diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-03-10 00:22:14 -0800 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-23 08:13:26 -0700 |
| commit | ef82512288d8ca36ac0beeb289f158195b0a8cae (patch) | |
| tree | e479ca0ef85dada4c1a2b69902ea68c769ed1fbc /COPYING | |
| parent | 17071c1c608247800b2ca03a35b1fcc9c4cabe6c (diff) | |
Avoid integer overflow in XListInputDevices() [CVE-2013-1984 8/8]
If the length of the reply as reported by the Xserver is too long, it
could overflow the calculation for the size of the buffer to copy the
reply into, causing memory corruption.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'COPYING')
0 files changed, 0 insertions, 0 deletions