diff options
author | Adam Jackson <ajax@redhat.com> | 2010-06-28 18:08:50 -0400 |
---|---|---|
committer | Keith Packard <keithp@keithp.com> | 2010-08-19 18:00:18 -0700 |
commit | 5725849a1b427cd4a72b84e57f211edb35838718 (patch) | |
tree | a9c8066fbb53bfcd200d1159282fdedfd4d04db7 /render/render.c | |
parent | fc091936e2bddbbab9c9a501edc5a5f08388617e (diff) |
render: Bounds check for nglyphs in ProcRenderAddGlyphs (#28801)
Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
Diffstat (limited to 'render/render.c')
-rw-r--r-- | render/render.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/render/render.c b/render/render.c index ef233e498..00241f9af 100644 --- a/render/render.c +++ b/render/render.c | |||
@@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client) | |||
1077 | gi = (xGlyphInfo *) (gids + nglyphs); | 1077 | gi = (xGlyphInfo *) (gids + nglyphs); |
1078 | bits = (CARD8 *) (gi + nglyphs); | 1078 | bits = (CARD8 *) (gi + nglyphs); |
1079 | remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs; | 1079 | remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs; |
1080 | |||
1081 | /* protect against bad nglyphs */ | ||
1082 | if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) || | ||
1083 | bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) { | ||
1084 | err = BadLength; | ||
1085 | goto bail; | ||
1086 | } | ||
1087 | |||
1080 | for (i = 0; i < nglyphs; i++) | 1088 | for (i = 0; i < nglyphs; i++) |
1081 | { | 1089 | { |
1082 | size_t padded_width; | 1090 | size_t padded_width; |