diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-03-31 12:22:35 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-09 18:59:54 -0700 |
| commit | e1b457beb8d4e831ef44279dada6c475cb955738 (patch) | |
| tree | 1720bfcf23905f20d821ed8f7c19e58ab2cbc7bc | |
| parent | 12ad4c6432496897ff000eb7cfecd0fb4b290331 (diff) | |
_XkbReadGetMapReply: reject maxKeyCodes smaller than the minKeyCode
Various other bounds checks in the code assume this is true, so
enforce it when we first get the data from the X server.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
| -rw-r--r-- | src/xkb/XKBGetMap.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c index 5551298c..0875dfd0 100644 --- a/src/xkb/XKBGetMap.c +++ b/src/xkb/XKBGetMap.c @@ -484,6 +484,8 @@ unsigned mask; if ( xkb->device_spec == XkbUseCoreKbd ) xkb->device_spec= rep->deviceID; + if ( rep->maxKeyCode < rep->minKeyCode ) + return BadImplementation; xkb->min_key_code = rep->minKeyCode; xkb->max_key_code = rep->maxKeyCode; |