From 3d1c57d5ef429e51ab7a626540c30b81e74a8f17 Mon Sep 17 00:00:00 2001 From: Reinhard Tartler Date: Mon, 10 Oct 2011 17:46:43 +0200 Subject: Imported nx-X11-3.1.0-4.tar.gz Summary: Imported nx-X11-3.1.0-4.tar.gz Keywords: Imported nx-X11-3.1.0-4.tar.gz into Git repository --- nx-X11/programs/Xserver/Xext/EVI.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'nx-X11/programs/Xserver/Xext/EVI.c') diff --git a/nx-X11/programs/Xserver/Xext/EVI.c b/nx-X11/programs/Xserver/Xext/EVI.c index b59180685..93ed19fa6 100644 --- a/nx-X11/programs/Xserver/Xext/EVI.c +++ b/nx-X11/programs/Xserver/Xext/EVI.c @@ -36,6 +36,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. #include #include "EVIstruct.h" #include "modinit.h" +#include "scrnintstr.h" #if 0 static unsigned char XEVIReqCode = 0; @@ -89,10 +90,22 @@ ProcEVIGetVisualInfo(ClientPtr client) { REQUEST(xEVIGetVisualInfoReq); xEVIGetVisualInfoReply rep; - int n, n_conflict, n_info, sz_info, sz_conflict; + int i, n, n_conflict, n_info, sz_info, sz_conflict; VisualID32 *conflict; + unsigned int total_visuals = 0; xExtendedVisualInfo *eviInfo; int status; + + /* + * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume + * here that you don't have more than 2^32 visuals over all your screens; + * this seems like a safe assumption. + */ + for (i = 0; i < screenInfo.numScreens; i++) + total_visuals += screenInfo.screens[i]->numVisuals; + if (stuff->n_visual > total_visuals) + return BadValue; + REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32); status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual, &eviInfo, &n_info, &conflict, &n_conflict); -- cgit v1.2.3