diff options
| author | Peter Hutterer <peter@cs.unisa.edu.au> | 2008-01-26 13:55:07 +1030 |
|---|---|---|
| committer | Peter Hutterer <peter@cs.unisa.edu.au> | 2008-01-26 13:55:07 +1030 |
| commit | 0ac175597712edfeae676f536746a4d26d625e30 (patch) | |
| tree | bd34a9601dc6f1a446646e0907e49c90c6862cc0 /dix/dixfonts.c | |
| parent | 210eeef495770c1883c842ff003c28ce25f279d4 (diff) | |
| parent | e915a2639752bc0ea9e6e192e020cc2031c08063 (diff) | |
Merge branch 'master' into mpx
Conflicts:
Xext/sampleEVI.c
Diffstat (limited to 'dix/dixfonts.c')
| -rw-r--r-- | dix/dixfonts.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/dix/dixfonts.c b/dix/dixfonts.c index da10a564e..4cc8d7188 100644 --- a/dix/dixfonts.c +++ b/dix/dixfonts.c @@ -326,6 +326,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c) err = BadFontName; goto bail; } + /* check values for firstCol, lastCol, firstRow, and lastRow */ + if (pfont->info.firstCol > pfont->info.lastCol || + pfont->info.firstRow > pfont->info.lastRow || + pfont->info.lastCol - pfont->info.firstCol > 255) { + err = AllocError; + goto bail; + } if (!pfont->fpe) pfont->fpe = fpe; pfont->refcnt++; |