diff options
| author | Dave Airlie <airlied@redhat.com> | 2011-10-19 16:22:31 +0100 |
|---|---|---|
| committer | Jeremy Huddleston <jeremyhu@apple.com> | 2011-12-09 12:35:18 -0800 |
| commit | befa8a3b836e8b5781491aff4e659ae856beb494 (patch) | |
| tree | 92354ef644a28fe5253775daff4a5accd7f29390 | |
| parent | b22783f483d440a005ff76d5c7894e2cf2a95dcb (diff) | |
Xi: avoid overrun of callback array.
This code had an off-by-one and would allow writing one past the end of
the callbacks array.
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 682c09a2cedd234b005334cc01247d859dd7f26a)
| -rw-r--r-- | Xi/extinit.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Xi/extinit.c b/Xi/extinit.c index 0905e1877..0ce4e060b 100644 --- a/Xi/extinit.c +++ b/Xi/extinit.c @@ -409,7 +409,7 @@ static int ProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) return BadRequest; return (*ProcIVector[stuff->data])(client); @@ -428,7 +428,7 @@ static int SProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) return BadRequest; return (*SProcIVector[stuff->data])(client); |