diff options
Diffstat (limited to 'Xext/xres.c')
| -rw-r--r-- | Xext/xres.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/Xext/xres.c b/Xext/xres.c index ae779dfe8..bc54133d2 100644 --- a/Xext/xres.c +++ b/Xext/xres.c @@ -947,6 +947,8 @@ ProcXResQueryResourceBytes (ClientPtr client) ConstructResourceBytesCtx ctx; REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq); + if (stuff->numSpecs > UINT32_MAX / sizeof(ctx.specs[0])) + return BadLength; REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq, stuff->numSpecs * sizeof(ctx.specs[0])); @@ -1052,8 +1054,8 @@ SProcXResQueryResourceBytes (ClientPtr client) int c; xXResResourceIdSpec *specs = (void*) ((char*) stuff + sizeof(*stuff)); - swapl(&stuff->numSpecs); REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq); + swapl(&stuff->numSpecs); REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq, stuff->numSpecs * sizeof(specs[0])); |