summaryrefslogtreecommitdiff
authorAdam Jackson <ajax@redhat.com>2009-04-14 14:54:25 (GMT)
committer Adam Jackson <ajax@redhat.com>2009-04-14 14:57:19 (GMT)
commit0eb19f9437b7d8c19592e49eedb028771d300d80 (patch) (side-by-side diff)
treeb2ff0b2de883e509c05fba8b34b5ac2bf7ad6626
parentf0543ae4ec0fcb5d696e7b2983653bd779f1eddc (diff)
downloadxserver-0eb19f9437b7d8c19592e49eedb028771d300d80.zip
xserver-0eb19f9437b7d8c19592e49eedb028771d300d80.tar.gz
xdmcp: Don't crash on X -query with more than 255 IP addresses. (#20675)
You could be more clever than this, but the wire protocol says this really is an array of not more than 255 ARRAY8, so it's not just a matter of changing the types.
Diffstat (more/less context) (ignore whitespace changes)
-rw-r--r--os/xdmcp.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/os/xdmcp.c b/os/xdmcp.c
index cf95586..c1d650d 100644
--- a/os/xdmcp.c
+++ b/os/xdmcp.c
@@ -490,6 +490,8 @@ XdmcpRegisterConnection (
return;
}
}
+ if (ConnectionAddresses.length + 1 == 256)
+ return;
newAddress = xalloc (addrlen * sizeof (CARD8));
if (!newAddress)
return;