diff options
| author | Dave Airlie <airlied@redhat.com> | 2011-10-19 16:22:31 +0100 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2011-12-06 16:00:35 +0000 |
| commit | 682c09a2cedd234b005334cc01247d859dd7f26a (patch) | |
| tree | 1ca1c18aca45486d7f304c8ae0d0d9c298bed316 | |
| parent | b62dc4fcbcffd10de16650bee284702c8608bb60 (diff) | |
Xi: avoid overrun of callback array.
This code had an off-by-one and would allow writing one past the end of
the callbacks array.
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
| -rw-r--r-- | Xi/extinit.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Xi/extinit.c b/Xi/extinit.c index a2c807b46..b43f9bbc0 100644 --- a/Xi/extinit.c +++ b/Xi/extinit.c @@ -409,7 +409,7 @@ static int ProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(ProcIVector) || !ProcIVector[stuff->data]) return BadRequest; return (*ProcIVector[stuff->data])(client); @@ -428,7 +428,7 @@ static int SProcIDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data > ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) + if (stuff->data >= ARRAY_SIZE(SProcIVector) || !SProcIVector[stuff->data]) return BadRequest; return (*SProcIVector[stuff->data])(client); |