diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2009-09-01 16:30:52 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2009-09-03 08:39:27 +1000 |
| commit | 59a6d7d478903a8bc9c5d4cc8b2e62e2ad102dba (patch) | |
| tree | a5e16ec29cae585656c9531d33e67a433fad55d1 /Xi/xigrabdev.c | |
| parent | 83db2b126e8623824e1303e74070375994984599 (diff) | |
Xi: don't overrun memory for grab masks.
A grab mask provided in the request may be larger than the one used in the
server. Cut down to size before memcopying.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'Xi/xigrabdev.c')
| -rw-r--r-- | Xi/xigrabdev.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c index 95beb832b..5394b1900 100644 --- a/Xi/xigrabdev.c +++ b/Xi/xigrabdev.c @@ -66,6 +66,7 @@ ProcXIGrabDevice(ClientPtr client) int ret = Success; uint8_t status; GrabMask mask; + int mask_len; REQUEST(xXIGrabDeviceReq); REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq); @@ -77,8 +78,9 @@ ProcXIGrabDevice(ClientPtr client) if (!IsMaster(dev)) stuff->paired_device_mode = GrabModeAsync; + mask_len = min(sizeof(mask.xi2mask[stuff->deviceid]), stuff->mask_len * 4); memset(mask.xi2mask, 0, sizeof(mask.xi2mask)); - memcpy(mask.xi2mask, (char*)&stuff[1], stuff->mask_len * 4); + memcpy(mask.xi2mask, (char*)&stuff[1], mask_len); ret = GrabDevice(client, dev, stuff->grab_mode, stuff->paired_device_mode, |