XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-04-14 17:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix for CVE-2007-6427 - Xinput extension memory corruption.

Browse Source
This commit is contained in:
Matthieu Herrb
2008-01-17 15:27:34 +01:00
parent bbde5b62a1
commit dd5e0f5cd5
8 changed files with 33 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Xi/grabdev.c
View File

@@ -78,8 +78,6 @@ int
SProcXGrabDevice(ClientPtr client)
{
char n;
long *p;
int i;
REQUEST(xGrabDeviceReq);
swaps(&stuff->length, n);
@@ -87,11 +85,11 @@ SProcXGrabDevice(ClientPtr client)
swapl(&stuff->grabWindow, n);
swapl(&stuff->time, n);
swaps(&stuff->event_count, n);
p = (long *)&stuff[1];
for (i = 0; i < stuff->event_count; i++) {
swapl(p, n);
p++;
}
if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
return BadLength;
SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDevice(client));
}