diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-13 10:20:59 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:53:29 -0700 |
| commit | b031e3b60fa1af9e49449f23d4a84395868be3ab (patch) | |
| tree | 62d95f77e6d029fa06b9772d2d8d51421b5b5877 /src/Cursor.c | |
| parent | f870dfb47da9d43d1750ea5e5fc9288c4158f7ad (diff) | |
Use _XEatDataWords to avoid overflow of _XEatData calculations
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'src/Cursor.c')
| -rw-r--r-- | src/Cursor.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/Cursor.c b/src/Cursor.c index b3dfed1..641b747 100644 --- a/src/Cursor.c +++ b/src/Cursor.c @@ -113,7 +113,7 @@ XFixesGetCursorImage (Display *dpy) image = (XFixesCursorImage *) Xmalloc (rlength); if (!image) { - _XEatData (dpy, nbytes); + _XEatDataWords(dpy, rep.length); UnlockDisplay (dpy); SyncHandle (); return NULL; @@ -191,7 +191,7 @@ XFixesGetCursorName (Display *dpy, Cursor cursor, Atom *atom) _XReadPad(dpy, name, (long)rep.nbytes); name[rep.nbytes] = '\0'; } else { - _XEatData(dpy, (unsigned long) (rep.nbytes + 3) & ~3); + _XEatDataWords(dpy, rep.length); name = (char *) NULL; } UnlockDisplay(dpy); |