xfixes: unvalidated length in SProcXFixesSelectSelectionInput [CVE-2014-8102]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> v2: backport to nx-libs 3.6.x (Mike DePaulo) Conflicts: xfixes/select.c

xfixes: unvalidated length in SProcXFixesSelectSelectionInput [CVE-2014-8102]
c12a473f · Alan Coopersmith · Mike Gabriel · 9c3842a4 · c12a473f
Commit c12a473f authored Jan 26, 2014 by Alan Coopersmith Committed by Mike Gabriel Feb 14, 2015
Show whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

select.c nx-X11/programs/Xserver/xfixes/select.c +1 -0

No files found.
--- a/nx-X11/programs/Xserver/xfixes/select.c
+++ b/nx-X11/programs/Xserver/xfixes/select.c
@@ -216,6 +216,7 @@ SProcXFixesSelectSelectionInput (ClientPtr client)
    register int n;
    REQUEST(xXFixesSelectSelectionInputReq);

+    REQUEST_SIZE_MATCH(xXFixesSelectSelectionInputReq);
    swaps(&stuff->length, n);
    swapl(&stuff->window, n);
    swapl(&stuff->selection, n);