diff options
Diffstat (limited to 'render/render.c')
| -rw-r--r-- | render/render.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/render/render.c b/render/render.c index b9a932ee3..bfacaa0d0 100644 --- a/render/render.c +++ b/render/render.c @@ -1908,6 +1908,8 @@ ProcRenderCreateRadialGradient(ClientPtr client) LEGAL_NEW_RESOURCE(stuff->pid, client); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); + if (stuff->nStops > UINT32_MAX / (sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops * (sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -1946,6 +1948,8 @@ ProcRenderCreateConicalGradient(ClientPtr client) LEGAL_NEW_RESOURCE(stuff->pid, client); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); + if (stuff->nStops > UINT32_MAX / (sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops * (sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; |