diff options
| author | Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com> | 2012-05-29 10:17:50 +0530 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2012-06-04 11:28:44 +1000 |
| commit | 42ae2e8199fe875319978249963de7499607988b (patch) | |
| tree | a3ce697919b80de7556c53c5c5dfedbcf593f26d /xkb | |
| parent | 88c767edb01ed7efb19ffe3a453e16107b27130b (diff) | |
xkb: Allocate size_syms correctly when width of a type increases
The current code seems to skip syms with width less than
type->num_levels when calculating the total size for the new
size_syms. This leads to less space being allocated than necessary
during the next phase, which is to copy over the syms to the new
location. This results in an overflow leading to a crash.
Signed-off-by: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'xkb')
| -rw-r--r-- | xkb/XKBMAlloc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/xkb/XKBMAlloc.c b/xkb/XKBMAlloc.c index 645e90544..3ffd5dad1 100644 --- a/xkb/XKBMAlloc.c +++ b/xkb/XKBMAlloc.c @@ -375,8 +375,10 @@ XkbResizeKeyType(XkbDescPtr xkb, nResize = 0; for (nTotal = 1, i = xkb->min_key_code; i <= xkb->max_key_code; i++) { width = XkbKeyGroupsWidth(xkb, i); - if (width < type->num_levels) + if (width < type->num_levels || width >= new_num_lvls) { + nTotal += XkbKeyNumSyms(xkb,i); continue; + } for (match = 0, g = XkbKeyNumGroups(xkb, i) - 1; (g >= 0) && (!match); g--) { if (XkbKeyKeyTypeIndex(xkb, i, g) == type_ndx) { @@ -384,7 +386,7 @@ XkbResizeKeyType(XkbDescPtr xkb, match = 1; } } - if ((!match) || (width >= new_num_lvls)) + if (!match) nTotal += XkbKeyNumSyms(xkb, i); else { nTotal += XkbKeyNumGroups(xkb, i) * new_num_lvls; |