Alan Coopersmith c37ceda76b Xephyr: integer overflow in ephyrHostGLXGetStringFromServer() ... reply.length & reply.size are CARD32s and need to be bounds checked before multiplying or adding to come up with the total size to allocate, to avoid integer overflow leading to underallocation and writing data from the network past the end of the allocated buffer. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>		2013-07-17 18:10:40 -07:00
..
ephyr	Xephyr: integer overflow in ephyrHostGLXGetStringFromServer()	2013-07-17 18:10:40 -07:00
fake	Introduce a consistent coding style	2012-03-21 13:54:42 -07:00
fbdev	Xfbdev: Wire up Amiga afb4 and afb8 support	2013-04-18 13:10:26 +02:00
linux	kdrive: fix "set but not used" warnings	2013-03-06 10:19:27 +10:00
src	KDrive: Bail out if screen initialization failed	2013-04-18 13:10:25 +02:00
Makefile.am	Catch errors in recursive relink targets	2010-03-22 00:45:57 -05:00
Xkdrive.man	The great kdrive purge.	2008-05-16 08:16:01 -04:00