From e187ea816abbf05bff280a8acebac34760fe772a Mon Sep 17 00:00:00 2001 From: "Enrico Weigelt, metux IT consult" Date: Tue, 6 Aug 2024 15:58:11 +0200 Subject: [PATCH] (!1639) Xext: saver: fix length checking with bigreq The authorative source of the request frame size is client->req_len, especially with big requests larger than 2^18 bytes. Signed-off-by: Enrico Weigelt, metux IT consult --- Xext/saver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Xext/saver.c b/Xext/saver.c index f76ff8e10..d99248496 100644 --- a/Xext/saver.c +++ b/Xext/saver.c @@ -745,7 +745,7 @@ ScreenSaverSetAttributes(ClientPtr client) if (ret != Success) return ret; - len = stuff->length - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq)); + len = client->req_len - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq)); if (Ones(stuff->mask) != len) return BadLength; if (!stuff->width || !stuff->height) { @@ -1094,7 +1094,7 @@ ProcScreenSaverSetAttributes(ClientPtr client) return (status == BadValue) ? BadDrawable : status; len = - stuff->length - + client->req_len - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq)); if (Ones(stuff->mask) != len) return BadLength;