Xi: fix length checks for swapped clients
ChangeDeviceProperty and XIChangeProperty are followed by some data, so use REQUEST_AT_LEAST_SIZE instead of REQUEST_SIZE_MATCH. X.Org bug#35082 <https://bugs.freedesktop.org/show_bug.cgi?id=35082> Reported-by: Markus Fleschutz <markus.fleschutz@x-software.com> Signed-off-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
parent
4114533db6
commit
eb8141b6ed
|
@ -1051,11 +1051,11 @@ SProcXChangeDeviceProperty (ClientPtr client)
|
|||
char n;
|
||||
REQUEST(xChangeDevicePropertyReq);
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xChangeDevicePropertyReq);
|
||||
swaps(&stuff->length, n);
|
||||
swapl(&stuff->property, n);
|
||||
swapl(&stuff->type, n);
|
||||
swapl(&stuff->nUnits, n);
|
||||
REQUEST_SIZE_MATCH(xChangeDevicePropertyReq);
|
||||
return (ProcXChangeDeviceProperty(client));
|
||||
}
|
||||
|
||||
|
@ -1295,12 +1295,12 @@ SProcXIChangeProperty(ClientPtr client)
|
|||
char n;
|
||||
REQUEST(xXIChangePropertyReq);
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xXIChangePropertyReq);
|
||||
swaps(&stuff->length, n);
|
||||
swaps(&stuff->deviceid, n);
|
||||
swapl(&stuff->property, n);
|
||||
swapl(&stuff->type, n);
|
||||
swapl(&stuff->num_items, n);
|
||||
REQUEST_SIZE_MATCH(xXIChangePropertyReq);
|
||||
return (ProcXIChangeProperty(client));
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue
Block a user