Skip to content

N
nx-libs
Commit a9f623f0 authored by Julien Cristau's avatar Julien Cristau Committed by Ulrich Sibiller
Browse files
Options

Add a couple fixups for the security patches

Add a couple fixups for the security patches - off-by-one in xkb - memory leak in an error path Backport from debian to NX: Ulrich Sibiller <uli42@gmx.de>
parent 838108c2
Hide whitespace changes
Inline Side-by-side
Showing with 3 additions and 2 deletions
nx-X11/lib/X11/Font.c
View file @ a9f623f0
......@@ -508,6 +508,7 @@ _XF86BigfontQueryFont (
any real font needs, so the combined total doesn't overflow either */
if (reply.nUniqCharInfos > ((ULONG_MAX / 2) / SIZEOF(xCharInfo)) ||
reply.nCharInfos > ((ULONG_MAX / 2) / sizeof(CARD16))) {
Xfree(fs->properties);
Xfree((char *) fs);
_XEatDataWords(dpy, reply_left);
return (XFontStruct *)NULL;
......
nx-X11/lib/X11/XKBGetMap.c
View file @ a9f623f0
......@@ -427,7 +427,7 @@ XkbServerMapPtr srv;
if ( rep->totalVModMapKeys>0 ) {
if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
> xkb->max_key_code)
> xkb->max_key_code + 1)
return BadLength;
if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
(XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
......
nx-X11/lib/X11/XKBNames.c
View file @ a9f623f0
......@@ -180,7 +180,7 @@ _XkbReadGetNamesReply( Display * dpy,
nKeys= xkb->max_key_code+1;
names->keys= _XkbTypedCalloc(nKeys,XkbKeyNameRec);
}
else if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code)
else if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code + 1)
goto BAILOUT;
if (names->keys!=NULL) {
if (!_XkbCopyFromReadBuffer(&buf,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment