From 30af30b78075159fce477ae99cc72540133714d0 Mon Sep 17 00:00:00 2001 From: marha Date: Sun, 26 Jan 2014 20:05:50 +0100 Subject: xserver randrproto libxtrans fontconfig libxcb xcb-proto mesa git update 26 Jan 2014 xserver commit c1ce807d9f18f215332d7eeb844e8c640f71c53c libxcb commit e7263931aff3e3450dc938ad465a7577f943549f libxcb/xcb-proto commit d898fd39ad6c82207eb78666b2daad982dd757b5 randrproto commit a4a6694c059d74247c16527eef4a0ec9f56bbef6 libxtrans commit e1e6121a1638d43d9929589b4723da2b38cb6b44 fontconfig commit e2b406053c2937799da8636c56b72a77998bcab0 mesa commit 07149f0252c52b4ac58b6df4e307fd786b49b490 --- xorg-server/hw/xquartz/applewm.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'xorg-server/hw/xquartz/applewm.c') diff --git a/xorg-server/hw/xquartz/applewm.c b/xorg-server/hw/xquartz/applewm.c index 4409d4bf6..cc91c9608 100644 --- a/xorg-server/hw/xquartz/applewm.c +++ b/xorg-server/hw/xquartz/applewm.c @@ -378,6 +378,13 @@ ProcAppleWMSetWindowMenu(register ClientPtr client) items = malloc(sizeof(char *) * nitems); shortcuts = malloc(sizeof(char) * nitems); + if (!items || !shortcuts) { + free(items); + free(shortcuts); + + return BadAlloc; + } + max_len = (stuff->length << 2) - sizeof(xAppleWMSetWindowMenuReq); bytes = (char *)&stuff[1]; @@ -391,6 +398,15 @@ ProcAppleWMSetWindowMenu(register ClientPtr client) break; } } + + /* Check if we bailed out of the above loop due to a request that was too long */ + if (j < nitems) { + free(items); + free(shortcuts); + + return BadRequest; + } + X11ApplicationSetWindowMenu(nitems, items, shortcuts); free(items); free(shortcuts); -- cgit v1.2.3