| Age | Commit message (Collapse) | Author |
|---|
|
By validating length fields from server responses, out of boundary
accesses and endless loops can be mitigated.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
|
|
Several functions were returning NoSuchExtension casted to a pointer in case of
an error. Often in parallel with returning NULL in case of another error. It is
undocumented and certainly wrong.
Signed-off-by: Michal Srb <msrb@suse.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
|
|
|
|
held.
All callers of _XiCheckExtInit have already called XInput_find_display
first outside the lock, so just pass their copy of the XExtDisplayInfo
structure down. Besides being more correct, this should be slightly
faster. :-)
Thanks to Magnus Kessler <Magnus.Kessler@gmx.net> for identifying
the bug and proposing a workaround.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
