summaryrefslogtreecommitdiffstats
path: root/source/x/x11/patch/libX11/libX11.fix_size.diff
blob: ab2a0cf7709c4de9566ccdbca452eaa25bf95cca (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
--- ./modules/im/ximcp/imRmAttr.c.orig	2020-07-31 08:46:40.000000000 -0500
+++ ./modules/im/ximcp/imRmAttr.c	2020-08-02 13:07:15.343940851 -0500
@@ -265,7 +265,7 @@
 
 	    if (num > (USHRT_MAX / sizeof(XIMStyle)))
 		return False;
-	    if ((sizeof(num) + (num * sizeof(XIMStyle))) > data_len)
+           if ((2 * sizeof(CARD16) + (num * sizeof(CARD32))) > data_len)
 		return False;
 	    alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num;
 	    if (alloc_len < sizeof(XIMStyles))
@@ -379,7 +379,7 @@
 
 	    if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger)))
 		return False;
-	    if ((sizeof(num) + (num * sizeof(XIMHotKeyTrigger))) > data_len)
+           if ((2 * sizeof(CARD16) + (num * 3 * sizeof(CARD32))) > data_len)
 		return False;
 	    alloc_len = sizeof(XIMHotKeyTriggers)
 		      + sizeof(XIMHotKeyTrigger) * num;