Fix an integer underflow in XIChangeHierarchy()

Reported by Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.
This commit is contained in:
matthieu 2020-08-25 15:41:59 +00:00
parent 02b8f73518
commit 77c86a2898

View File

@ -423,7 +423,7 @@ ProcXIChangeHierarchy(ClientPtr client)
if (!stuff->num_changes)
return rc;
len = ((size_t)stuff->length << 2) - sizeof(xXIChangeHierarchyReq);
len = ((size_t)client->req_len << 2) - sizeof(xXIChangeHierarchyReq);
any = (xXIAnyHierarchyChangeInfo *) &stuff[1];
while (stuff->num_changes--) {