diff options
| author | Keith Packard <keithp@keithp.com> | 2014-12-09 11:47:11 -0800 |
|---|---|---|
| committer | Keith Packard <keithp@keithp.com> | 2014-12-09 11:47:11 -0800 |
| commit | 6704bb0ed7a10dabe8ef3bb3adf8b8a7f29a78f0 (patch) | |
| tree | 6a9a554a25afb4c3e90fe4a42d83f0cf259c5748 /hw | |
| parent | 8aa23f27c7e29c62d23867440b0bb00fc288b5ba (diff) | |
| parent | 1559a94395258fd73e369f1a2c98a44bfe21a486 (diff) | |
Merge remote-tracking branch 'alanc/master'
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/xfree86/dri2/dri2ext.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/xfree86/dri2/dri2ext.c b/hw/xfree86/dri2/dri2ext.c index ffd66fad6..221ec530b 100644 --- a/hw/xfree86/dri2/dri2ext.c +++ b/hw/xfree86/dri2/dri2ext.c @@ -270,6 +270,9 @@ ProcDRI2GetBuffers(ClientPtr client) unsigned int *attachments; REQUEST_FIXED_SIZE(xDRI2GetBuffersReq, stuff->count * 4); + if (stuff->count > (INT_MAX / 4)) + return BadLength; + if (!validDrawable(client, stuff->drawable, DixReadAccess | DixWriteAccess, &pDrawable, &status)) return status; |