frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xi: fix length checks for swapped clients 

ChangeDeviceProperty and XIChangeProperty are followed by some data, so
use REQUEST_AT_LEAST_SIZE instead of REQUEST_SIZE_MATCH.

X.Org bug#35082 <https://bugs.freedesktop.org/show_bug.cgi?id=35082>

Reported-by: Markus Fleschutz <markus.fleschutz@x-software.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
Julien Cristau 2011-03-07 18:55:19 +01:00 committed by Peter Hutterer
parent 4114533db6
commit eb8141b6ed
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Xi/xiproperty.c
View File

@ -1051,11 +1051,11 @@ SProcXChangeDeviceProperty (ClientPtr client)
char n; char n;
REQUEST(xChangeDevicePropertyReq); REQUEST(xChangeDevicePropertyReq);
REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->property, n); swapl(&stuff->property, n);
swapl(&stuff->type, n); swapl(&stuff->type, n);
swapl(&stuff->nUnits, n); swapl(&stuff->nUnits, n);
REQUEST_SIZE_MATCH(xChangeDevicePropertyReq);
return (ProcXChangeDeviceProperty(client)); return (ProcXChangeDeviceProperty(client));
} }
@ -1295,12 +1295,12 @@ SProcXIChangeProperty(ClientPtr client)
char n; char n;
REQUEST(xXIChangePropertyReq); REQUEST(xXIChangePropertyReq);
REQUEST_AT_LEAST_SIZE(xXIChangePropertyReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swaps(&stuff->deviceid, n); swaps(&stuff->deviceid, n);
swapl(&stuff->property, n); swapl(&stuff->property, n);
swapl(&stuff->type, n); swapl(&stuff->type, n);
swapl(&stuff->num_items, n); swapl(&stuff->num_items, n);
REQUEST_SIZE_MATCH(xXIChangePropertyReq);
return (ProcXIChangeProperty(client)); return (ProcXIChangeProperty(client));
} }