From e3c1096273446bb7eb993b179ceb989617d149cc Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 23 Mar 2009 13:20:22 +1000
Subject: [PATCH] dix: build_modmap_from_modkeymap needs to bounds-check its
 argument.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Daniel Stone <daniel@fooishbar.org>
---
 dix/inpututils.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dix/inpututils.c b/dix/inpututils.c
index 2226d5562..c6300880b 100644
--- a/dix/inpututils.c
+++ b/dix/inpututils.c
@@ -235,6 +235,9 @@ static int build_modmap_from_modkeymap(CARD8 *modmap, KeyCode *modkeymap,
         if (!modkeymap[i])
             continue;
 
+        if (modkeymap[i] >= MAP_LENGTH)
+            return BadValue;
+
         if (modmap[modkeymap[i]])
             return BadValue;