From 42ae2e8199fe875319978249963de7499607988b Mon Sep 17 00:00:00 2001 From: Siddhesh Poyarekar Date: Tue, 29 May 2012 10:17:50 +0530 Subject: [PATCH] xkb: Allocate size_syms correctly when width of a type increases The current code seems to skip syms with width less than type->num_levels when calculating the total size for the new size_syms. This leads to less space being allocated than necessary during the next phase, which is to copy over the syms to the new location. This results in an overflow leading to a crash. Signed-off-by: Siddhesh Poyarekar Signed-off-by: Peter Hutterer --- xkb/XKBMAlloc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/xkb/XKBMAlloc.c b/xkb/XKBMAlloc.c index 645e90544..3ffd5dad1 100644 --- a/xkb/XKBMAlloc.c +++ b/xkb/XKBMAlloc.c @@ -375,8 +375,10 @@ XkbResizeKeyType(XkbDescPtr xkb, nResize = 0; for (nTotal = 1, i = xkb->min_key_code; i <= xkb->max_key_code; i++) { width = XkbKeyGroupsWidth(xkb, i); - if (width < type->num_levels) + if (width < type->num_levels || width >= new_num_lvls) { + nTotal += XkbKeyNumSyms(xkb,i); continue; + } for (match = 0, g = XkbKeyNumGroups(xkb, i) - 1; (g >= 0) && (!match); g--) { if (XkbKeyKeyTypeIndex(xkb, i, g) == type_ndx) { @@ -384,7 +386,7 @@ XkbResizeKeyType(XkbDescPtr xkb, match = 1; } } - if ((!match) || (width >= new_num_lvls)) + if (!match) nTotal += XkbKeyNumSyms(xkb, i); else { nTotal += XkbKeyNumGroups(xkb, i) * new_num_lvls;