From 682c09a2cedd234b005334cc01247d859dd7f26a Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Wed, 19 Oct 2011 16:22:31 +0100 Subject: [PATCH] Xi: avoid overrun of callback array. This code had an off-by-one and would allow writing one past the end of the callbacks array. Pointed out by coverity. Signed-off-by: Dave Airlie Reviewed-by: Jeremy Huddleston --- Xi/extinit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Xi/extinit.c b/Xi/extinit.c index a2c807b46..b43f9bbc0 100644 --- a/Xi/extinit.c +++ b/Xi/extinit.c @@ -409,7 +409,7 @@ static int ProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) return BadRequest; return (*ProcIVector[stuff->data])(client); @@ -428,7 +428,7 @@ static int SProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) return BadRequest; return (*SProcIVector[stuff->data])(client);