XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-24 08:04:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Xi: fix length checking with bigreq

Browse Source 
The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1639>
This commit is contained in:
Enrico Weigelt, metux IT consult
2024-08-06 11:39:09 +02:00
committed by Marge Bot
parent e1e8ab3ddf
commit fc9f8f8d3c
15 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Xi/sendexev.c
View File

@@ -87,7 +87,7 @@ SProcXSendExtensionEvent(ClientPtr client)
swapl(&stuff->destination);
swaps(&stuff->count);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count +
bytes_to_int32(stuff->num_events * sizeof(xEvent)))
return BadLength;
@@ -133,7 +133,7 @@ ProcXSendExtensionEvent(ClientPtr client)
REQUEST(xSendExtensionEventReq);
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
if (stuff->length !=
if (client->req_len !=
bytes_to_int32(sizeof(xSendExtensionEventReq)) + stuff->count +
(stuff->num_events * bytes_to_int32(sizeof(xEvent))))
return BadLength;