diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:29:22 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:44:50 -0700 |
| commit | 1c7ad6773ce6be00dcd6e51e9be08f203abe5071 (patch) | |
| tree | 935094e79765854919a6c48843305d15873dec3f /src/XrrCrtc.c | |
| parent | 99a63d10cbbab7d69a52d25d78795a3278506ea9 (diff) | |
| download | xorg-lib-libXrandr-1c7ad6773ce6be00dcd6e51e9be08f203abe5071.tar.gz | |
Use _XEatDataWords to avoid overflow of rep.length bit shifting
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'src/XrrCrtc.c')
| -rw-r--r-- | src/XrrCrtc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/XrrCrtc.c b/src/XrrCrtc.c index 04087c5..a704a52 100644 --- a/src/XrrCrtc.c +++ b/src/XrrCrtc.c @@ -74,7 +74,7 @@ XRRGetCrtcInfo (Display *dpy, XRRScreenResources *resources, RRCrtc crtc) xci = (XRRCrtcInfo *) Xmalloc(rbytes); if (xci == NULL) { - _XEatData (dpy, (unsigned long) nbytes); + _XEatDataWords (dpy, rep.length); UnlockDisplay (dpy); SyncHandle (); return NULL; @@ -203,7 +203,7 @@ XRRGetCrtcGamma (Display *dpy, RRCrtc crtc) if (!crtc_gamma) { - _XEatData (dpy, (unsigned long) nbytes); + _XEatDataWords (dpy, rep.length); goto out; } _XRead16 (dpy, crtc_gamma->red, rep.size * 2); @@ -397,7 +397,7 @@ XRRGetCrtcTransform (Display *dpy, int extraBytes = rep.length * 4 - CrtcTransformExtra; extra = Xmalloc (extraBytes); if (!extra) { - _XEatData (dpy, extraBytes); + _XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 2)); UnlockDisplay (dpy); SyncHandle (); return False; |