From ac2356843e38b3400142bc54b65393c12976fc07 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter@cs.unisa.edu.au>
Date: Sun, 25 Mar 2007 09:41:33 +0930
Subject: dix: Increase allocation size for core keyboard keymap to avoid
 buffer overrun when copying keymap from extension devices.

---
 dix/devices.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dix/devices.c b/dix/devices.c
index f73841932..5996b75cd 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -238,7 +238,7 @@ CoreKeyboardProc(DeviceIntPtr pDev, int what)
         keySyms.mapWidth = 4;
         keySyms.map = (KeySym *)xcalloc(sizeof(KeySym),
                                         (keySyms.maxKeyCode -
-                                         keySyms.minKeyCode) *
+                                         keySyms.minKeyCode + 1) *
                                         keySyms.mapWidth);
         if (!keySyms.map) {
             ErrorF("Couldn't allocate core keymap\n");
-- 
cgit v1.2.3