summaryrefslogtreecommitdiff
path: root/src/Xrender.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/Xrender.c')
-rw-r--r--src/Xrender.c25
1 files changed, 16 insertions, 9 deletions
diff --git a/src/Xrender.c b/src/Xrender.c
index a62c753..3102eb2 100644
--- a/src/Xrender.c
+++ b/src/Xrender.c
@@ -844,7 +844,7 @@ XRenderQueryPictIndexValues(Display *dpy,
xRenderQueryPictIndexValuesReq *req;
xRenderQueryPictIndexValuesReply rep;
XIndexValue *values;
- int nbytes, nread, rlength, i;
+ unsigned int nbytes, nread, rlength, i;
RenderCheckExtension (dpy, info, NULL);
@@ -860,15 +860,22 @@ XRenderQueryPictIndexValues(Display *dpy,
return NULL;
}
- /* request data length */
- nbytes = (long)rep.length << 2;
- /* bytes of actual data in the request */
- nread = rep.numIndexValues * SIZEOF (xIndexValue);
- /* size of array returned to application */
- rlength = rep.numIndexValues * sizeof (XIndexValue);
+ if ((rep.length < (INT_MAX >> 2)) &&
+ (rep.numIndexValues < (INT_MAX / sizeof (XIndexValue)))) {
+ /* request data length */
+ nbytes = rep.length << 2;
+ /* bytes of actual data in the request */
+ nread = rep.numIndexValues * SIZEOF (xIndexValue);
+ /* size of array returned to application */
+ rlength = rep.numIndexValues * sizeof (XIndexValue);
+
+ /* allocate returned data */
+ values = Xmalloc (rlength);
+ } else {
+ nbytes = nread = rlength = 0;
+ values = NULL;
+ }
- /* allocate returned data */
- values = (XIndexValue *)Xmalloc (rlength);
if (!values)
{
_XEatDataWords (dpy, rep.length);