From 807c6931fe683fd844ceec1b023232181e6aae03 Mon Sep 17 00:00:00 2001
From: marha <marha@users.sourceforge.net>
Date: Tue, 28 Dec 2010 16:10:20 +0000
Subject: xserver and mesa git update 28-12-2010

---
 xorg-server/render/render.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'xorg-server/render/render.c')

diff --git a/xorg-server/render/render.c b/xorg-server/render/render.c
index dd143d6a7..9f1b4701f 100644
--- a/xorg-server/render/render.c
+++ b/xorg-server/render/render.c
@@ -1084,8 +1084,10 @@ ProcRenderAddGlyphs (ClientPtr client)
     remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
 
     /* protect against bad nglyphs */
-    if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
-        bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+    if (gi < ((xGlyphInfo *)stuff) ||
+        gi > ((xGlyphInfo *)((CARD32 *)stuff + client->req_len)) ||
+        bits < ((CARD8 *)stuff) ||
+        bits > ((CARD8 *)((CARD32 *)stuff + client->req_len))) {
         err = BadLength;
         goto bail;
     }
-- 
cgit v1.2.3