While receiver is accumulating a selection delivered incrementally,

which is finally delivered to the requesting client in a single buffer,
that buffer is gradually reallocated to accommodate the growing data.
As it is reallocated, be sure it is at least big enough to hold the
data we're about to read into it, and try not to realloc all the time.
Previously the code relied on the minimal value being at least half
the size of the actual value of the first increment, or it would
overwrite memory.  #7160

1 files changed, 12 insertions, 12 deletions

diff --git a/xc/lib/Xt/Selection.c b/xc/lib/Xt/Selection.c
index 088a9d872..286583c60 100644
--- a/xc/lib/Xt/Selection.c
+++ b/xc/lib/Xt/Selection.c
@@ -1,4 +1,4 @@
-/* $XConsortium: Selection.c,v 1.97 94/09/09 21:59:10 converse Exp kaleb $ */
+/* $XConsortium: Selection.c,v 1.98 95/05/10 21:23:58 kaleb Exp converse $ */
 
 /***********************************************************
 Copyright 1987, 1988 by Digital Equipment Corporation, Maynard, Massachusetts,
@@ -1199,17 +1199,17 @@ Boolean *cont;
         (*info->callbacks[n])(widget, *info->req_closure, &ctx->selection, 
 			      &info->type, value, &length, &info->format);
       } else {
-          if ((BYTELENGTH(length,info->format)+info->offset) 
-			> info->bytelength) {
-	      unsigned int bytes;
-	      bytes = (info->bytelength *= 2);
-	      info->value = XtRealloc(info->value, bytes);
-          }
-          (void) memmove(&info->value[info->offset], value, 
-			 (int) BYTELENGTH(length, info->format));
-          info->offset += BYTELENGTH(length, info->format);
-         XFree(value);
-     }
+	  int size = BYTELENGTH(length, info->format);
+	  if (info->offset + size > info->bytelength) {
+	      /* allocate enough for this and the next increment */
+	      info->bytelength = info->offset + size * 2;
+	      info->value = XtRealloc(info->value,
+				      (Cardinal) info->bytelength);
+	  }
+	  (void) memmove(&info->value[info->offset], value, size);
+	  info->offset += size;
+	  XFree(value);
+      }
      /* reset timer */
 #ifndef DEBUG_WO_TIMERS
      {