diff options
| author | Adam Jackson <ajax@nwnk.net> | 2005-04-03 18:24:25 +0000 |
|---|---|---|
| committer | Adam Jackson <ajax@nwnk.net> | 2005-04-03 18:24:25 +0000 |
| commit | 5004ef0b757c1cd7e4ceaa1759914f938d5ea295 (patch) | |
| tree | cea6af05e813d05a97d2db37f1388c36ec35c7ea | |
| parent | c9f8774f04b398ac963b23ce1d5a12e703977064 (diff) | |
Bug #1447: Fix a use-after-free case in libSM. (Mark McLoughlin)sco_port_update-baseXORG-6_8_99_7XORG-6_8_99_6XORG-6_8_99_5XORG-6_8_99_4XORG-6_8_99_3XORG-6_8_99_2
| -rw-r--r-- | src/sm_process.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/src/sm_process.c b/src/sm_process.c index 8f913f0..c770236 100644 --- a/src/sm_process.c +++ b/src/sm_process.c @@ -481,6 +481,7 @@ Bool swap; smRegisterClientMsg *pMsg; char *pData, *pStart; char *previousId; + int idLen; #if 0 /* No-op */ CHECK_AT_LEAST_SIZE (iceConn, _SmsOpcode, opcode, @@ -506,7 +507,7 @@ Bool swap; pData = pStart; - EXTRACT_ARRAY8_AS_STRING (pData, swap, previousId); + EXTRACT_ARRAY8 (pData, swap, idLen, previousId); if (*previousId == '\0') { @@ -521,11 +522,8 @@ Bool swap; * The previoudId was bad. Generate BadValue error. */ - int length = previousId ? strlen (previousId) : 0; - int bytes = ARRAY8_BYTES (length); - _IceErrorBadValue (smsConn->iceConn, _SmsOpcode, SM_RegisterClient, - 8, bytes, (IcePointer) pStart); + 8, ARRAY8_BYTES (idLen), (IcePointer) pStart); } IceDisposeCompleteMessage (iceConn, pStart); |