diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-13 09:32:12 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-13 10:06:26 -0700 |
| commit | ca84a813716f9de691dc3f60390d83af4b5ae534 (patch) | |
| tree | accc0871f9b97ddbaad77a39ddec4b5226469963 /src/XMultibuf.c | |
| parent | 8eee1236041d46a21faba32e0d27c26985267d89 (diff) | |
Use _XEatDataWords to avoid overflow of rep.length bit shifting
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'src/XMultibuf.c')
| -rw-r--r-- | src/XMultibuf.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/XMultibuf.c b/src/XMultibuf.c index 7a746ba..43d56d3 100644 --- a/src/XMultibuf.c +++ b/src/XMultibuf.c @@ -34,6 +34,7 @@ in this Software without prior written authorization from The Open Group. #include <X11/extensions/extutil.h> #include <X11/extensions/multibufproto.h> #include <X11/extensions/multibuf.h> +#include "eat.h" static XExtensionInfo _multibuf_info_data; static XExtensionInfo *multibuf_info = &_multibuf_info_data; @@ -408,7 +409,7 @@ Status XmbufGetWindowAttributes ( attr->buffers = (Multibuffer *) Xmalloc((unsigned) nbytes); nbytes = rep.length << 2; if (! attr->buffers) { - _XEatData(dpy, (unsigned long) nbytes); + _XEatDataWords(dpy, rep.length); UnlockDisplay(dpy); SyncHandle(); return (0); |