diff --git a/record/record.c b/record/record.c index d8e730972..fd6d0fd43 100644 --- a/record/record.c +++ b/record/record.c @@ -37,6 +37,7 @@ and Jim Haggerty of Metheus. #include "dix/cursor_priv.h" #include "dix/eventconvert.h" #include "os/client_priv.h" +#include "os/osdep.h" #include "dixstruct.h" #include "extnsionst.h" @@ -1299,6 +1300,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client, int i; XID recordingClient; + /* LimitClients is 2048 at max, way less that MAXINT */ + if (stuff->nClients > LimitClients) + return BadValue; + + if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange)) + return BadValue; + if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) != 4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges) return BadLength;