diff --git a/record/record.c b/record/record.c index c2bfbfbe1..45f531545 100644 --- a/record/record.c +++ b/record/record.c @@ -46,6 +46,7 @@ and Jim Haggerty of Metheus. #include "dix/resource_priv.h" #include "miext/extinit_priv.h" #include "os/client_priv.h" +#include "os/osdep.h" #include "Xext/panoramiX.h" #include "Xext/panoramiXsrv.h" @@ -1299,6 +1300,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client, int i; XID recordingClient; + /* LimitClients is 2048 at max, way less that MAXINT */ + if (stuff->nClients > LimitClients) + return BadValue; + + if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange)) + return BadValue; + if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) != 4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges) return BadLength;