diff --git a/src/cairo-xlib-private.h b/src/cairo-xlib-private.h index 71dccc3a7..8e338aea6 100644 --- a/src/cairo-xlib-private.h +++ b/src/cairo-xlib-private.h @@ -65,6 +65,8 @@ typedef struct _cairo_xlib_surface cairo_xlib_surface_t; #define RAMP_SIZE 16 /* maximum number of cached GC's */ #define GC_CACHE_SIZE 4 +/* maximum width/height of an X11 drawable */ +#define XLIB_COORD_MAX 32767 struct _cairo_xlib_display { cairo_device_t base; diff --git a/src/cairo-xlib-surface-shm.c b/src/cairo-xlib-surface-shm.c index 1ee1e3d70..ccdaf4cbc 100644 --- a/src/cairo-xlib-surface-shm.c +++ b/src/cairo-xlib-surface-shm.c @@ -809,6 +809,9 @@ _cairo_xlib_shm_surface_create (cairo_xlib_surface_t *other, pixman_image_t *image; int stride, size; + if (width > XLIB_COORD_MAX || height > XLIB_COORD_MAX) + return NULL; + stride = CAIRO_STRIDE_FOR_WIDTH_BPP (width, PIXMAN_FORMAT_BPP(format)); size = stride * height; if (size < MIN_SIZE) diff --git a/src/cairo-xlib-surface.c b/src/cairo-xlib-surface.c index 2a6d896d3..7d368a8ba 100644 --- a/src/cairo-xlib-surface.c +++ b/src/cairo-xlib-surface.c @@ -72,8 +72,6 @@ #include #include -#define XLIB_COORD_MAX 32767 - #define DEBUG 0 #if DEBUG