diff options
| author | Adam Jackson <ajax@redhat.com> | 2009-04-14 10:54:25 -0400 |
|---|---|---|
| committer | Adam Jackson <ajax@redhat.com> | 2009-07-09 12:05:31 -0400 |
| commit | 606f6dba16d42e3546a82a386d5a01087467b511 (patch) | |
| tree | 95652edd38e4e5a38d9dfab15776bacae727276c | |
| parent | 396d3a7762abd0dd84042833b75f2ebf9d100bb0 (diff) | |
xdmcp: Don't crash on X -query with more than 255 IP addresses. (#20675)
You could be more clever than this, but the wire protocol says this
really is an array of not more than 255 ARRAY8, so it's not just a
matter of changing the types.
(cherry picked from commit 0eb19f9437b7d8c19592e49eedb028771d300d80)
| -rw-r--r-- | os/xdmcp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/os/xdmcp.c b/os/xdmcp.c index 736cd3e11..746f5985c 100644 --- a/os/xdmcp.c +++ b/os/xdmcp.c @@ -491,7 +491,9 @@ XdmcpRegisterConnection ( return; } } - newAddress = (CARD8 *) xalloc (addrlen * sizeof (CARD8)); + if (ConnectionAddresses.length + 1 == 256) + return; + newAddress = xalloc (addrlen * sizeof (CARD8)); if (!newAddress) return; if (!XdmcpReallocARRAY16 (&ConnectionTypes, ConnectionTypes.length + 1)) |