Skip to content

N
nx-libs
Commit 3cd82252 authored by Alan Coopersmith's avatar Alan Coopersmith Committed by Ulrich Sibiller
Browse files
Options

Fix overflow checks in _XkbReadKeySyms when key_sym_map is already created

We were checking to make sure that the largest keysym value was within the range of the allocated buffer, but checking against different limits in the not-yet-allocated vs. the already-allocated branches. The check should be the same in both, and reflect the size used for the allocation, which is based on the maximum key code value, so we move it to be a common check, before we branch, instead of duplicating in each branch. map->key_sym_map is an array of XkbSymMapRec structs, [0..max_key_code] map->syms is the array for which num_syms is recorded, hence is not the right value to check for ensuring our key_sym_map accesses are in range. Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Reported-by: 's avatarBarry Kauler <bkauler@gmail.com> Tested-by: 's avatarBarry Kauler <bkauler@gmail.com> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent c22524d3
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 5 deletions
nx-X11/lib/X11/XKBGetMap.c
View file @ 3cd82252
......@@ -147,15 +147,16 @@ _XkbReadKeySyms(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep)
{
register int i;
XkbClientMapPtr map;
int size = xkb->max_key_code + 1;
if (((unsigned short)rep->firstKeySym + rep->nKeySyms) > size)
return BadLength;
map= xkb->map;
if (map->key_sym_map==NULL) {
register int offset;
int size = xkb->max_key_code + 1;
XkbSymMapPtr oldMap;
xkbSymMapWireDesc *newMap;
if (((unsigned short)rep->firstKeySym + rep->nKeySyms) > size)
return BadLength;
map->key_sym_map= _XkbTypedCalloc(size,XkbSymMapRec);
if (map->key_sym_map==NULL)
return BadAlloc;
......@@ -212,8 +213,6 @@ XkbClientMapPtr map;
KeySym * newSyms;
int tmp;
if (((unsigned short)rep->firstKeySym + rep->nKeySyms) > map->num_syms)
return BadLength;
oldMap = &map->key_sym_map[rep->firstKeySym];
for (i=0;i<(int)rep->nKeySyms;i++,oldMap++) {
newMap= (xkbSymMapWireDesc *)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment