From 1137c11be0f82049d28024eaf963c6f76e0d4334 Mon Sep 17 00:00:00 2001 From: Julien Cristau Date: Wed, 26 Jan 2011 13:06:53 +0100 Subject: glx: fix BindTexImageEXT length check The request is followed by a list of attributes. X.Org bug#33449 Reported-and-tested-by: meng Signed-off-by: Julien Cristau Reviewed-by: Adam Jackson --- glx/glxcmdsswap.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'glx/glxcmdsswap.c') diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c index 9d96c9de3..d58de6299 100644 --- a/glx/glxcmdsswap.c +++ b/glx/glxcmdsswap.c @@ -648,19 +648,23 @@ int __glXDispSwap_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc) xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc; GLXDrawable *drawId; int *buffer; + CARD32 *num_attribs; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8); + if ((sizeof(xGLXVendorPrivateReq) + 12) >> 2 > client->req_len) + return BadLength; pc += __GLX_VENDPRIV_HDR_SIZE; drawId = ((GLXDrawable *) (pc)); buffer = ((int *) (pc + 4)); + num_attribs = ((CARD32 *) (pc + 8)); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->contextTag); __GLX_SWAP_INT(drawId); __GLX_SWAP_INT(buffer); + __GLX_SWAP_INT(num_attribs); return __glXDisp_BindTexImageEXT(cl, (GLbyte *)pc); } -- cgit v1.2.3