diff --git a/render/animcur.c b/render/animcur.c index eb8b817e2..a53e2a473 100644 --- a/render/animcur.c +++ b/render/animcur.c @@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor, int rc = BadAlloc, i; AnimCurPtr ac; + if (ncursor <= 0) + return BadValue; + for (i = 0; i < screenInfo.numScreens; i++) if (!GetAnimCurScreen(screenInfo.screens[i])) return BadImplementation; diff --git a/render/render.c b/render/render.c index fe5e37dd9..69d99c25b 100644 --- a/render/render.c +++ b/render/render.c @@ -1795,6 +1795,8 @@ ProcRenderCreateAnimCursor(ClientPtr client) ncursor = (client->req_len - (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1; + if (ncursor <= 0) + return BadValue; cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32)); if (!cursors) return BadAlloc;