diff options
| author | Julien Cristau <jcristau@debian.org> | 2011-03-07 18:55:19 +0100 |
|---|---|---|
| committer | Jeremy Huddleston <jeremyhu@apple.com> | 2011-03-27 22:33:48 -0700 |
| commit | 09f6d85b5bb49406f015ec667bb6efb3e710ced2 (patch) | |
| tree | a6e68fec2ba7431ece5334c9e2c7ff286943f0f1 /Xi | |
| parent | d1caa195abc648560f81356c40f08e7630544db9 (diff) | |
Xi: fix length checks for swapped clients
ChangeDeviceProperty and XIChangeProperty are followed by some data, so
use REQUEST_AT_LEAST_SIZE instead of REQUEST_SIZE_MATCH.
X.Org bug#35082 <https://bugs.freedesktop.org/show_bug.cgi?id=35082>
Reported-by: Markus Fleschutz <markus.fleschutz@x-software.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit eb8141b6edd8b477c0ba796be71e985c35520a9b)
Diffstat (limited to 'Xi')
| -rw-r--r-- | Xi/xiproperty.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c index 17835e2cd..83ce93014 100644 --- a/Xi/xiproperty.c +++ b/Xi/xiproperty.c @@ -1051,11 +1051,11 @@ SProcXChangeDeviceProperty (ClientPtr client) char n; REQUEST(xChangeDevicePropertyReq); + REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq); swaps(&stuff->length, n); swapl(&stuff->property, n); swapl(&stuff->type, n); swapl(&stuff->nUnits, n); - REQUEST_SIZE_MATCH(xChangeDevicePropertyReq); return (ProcXChangeDeviceProperty(client)); } @@ -1295,12 +1295,12 @@ SProcXIChangeProperty(ClientPtr client) char n; REQUEST(xXIChangePropertyReq); + REQUEST_AT_LEAST_SIZE(xXIChangePropertyReq); swaps(&stuff->length, n); swaps(&stuff->deviceid, n); swapl(&stuff->property, n); swapl(&stuff->type, n); swapl(&stuff->num_items, n); - REQUEST_SIZE_MATCH(xXIChangePropertyReq); return (ProcXIChangeProperty(client)); } |