diff options
| author | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2020-08-25 15:42:00 +0000 |
|---|---|---|
| committer | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2020-08-25 15:42:00 +0000 |
| commit | 5bcc972822732978c2a22aef3575e1fdb5b8eda0 (patch) | |
| tree | 28e66e8a339e18c68a33d06db6ce0475ec1681a1 /xserver/Xi | |
| parent | b8901f435fec86beb897405cda33ea49b5cf19d5 (diff) | |
Fix an integer underflow in XIChangeHierarchy()
Reported by Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.
Diffstat (limited to 'xserver/Xi')
| -rw-r--r-- | xserver/Xi/xichangehierarchy.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xserver/Xi/xichangehierarchy.c b/xserver/Xi/xichangehierarchy.c index cbdd91258..504defe56 100644 --- a/xserver/Xi/xichangehierarchy.c +++ b/xserver/Xi/xichangehierarchy.c @@ -423,7 +423,7 @@ ProcXIChangeHierarchy(ClientPtr client) if (!stuff->num_changes) return rc; - len = ((size_t)stuff->length << 2) - sizeof(xXIChangeHierarchyReq); + len = ((size_t)client->req_len << 2) - sizeof(xXIChangeHierarchyReq); any = (xXIAnyHierarchyChangeInfo *) &stuff[1]; while (stuff->num_changes--) { |