From 606f6dba16d42e3546a82a386d5a01087467b511 Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@redhat.com>
Date: Tue, 14 Apr 2009 10:54:25 -0400
Subject: [PATCH] xdmcp: Don't crash on X -query with more than 255 IP
 addresses. (#20675)

You could be more clever than this, but the wire protocol says this
really is an array of not more than 255 ARRAY8, so it's not just a
matter of changing the types.

(cherry picked from commit 0eb19f9437b7d8c19592e49eedb028771d300d80)
---
 os/xdmcp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/os/xdmcp.c b/os/xdmcp.c
index 736cd3e11..746f5985c 100644
--- a/os/xdmcp.c
+++ b/os/xdmcp.c
@@ -491,7 +491,9 @@ XdmcpRegisterConnection (
 	    return;
 	}
     }
-    newAddress = (CARD8 *) xalloc (addrlen * sizeof (CARD8));
+    if (ConnectionAddresses.length + 1 == 256)
+	return;
+    newAddress = xalloc (addrlen * sizeof (CARD8));
     if (!newAddress)
 	return;
     if (!XdmcpReallocARRAY16 (&ConnectionTypes, ConnectionTypes.length + 1))