Fix an integer overflow in init_om()

CVE-2020-14363

This can lead to a double free later, as reported by Jayden Rivers.

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
This commit is contained in:
Matthieu Herrb 2020-08-13 18:02:58 +02:00
parent d15c24c8b4
commit acdaaadcb3

View file

@ -1908,7 +1908,8 @@ init_om(
char **required_list;
XOrientation *orientation;
char **value, buf[BUFSIZ], *bufptr;
int count = 0, num = 0, length = 0;
int count = 0, num = 0;
unsigned int length = 0;
_XlcGetResource(lcd, "XLC_FONTSET", "on_demand_loading", &value, &count);
if (count > 0 && _XlcCompareISOLatin1(*value, "True") == 0)