diff options
| -rw-r--r-- | src/XvMC.c | 36 |
1 files changed, 19 insertions, 17 deletions
@@ -501,3 +501,2 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, xvmcGetDRInfoReq *req; - char *tmpBuf = NULL; CARD32 magic; @@ -512,2 +511,5 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, + *name = NULL; + *busID = NULL; + XvMCCheckExtension (dpy, info, BadImplementation); @@ -570,16 +572,11 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, if (rep.length > 0) { - - int realSize = rep.length << 2; - - tmpBuf = (char *) Xmalloc(realSize); - if (tmpBuf) { - *name = (char *) Xmalloc(rep.nameLen); - if (*name) { - *busID = (char *) Xmalloc(rep.busIDLen); - if (! *busID) { - XFree(*name); - XFree(tmpBuf); - } - } else { - XFree(tmpBuf); + unsigned long realSize = 0; + char *tmpBuf = NULL; + + if (rep.length < (INT_MAX >> 2)) { + realSize = rep.length << 2; + if (realSize >= (rep.nameLen + rep.busIDLen)) { + tmpBuf = Xmalloc(realSize); + *name = Xmalloc(rep.nameLen); + *busID = Xmalloc(rep.busIDLen); } @@ -588,9 +585,14 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, if (*name && *busID && tmpBuf) { - _XRead(dpy, tmpBuf, realSize); strncpy(*name,tmpBuf,rep.nameLen); + name[rep.nameLen - 1] = '\0'; strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen); + busID[rep.busIDLen - 1] = '\0'; XFree(tmpBuf); - } else { + XFree(*name); + *name = NULL; + XFree(*busID); + *name = NULL; + XFree(tmpBuf); |