diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:29:22 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:44:50 -0700 |
| commit | 1c7ad6773ce6be00dcd6e51e9be08f203abe5071 (patch) | |
| tree | 935094e79765854919a6c48843305d15873dec3f /src/XrrProvider.c | |
| parent | 99a63d10cbbab7d69a52d25d78795a3278506ea9 (diff) | |
Use _XEatDataWords to avoid overflow of rep.length bit shifting
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'src/XrrProvider.c')
| -rw-r--r-- | src/XrrProvider.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/XrrProvider.c b/src/XrrProvider.c index fcd06ff..309e321 100644 --- a/src/XrrProvider.c +++ b/src/XrrProvider.c @@ -67,7 +67,7 @@ XRRGetProviderResources(Display *dpy, Window window) xrpr = (XRRProviderResources *) Xmalloc(rbytes); if (xrpr == NULL) { - _XEatData (dpy, (unsigned long) nbytes); + _XEatDataWords (dpy, rep.length); UnlockDisplay (dpy); SyncHandle (); return NULL; @@ -136,7 +136,7 @@ XRRGetProviderInfo(Display *dpy, XRRScreenResources *resources, RRProvider provi xpi = (XRRProviderInfo *)Xmalloc(rbytes); if (xpi == NULL) { - _XEatData (dpy, (unsigned long) nbytes); + _XEatDataWords (dpy, rep.length - (ProviderInfoExtra >> 2)); UnlockDisplay (dpy); SyncHandle (); return NULL; |