XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-24 08:04:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix for CVE-2007-6427 - Xinput extension memory corruption.

Browse Source
This commit is contained in:
Matthieu Herrb
2008-01-17 15:27:34 +01:00
parent bbde5b62a1
commit dd5e0f5cd5
8 changed files with 33 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
Xi/grabdevb.c
View File

@@ -77,8 +77,6 @@ int
SProcXGrabDeviceButton(ClientPtr client)
{
char n;
long *p;
int i;
REQUEST(xGrabDeviceButtonReq);
swaps(&stuff->length, n);
@@ -86,11 +84,9 @@ SProcXGrabDeviceButton(ClientPtr client)
swapl(&stuff->grabWindow, n);
swaps(&stuff->modifiers, n);
swaps(&stuff->event_count, n);
p = (long *)&stuff[1];
for (i = 0; i < stuff->event_count; i++) {
swapl(p, n);
p++;
}
REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
stuff->event_count * sizeof(CARD32));
SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDeviceButton(client));
}