1 files changed, 3 insertions, 0 deletions
diff --git a/dix/dispatch.c b/dix/dispatch.c
index 4f830f7f4..01820bc0f 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -1956,6 +1956,9 @@ ProcPutImage(ClientPtr client)
     tmpImage = (char *) &stuff[1];
     lengthProto = length;
 
+    if (lengthProto >= (INT32_MAX / stuff->height))
+        return BadLength;
+
     if ((bytes_to_int32(lengthProto * stuff->height) +
          bytes_to_int32(sizeof(xPutImageReq))) != client->req_len)
         return BadLength;