diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2009-09-01 16:30:52 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2009-09-03 08:39:27 +1000 |
| commit | 59a6d7d478903a8bc9c5d4cc8b2e62e2ad102dba (patch) | |
| tree | a5e16ec29cae585656c9531d33e67a433fad55d1 /Xi/xipassivegrab.c | |
| parent | 83db2b126e8623824e1303e74070375994984599 (diff) | |
Xi: don't overrun memory for grab masks.
A grab mask provided in the request may be larger than the one used in the
server. Cut down to size before memcopying.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'Xi/xipassivegrab.c')
| -rw-r--r-- | Xi/xipassivegrab.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c index 1d6200f3a..0cfdc1d9b 100644 --- a/Xi/xipassivegrab.c +++ b/Xi/xipassivegrab.c @@ -86,6 +86,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) GrabMask mask; GrabParameters param; void *tmp; + int mask_len; REQUEST(xXIPassiveGrabDeviceReq); REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq); @@ -127,8 +128,9 @@ ProcXIPassiveGrabDevice(ClientPtr client) } } + mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4); memset(mask.xi2mask, 0, sizeof(mask.xi2mask)); - memcpy(mask.xi2mask[stuff->deviceid], &stuff[1], stuff->mask_len * 4); + memcpy(mask.xi2mask[stuff->deviceid], &stuff[1], mask_len * 4); rep.repType = X_Reply; rep.RepType = X_XIPassiveGrabDevice; |