render: Bounds check for nglyphs in ProcRenderAddGlyphs (#28801)
Signed-off-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
parent
fc091936e2
commit
5725849a1b
|
@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client)
|
|||
gi = (xGlyphInfo *) (gids + nglyphs);
|
||||
bits = (CARD8 *) (gi + nglyphs);
|
||||
remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
|
||||
|
||||
/* protect against bad nglyphs */
|
||||
if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
|
||||
bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
|
||||
err = BadLength;
|
||||
goto bail;
|
||||
}
|
||||
|
||||
for (i = 0; i < nglyphs; i++)
|
||||
{
|
||||
size_t padded_width;
|
||||
|
|
Loading…
Reference in New Issue
Block a user