From 5e5a48ff8cd08f123601cd0625ca62a86675aac9 Mon Sep 17 00:00:00 2001 From: marha Date: Sun, 4 Jan 2015 16:25:32 +0100 Subject: fontconfig libX11 mesa xserver git update 4 Jan 2015 xserver commit dc777c346d5d452a53b13b917c45f6a1bad2f20b libX11 commit 446f5f7f41317a85a0cd0efa5e6a1b37bc99fba2 fontconfig commit 4420b27c074821a1d1f9d6ebe822a610176a417d mesa commit 48094d0e6554a9df36bf00fc2793ade46cf92406 --- xorg-server/include/regionstr.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'xorg-server/include/regionstr.h') diff --git a/xorg-server/include/regionstr.h b/xorg-server/include/regionstr.h index 515e93ffa..079375d33 100644 --- a/xorg-server/include/regionstr.h +++ b/xorg-server/include/regionstr.h @@ -127,7 +127,10 @@ RegionEnd(RegionPtr reg) static inline size_t RegionSizeof(size_t n) { - return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec))); + if (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec))) + return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec))); + else + return 0; } static inline void @@ -138,9 +141,10 @@ RegionInit(RegionPtr _pReg, BoxPtr _rect, int _size) (_pReg)->data = (RegDataPtr) NULL; } else { + size_t rgnSize; (_pReg)->extents = RegionEmptyBox; - if (((_size) > 1) && ((_pReg)->data = - (RegDataPtr) malloc(RegionSizeof(_size)))) { + if (((_size) > 1) && ((rgnSize = RegionSizeof(_size)) > 0) && + (((_pReg)->data = malloc(rgnSize)) != NULL)) { (_pReg)->data->size = (_size); (_pReg)->data->numRects = 0; } -- cgit v1.2.3