frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xi: avoid overrun of callback array. 

This code had an off-by-one and would allow writing one past the end of
the callbacks array.

Pointed out by coverity.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
This commit is contained in:
Dave Airlie 2011-10-19 16:22:31 +01:00
parent b62dc4fcbc
commit 682c09a2ce
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Xi/extinit.c
View File

@ -409,7 +409,7 @@ static int
ProcIDispatch(ClientPtr client) ProcIDispatch(ClientPtr client)
{ {
REQUEST(xReq); REQUEST(xReq);
if (stuff->data > ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) if (stuff->data >= ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data])
return BadRequest; return BadRequest;
return (*ProcIVector[stuff->data])(client); return (*ProcIVector[stuff->data])(client);
@ -428,7 +428,7 @@ static int
SProcIDispatch(ClientPtr client) SProcIDispatch(ClientPtr client)
{ {
REQUEST(xReq); REQUEST(xReq);
if (stuff->data > ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) if (stuff->data >= ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data])
return BadRequest; return BadRequest;
return (*SProcIVector[stuff->data])(client); return (*SProcIVector[stuff->data])(client);