fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-02-15 20:50:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Xext: saver: fix length checking with bigreq

Browse source 
The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
(cherry picked from commit bacc4b1477)
This commit is contained in:
Enrico Weigelt, metux IT consult 2024-08-06 15:58:11 +02:00 • committed by Alan Coopersmith
parent f5a24358bf
commit d9f8aad4b6
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Xext/saver.c
View file

@ -749,7 +749,7 @@ ScreenSaverSetAttributes(ClientPtr client)
if (ret != Success)
return ret;
len = stuff->length - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq));
len = client->req_len - bytes_to_int32(sizeof(xScreenSaverSetAttributesReq));
if (Ones(stuff->mask) != len)
return BadLength;
if (!stuff->width || !stuff->height) {
@ -1098,7 +1098,7 @@ ProcScreenSaverSetAttributes(ClientPtr client)
return (status == BadValue) ? BadDrawable : status;
len =
stuff->length -
client->req_len -
bytes_to_int32(sizeof(xScreenSaverSetAttributesReq));
if (Ones(stuff->mask) != len)
return BadLength;