0efa5e6a1b37bc99fba2 fontconfig commit 4420b27c074821a1d1f9d6ebe822a610176a417d mesa commit 48094d0e6554a9df36bf00fc2793ade46cf92406 --- xorg-server/Xi/chgdctl.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'xorg-server/Xi/chgdctl.c') diff --git a/xorg-server/Xi/chgdctl.c b/xorg-server/Xi/chgdctl.c index d078aa248..b3ee867f0 100644 --- a/xorg-server/Xi/chgdctl.c +++ b/xorg-server/Xi/chgdctl.c @@ -78,7 +78,7 @@ SProcXChangeDeviceControl(ClientPtr client) REQUEST(xChangeDeviceControlReq); swaps(&stuff->length); - REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq); + REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl)); swaps(&stuff->control); ctl = (xDeviceCtl *) &stuff[1]; swaps(&ctl->control); @@ -115,7 +115,7 @@ ProcXChangeDeviceControl(ClientPtr client) xDeviceEnableCtl *e; REQUEST(xChangeDeviceControlReq); - REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq); + REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl)); len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceControlReq)); ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess); @@ -192,6 +192,10 @@ ProcXChangeDeviceControl(ClientPtr client) break; case DEVICE_ENABLE: e = (xDeviceEnableCtl *) &stuff[1]; + if ((len != bytes_to_int32(sizeof(xDeviceEnableCtl)))) { + ret = BadLength; + goto out; + } if (IsXTestDevice(dev, NULL)) status = !Success; -- cgit v1.2.3