From 9111cffb355f6444f9f6b04cc76a138e70ed1a77 Mon Sep 17 00:00:00 2001 From: "Enrico Weigelt, metux IT consult" Date: Tue, 6 Aug 2024 15:59:11 +0200 Subject: [PATCH] (submit/fixup-req-len) Xext: shape: fix length checking with bigreq The authorative source of the request frame size is client->req_len, especially with big requests larger than 2^18 bytes. Signed-off-by: Enrico Weigelt, metux IT consult --- Xext/shape.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Xext/shape.c b/Xext/shape.c index cba0586c5..b7631eb43 100644 --- a/Xext/shape.c +++ b/Xext/shape.c @@ -260,7 +260,7 @@ ShapeRectangles(ClientPtr client, xShapeRectanglesReq *stuff) client->errorValue = stuff->ordering; return BadValue; } - nrects = ((stuff->length << 2) - sizeof(xShapeRectanglesReq)); + nrects = ((client->req_len << 2) - sizeof(xShapeRectanglesReq)); if (nrects & 4) return BadLength; nrects >>= 3;