Protocol handling issues in X Window System servers

One year after Ilja van Sprundel, discovered and reported a large number
of issues in the way the X server code base handles requests from X clients,
they have been fixed.
This commit is contained in:
matthieu
2014-12-09 17:58:52 +00:00
parent 01412a19db
commit 797ed93386
54 changed files with 771 additions and 297 deletions

View File

@@ -125,9 +125,12 @@ RegionEnd(RegionPtr reg)
}
static inline size_t
RegionSizeof(int n)
RegionSizeof(unsigned int n)
{
return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
if (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)))
return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
else
return 0;
}
static inline void
@@ -138,9 +141,10 @@ RegionInit(RegionPtr _pReg, BoxPtr _rect, int _size)
(_pReg)->data = (RegDataPtr) NULL;
}
else {
size_t rgnSize;
(_pReg)->extents = RegionEmptyBox;
if (((_size) > 1) && ((_pReg)->data =
(RegDataPtr) malloc(RegionSizeof(_size)))) {
if (((_size) > 1) && ((rgnSize = RegionSizeof(_size)) > 0) &&
(((_pReg)->data = malloc(rgnSize)) != NULL)) {
(_pReg)->data->size = (_size);
(_pReg)->data->numRects = 0;
}