frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

(!1639) Xext: shape: fix length checking with bigreq 

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 15:59:11 +02:00
parent 4ebeaa025d
commit 8ebcbb5d92
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Xext/shape.c
View File

@ -260,7 +260,7 @@ ShapeRectangles(ClientPtr client, xShapeRectanglesReq *stuff)
client->errorValue = stuff->ordering;
return BadValue;
}
nrects = ((stuff->length << 2) - sizeof(xShapeRectanglesReq));
nrects = ((client->req_len << 2) - sizeof(xShapeRectanglesReq));
if (nrects & 4)
return BadLength;
nrects >>= 3;