diff options
Diffstat (limited to 'Xi/sendexev.c')
| -rw-r--r-- | Xi/sendexev.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/Xi/sendexev.c b/Xi/sendexev.c index 5acdb4761..8c975e3a3 100644 --- a/Xi/sendexev.c +++ b/Xi/sendexev.c @@ -80,7 +80,7 @@ int SProcXSendExtensionEvent(ClientPtr client) { char n; - long *p; + CARD32 *p; int i; xEvent eventT; xEvent *eventP; @@ -91,6 +91,11 @@ SProcXSendExtensionEvent(ClientPtr client) REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); swapl(&stuff->destination, n); swaps(&stuff->count, n); + + if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + + (stuff->num_events * (sizeof(xEvent) >> 2))) + return BadLength; + eventP = (xEvent *) & stuff[1]; for (i = 0; i < stuff->num_events; i++, eventP++) { proc = EventSwapVector[eventP->u.u.type & 0177]; @@ -100,11 +105,8 @@ SProcXSendExtensionEvent(ClientPtr client) *eventP = eventT; } - p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events); - for (i = 0; i < stuff->count; i++) { - swapl(p, n); - p++; - } + p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events); + SwapLongs(p, stuff->count); return (ProcXSendExtensionEvent(client)); } |