summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--src/xkb/XKBExtDev.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/xkb/XKBExtDev.c b/src/xkb/XKBExtDev.c
index 353e769b..dd383bc1 100644
--- a/src/xkb/XKBExtDev.c
+++ b/src/xkb/XKBExtDev.c
@@ -181,6 +181,9 @@ int tmp;
return tmp;
}
if (rep->nBtnsWanted>0) {
+ if (((unsigned short) rep->firstBtnWanted + rep->nBtnsWanted)
+ >= devi->num_btns)
+ goto BAILOUT;
act= &devi->btn_acts[rep->firstBtnWanted];
bzero((char *)act,(rep->nBtnsWanted*sizeof(XkbAction)));
}
@@ -190,6 +193,9 @@ int tmp;
goto BAILOUT;
if (rep->nBtnsRtrn>0) {
int size;
+ if (((unsigned short) rep->firstBtnRtrn + rep->nBtnsRtrn)
+ >= devi->num_btns)
+ goto BAILOUT;
act= &devi->btn_acts[rep->firstBtnRtrn];
size= rep->nBtnsRtrn*SIZEOF(xkbActionWireDesc);
if (!_XkbCopyFromReadBuffer(&buf,(char *)act,size))