From eb8141b6edd8b477c0ba796be71e985c35520a9b Mon Sep 17 00:00:00 2001
From: Julien Cristau <jcristau@debian.org>
Date: Mon, 7 Mar 2011 18:55:19 +0100
Subject: Xi: fix length checks for swapped clients

ChangeDeviceProperty and XIChangeProperty are followed by some data, so
use REQUEST_AT_LEAST_SIZE instead of REQUEST_SIZE_MATCH.

X.Org bug#35082 <https://bugs.freedesktop.org/show_bug.cgi?id=35082>

Reported-by: Markus Fleschutz <markus.fleschutz@x-software.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 Xi/xiproperty.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'Xi')

diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
index 17835e2cd..83ce93014 100644
--- a/Xi/xiproperty.c
+++ b/Xi/xiproperty.c
@@ -1051,11 +1051,11 @@ SProcXChangeDeviceProperty (ClientPtr client)
     char n;
     REQUEST(xChangeDevicePropertyReq);
 
+    REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq);
     swaps(&stuff->length, n);
     swapl(&stuff->property, n);
     swapl(&stuff->type, n);
     swapl(&stuff->nUnits, n);
-    REQUEST_SIZE_MATCH(xChangeDevicePropertyReq);
     return (ProcXChangeDeviceProperty(client));
 }
 
@@ -1295,12 +1295,12 @@ SProcXIChangeProperty(ClientPtr client)
     char n;
     REQUEST(xXIChangePropertyReq);
 
+    REQUEST_AT_LEAST_SIZE(xXIChangePropertyReq);
     swaps(&stuff->length, n);
     swaps(&stuff->deviceid, n);
     swapl(&stuff->property, n);
     swapl(&stuff->type, n);
     swapl(&stuff->num_items, n);
-    REQUEST_SIZE_MATCH(xXIChangePropertyReq);
     return (ProcXIChangeProperty(client));
 }
 
-- 
cgit v1.2.3