Xi: fix length checking with bigreq

The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
This commit is contained in:
Enrico Weigelt, metux IT consult
2024-08-06 11:39:09 +02:00
committed by Marge Bot
parent e1e8ab3ddf
commit fc9f8f8d3c
15 changed files with 19 additions and 19 deletions

View File

@@ -106,7 +106,7 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
if (ret != Success)
return ret;
len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceKeyMappingReq));
len = client->req_len - bytes_to_int32(sizeof(xChangeDeviceKeyMappingReq));
ret = ChangeKeyMapping(client, dev, len, DeviceMappingNotify,
stuff->firstKeyCode, stuff->keyCodes,