frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xext: shape: fix length checking with bigreq 

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 15:59:11 +02:00 committed by Marge Bot
parent 67a3319d73
commit dab1299745
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Xext/shape.c
View File

@ -258,7 +258,7 @@ ShapeRectangles(ClientPtr client, xShapeRectanglesReq *stuff)
client->errorValue = stuff->ordering; client->errorValue = stuff->ordering;
return BadValue; return BadValue;
} }
nrects = ((stuff->length << 2) - sizeof(xShapeRectanglesReq)); nrects = ((client->req_len << 2) - sizeof(xShapeRectanglesReq));
if (nrects & 4) if (nrects & 4)
return BadLength; return BadLength;
nrects >>= 3; nrects >>= 3;