diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:29:22 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:44:50 -0700 |
| commit | 1c7ad6773ce6be00dcd6e51e9be08f203abe5071 (patch) | |
| tree | 935094e79765854919a6c48843305d15873dec3f /src/XrrProviderProperty.c | |
| parent | 99a63d10cbbab7d69a52d25d78795a3278506ea9 (diff) | |
Use _XEatDataWords to avoid overflow of rep.length bit shifting
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'src/XrrProviderProperty.c')
| -rw-r--r-- | src/XrrProviderProperty.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/src/XrrProviderProperty.c b/src/XrrProviderProperty.c index c8c08e9..2d90a0a 100644 --- a/src/XrrProviderProperty.c +++ b/src/XrrProviderProperty.c @@ -62,7 +62,7 @@ XRRListProviderProperties (Display *dpy, RRProvider provider, int *nprop) props = (Atom *) Xmalloc (rbytes); if (props == NULL) { - _XEatData (dpy, nbytes); + _XEatDataWords (dpy, rep.length); UnlockDisplay (dpy); SyncHandle (); *nprop = 0; @@ -107,7 +107,7 @@ XRRQueryProviderProperty (Display *dpy, RRProvider provider, Atom property) prop_info = (XRRPropertyInfo *) Xmalloc (rbytes); if (prop_info == NULL) { - _XEatData (dpy, nbytes); + _XEatDataWords (dpy, rep.length); UnlockDisplay (dpy); SyncHandle (); return NULL; @@ -313,14 +313,13 @@ XRRGetProviderProperty (Display *dpy, RRProvider provider, * This part of the code should never be reached. If it is, * the server sent back a property with an invalid format. */ - nbytes = rep.length << 2; - _XEatData(dpy, (unsigned long) nbytes); + _XEatDataWords(dpy, rep.length); UnlockDisplay(dpy); SyncHandle(); return(BadImplementation); } if (! *prop) { - _XEatData(dpy, (unsigned long) nbytes); + _XEatDataWords(dpy, rep.length); UnlockDisplay(dpy); SyncHandle(); return(BadAlloc); |