record: Prevent out of bounds access when recording a reply.

Any pad bytes in replies are written to the client from a zeroed
array. However, record extension tries to incorrectly access the pad
bytes from the end of reply data.

Signed-off-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Reviewed-by: Erkki Seppälä <erkki.seppala@vincit.fi>

1 files changed, 1 insertions, 0 deletions

diff --git a/os/io.c b/os/io.c
index 068f5f028..955bf8b73 100644
--- a/os/io.c
+++ b/os/io.c
@@ -809,6 +809,7 @@ WriteToClient (ClientPtr who, int count, const void *__buf)
 	replyinfo.client = who;
 	replyinfo.replyData = buf;
 	replyinfo.dataLenBytes = count + padBytes;
+	replyinfo.padBytes = padBytes;
 	if (who->replyBytesRemaining)
 	{ /* still sending data of an earlier reply */
 	    who->replyBytesRemaining -= count + padBytes;