Fix an integer underflow in XIChangeHierarchy()
Reported by Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.
This commit is contained in:
parent
02b8f73518
commit
77c86a2898
@ -423,7 +423,7 @@ ProcXIChangeHierarchy(ClientPtr client)
|
||||
if (!stuff->num_changes)
|
||||
return rc;
|
||||
|
||||
len = ((size_t)stuff->length << 2) - sizeof(xXIChangeHierarchyReq);
|
||||
len = ((size_t)client->req_len << 2) - sizeof(xXIChangeHierarchyReq);
|
||||
|
||||
any = (xXIAnyHierarchyChangeInfo *) &stuff[1];
|
||||
while (stuff->num_changes--) {
|
||||
|
Loading…
Reference in New Issue
Block a user