[Xephyr/GL] don't crash when the host returns a NULL server string

1 files changed, 12 insertions, 2 deletions

diff --git a/hw/kdrive/ephyr/ephyrglxext.c b/hw/kdrive/ephyr/ephyrglxext.c
index 381c9d7ed..43a634d24 100644
--- a/hw/kdrive/ephyr/ephyrglxext.c
+++ b/hw/kdrive/ephyr/ephyrglxext.c
@@ -362,7 +362,7 @@ ephyrGLXQueryServerString(__GLXclientState *a_cl, GLbyte *a_pc)
     ClientPtr client = a_cl->client;
     xGLXQueryServerStringReq *req = (xGLXQueryServerStringReq *) a_pc;
     xGLXQueryServerStringReply reply;
-    char *server_string=NULL ;
+    char *server_string=NULL, *buf=NULL;
     int length=0 ;
 
     EPHYR_LOG ("enter\n") ;
@@ -379,9 +379,15 @@ ephyrGLXQueryServerString(__GLXclientState *a_cl, GLbyte *a_pc)
     reply.sequenceNumber = client->sequence ;
     reply.length = __GLX_PAD (length) >> 2 ;
     reply.n = length ;
+    buf = xcalloc (reply.length << 2, 1);
+    if (!buf) {
+        EPHYR_LOG_ERROR ("failed to allocate string\n;");
+        return BadAlloc;
+    }
+    memcpy (buf, server_string, length);
 
     WriteToClient(client, sz_xGLXQueryServerStringReply, (char*)&reply);
-    WriteToClient(client, (int)length, server_string);
+    WriteToClient(client, (int)(reply.length << 2), server_string);
 
     res = Success ;
 
@@ -391,6 +397,10 @@ out:
         xfree (server_string) ;
         server_string = NULL;
     }
+    if (buf) {
+        xfree (buf);
+        buf = NULL;
+    }
     return res ;
 }