diff --git a/record/record.c b/record/record.c index ca9254ce1..d34fa106b 100644 --- a/record/record.c +++ b/record/record.c @@ -46,6 +46,7 @@ and Jim Haggerty of Metheus. #include "swaprep.h" #include "inputstr.h" #include "scrnintstr.h" +#include "opaque.h" #include #include @@ -1299,6 +1300,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client, int i; XID recordingClient; + /* LimitClients is 2048 at max, way less that MAXINT */ + if (stuff->nClients > LimitClients) + return BadValue; + + if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange)) + return BadValue; + if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) != 4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges) return BadLength;