diff --git a/render/animcur.c b/render/animcur.c index f906cd813..1194cee7e 100644 --- a/render/animcur.c +++ b/render/animcur.c @@ -305,6 +305,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor, int rc = BadAlloc, i; AnimCurPtr ac; + if (ncursor <= 0) + return BadValue; + for (i = 0; i < screenInfo.numScreens; i++) if (!GetAnimCurScreen(screenInfo.screens[i])) return BadImplementation; diff --git a/render/render.c b/render/render.c index 113f6e0c5..fe9f03c8c 100644 --- a/render/render.c +++ b/render/render.c @@ -1799,6 +1799,8 @@ ProcRenderCreateAnimCursor(ClientPtr client) ncursor = (client->req_len - (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1; + if (ncursor <= 0) + return BadValue; cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32)); if (!cursors) return BadAlloc;