diff --git a/render/render.c b/render/render.c index c6d55daa8..40b8439c6 100644 --- a/render/render.c +++ b/render/render.c @@ -1562,6 +1562,8 @@ ProcRenderCreateCursor (ClientPtr client) pScreen = pSrc->pDrawable->pScreen; width = pSrc->pDrawable->width; height = pSrc->pDrawable->height; + if (height && width > UINT32_MAX/(height*sizeof(CARD32))) + return BadAlloc; if ( stuff->x > width || stuff->y > height ) return (BadMatch);