diff options
| -rw-r--r-- | src/XvMC.c | 36 |
1 files changed, 19 insertions, 17 deletions
@@ -499,7 +499,6 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, XExtDisplayInfo *info = xvmc_find_display(dpy); xvmcGetDRInfoReply rep; xvmcGetDRInfoReq *req; - char *tmpBuf = NULL; CARD32 magic; #ifdef HAVE_SHMAT @@ -510,6 +509,9 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, here.tz_dsttime = 0; #endif + *name = NULL; + *busID = NULL; + XvMCCheckExtension (dpy, info, BadImplementation); LockDisplay (dpy); @@ -568,31 +570,31 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, #endif if (rep.length > 0) { - - int realSize = rep.length << 2; - - tmpBuf = (char *) Xmalloc(realSize); - if (tmpBuf) { - *name = (char *) Xmalloc(rep.nameLen); - if (*name) { - *busID = (char *) Xmalloc(rep.busIDLen); - if (! *busID) { - XFree(*name); - XFree(tmpBuf); - } - } else { - XFree(tmpBuf); + unsigned long realSize = 0; + char *tmpBuf = NULL; + + if (rep.length < (INT_MAX >> 2)) { + realSize = rep.length << 2; + if (realSize >= (rep.nameLen + rep.busIDLen)) { + tmpBuf = Xmalloc(realSize); + *name = Xmalloc(rep.nameLen); + *busID = Xmalloc(rep.busIDLen); } } if (*name && *busID && tmpBuf) { - _XRead(dpy, tmpBuf, realSize); strncpy(*name,tmpBuf,rep.nameLen); + name[rep.nameLen - 1] = '\0'; strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen); + busID[rep.busIDLen - 1] = '\0'; XFree(tmpBuf); - } else { + XFree(*name); + *name = NULL; + XFree(*busID); + *name = NULL; + XFree(tmpBuf); _XEatDataWords(dpy, rep.length); UnlockDisplay (dpy); |