diff options
| author | Igor V. Kovalenko <igor.v.kovalenko@gmail.com> | 2021-09-05 10:25:38 +0300 |
|---|---|---|
| committer | Igor V. Kovalenko <igor.v.kovalenko@gmail.com> | 2021-09-05 13:57:26 +0300 |
| commit | 2356e59ff24f8d1b25cdc4dffc5171c65dc2b86e (patch) | |
| tree | 15a16fabe0c5cd25be6840f7233f9b7a89f81701 /include | |
| parent | e92efc63acd7b377faa9e534f4bf52aaa86be2a9 (diff) | |
libX11: do not crash in GetResReq() macro
When _XGetRequest() detects that requested length exceeds remaining display
output buffer capacity it would return NULL. GetResReq() macro obtains "req"
pointer from a call to _XGetRequest() and then proceeds to assign request id
through "req" pointer which leads to NULL pointer dereference in this case.
Fix this by checking if "req" is valid before assigning request id.
Signed-off-by: Igor V. Kovalenko <igor.v.kovalenko@gmail.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/X11/Xlibint.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/X11/Xlibint.h b/include/X11/Xlibint.h index abcc59ac..6d880a65 100644 --- a/include/X11/Xlibint.h +++ b/include/X11/Xlibint.h @@ -559,7 +559,7 @@ extern void *_XGetRequest(Display *dpy, CARD8 type, size_t len); #define GetResReq(name, rid, req) \ req = (xResourceReq *) _XGetRequest(dpy, X_##name, SIZEOF(xResourceReq)); \ - req->id = (rid) + if (req) req->id = (rid) /* * GetEmptyReq is for those requests that have no arguments |