diff options
| -rw-r--r-- | Xi/xiselectev.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c index d7b16446f..eac12c50f 100644 --- a/Xi/xiselectev.c +++ b/Xi/xiselectev.c @@ -69,6 +69,7 @@ ProcXISelectEvents(ClientPtr client) DeviceIntRec dummy; xXIEventMask *evmask; int *types = NULL; + int len; REQUEST(xXISelectEventsReq); REQUEST_AT_LEAST_SIZE(xXISelectEventsReq); @@ -80,11 +81,18 @@ ProcXISelectEvents(ClientPtr client) if (rc != Success) return rc; + len = sz_xXISelectEventsReq; + /* check request validity */ evmask = (xXIEventMask*)&stuff[1]; num_masks = stuff->num_masks; while(num_masks--) { + len += sizeof(xXIEventMask) + evmask->mask_len * 4; + + if (bytes_to_int32(len) > stuff->length) + return BadLength; + if (evmask->deviceid != XIAllDevices && evmask->deviceid != XIAllMasterDevices) rc = dixLookupDevice(&dev, evmask->deviceid, client, DixUseAccess); @@ -128,6 +136,9 @@ ProcXISelectEvents(ClientPtr client) evmask++; } + if (bytes_to_int32(len) != stuff->length) + return BadLength; + /* Set masks on window */ evmask = (xXIEventMask*)&stuff[1]; num_masks = stuff->num_masks; |