frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xext: xtest: fix length checking with bigreq 

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 15:59:57 +02:00 committed by Marge Bot
parent c3e1f6fccf
commit 44c063d93d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Xext/xtest.c
View File

@ -197,7 +197,7 @@ ProcXTestFakeInput(ClientPtr client)
int flags = 0; int flags = 0;
int need_ptr_update = 1; int need_ptr_update = 1;
nev = (stuff->length << 2) - sizeof(xReq); nev = (client->req_len << 2) - sizeof(xReq);
if ((nev % sizeof(xEvent)) || !nev) if ((nev % sizeof(xEvent)) || !nev)
return BadLength; return BadLength;
nev /= sizeof(xEvent); nev /= sizeof(xEvent);
@ -514,7 +514,7 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
xEvent sev; xEvent sev;
EventSwapPtr proc; EventSwapPtr proc;
nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent); nev = ((client->req_len << 2) - sizeof(xReq)) / sizeof(xEvent);
for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) { for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
int evtype = ev->u.u.type & 0177; int evtype = ev->u.u.type & 0177;
/* Swap event */ /* Swap event */