frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

(!1639) Xext: saver: fix length checking with bigreq 

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 15:58:11 +02:00
parent 2b7f53a0bf
commit e187ea816a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Xext/saver.c
View File

@ -745,7 +745,7 @@ ScreenSaverSetAttributes(ClientPtr client)
if (ret != Success) if (ret != Success)
return ret; return ret;
len = stuff->length - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq)); len = client->req_len - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq));
if (Ones(stuff->mask) != len) if (Ones(stuff->mask) != len)
return BadLength; return BadLength;
if (!stuff->width || !stuff->height) { if (!stuff->width || !stuff->height) {
@ -1094,7 +1094,7 @@ ProcScreenSaverSetAttributes(ClientPtr client)
return (status == BadValue) ? BadDrawable : status; return (status == BadValue) ? BadDrawable : status;
len = len =
stuff->length - client->req_len -
bytes_to_int32(sizeof(xScreenSaverSetAttributesReq)); bytes_to_int32(sizeof(xScreenSaverSetAttributesReq));
if (Ones(stuff->mask) != len) if (Ones(stuff->mask) != len)
return BadLength; return BadLength;