frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xext: saver: fix length checking with bigreq 

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 15:58:11 +02:00 committed by Marge Bot
parent ef396a28b7
commit bacc4b1477
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Xext/saver.c
View File

@ -748,7 +748,7 @@ ScreenSaverSetAttributes(ClientPtr client)
if (ret != Success) if (ret != Success)
return ret; return ret;
len = stuff->length - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq)); len = client->req_len - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq));
if (Ones(stuff->mask) != len) if (Ones(stuff->mask) != len)
return BadLength; return BadLength;
if (!stuff->width || !stuff->height) { if (!stuff->width || !stuff->height) {
@ -1097,7 +1097,7 @@ ProcScreenSaverSetAttributes(ClientPtr client)
return (status == BadValue) ? BadDrawable : status; return (status == BadValue) ? BadDrawable : status;
len = len =
stuff->length - client->req_len -
bytes_to_int32(sizeof(xScreenSaverSetAttributesReq)); bytes_to_int32(sizeof(xScreenSaverSetAttributesReq));
if (Ones(stuff->mask) != len) if (Ones(stuff->mask) != len)
return BadLength; return BadLength;