diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 22:48:11 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-05-03 23:07:14 -0700 |
| commit | 73e77eb21d649edc1ce1746739f9358e337b2935 (patch) | |
| tree | de6d657f0e537deecd8a2173bf5e80aee4594272 /src/Xrenderint.h | |
| parent | 1af52cb334377611233d7dc156bc1e6f7923756d (diff) | |
| download | xorg-lib-libXrender-73e77eb21d649edc1ce1746739f9358e337b2935.tar.gz | |
Use _XEatDataWords to avoid overflow of rep.length bit shifting
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'src/Xrenderint.h')
| -rw-r--r-- | src/Xrenderint.h | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/src/Xrenderint.h b/src/Xrenderint.h index 57b13da..daaa6fe 100644 --- a/src/Xrenderint.h +++ b/src/Xrenderint.h @@ -109,4 +109,18 @@ XRenderFindDisplay (Display *dpy); #define DataInt32(dpy,d,len) Data(dpy,(char *) (d),len) #endif +#ifndef HAVE__XEATDATAWORDS +#include <X11/Xmd.h> /* for LONG64 on 64-bit platforms */ +#include <limits.h> + +static inline void _XEatDataWords(Display *dpy, unsigned long n) +{ +# ifndef LONG64 + if (n >= (ULONG_MAX >> 2)) + _XIOError(dpy); +# endif + _XEatData (dpy, n << 2); +} +#endif + #endif /* _XRENDERINT_H_ */ |