diff options
| author | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2017-10-14 09:32:31 +0000 |
|---|---|---|
| committer | Matthieu Herrb <matthieu@cvs.openbsd.org> | 2017-10-14 09:32:31 +0000 |
| commit | 897ba3580e237cbae9c5e43232f81cf658c22dda (patch) | |
| tree | 5e63a27ea72a04b7b269c1ffa14753a5806b22af /xserver/Xi | |
| parent | ddf3a6111cf80dba42a798331e0e6b5fdf19c6e2 (diff) | |
MFC: Xi: fix wrong extra length check in ProcXIChangeHierarchy
(CVE-2017-12178)
Diffstat (limited to 'xserver/Xi')
| -rw-r--r-- | xserver/Xi/xichangehierarchy.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xserver/Xi/xichangehierarchy.c b/xserver/Xi/xichangehierarchy.c index 8d5b577b6..0f96c9164 100644 --- a/xserver/Xi/xichangehierarchy.c +++ b/xserver/Xi/xichangehierarchy.c @@ -421,7 +421,7 @@ ProcXIChangeHierarchy(ClientPtr client) if (!stuff->num_changes) return rc; - len = ((size_t)stuff->length << 2) - sizeof(xXIAnyHierarchyChangeInfo); + len = ((size_t)stuff->length << 2) - sizeof(xXIChangeHierarchyReq); any = (xXIAnyHierarchyChangeInfo *) &stuff[1]; while (stuff->num_changes--) { |