diff options
| author | Ran Benita <ran234@gmail.com> | 2014-05-14 11:44:29 +0300 |
|---|---|---|
| committer | Ran Benita <ran234@gmail.com> | 2014-05-14 12:02:13 +0300 |
| commit | e3f751be660e28e48d1477660e99e5456c864296 (patch) | |
| tree | d4d452ec22f68e60cfbb68cc4f6a49668775d77d /NEWS | |
| parent | 86cfef63ca9ae6ad01791e4a6ec73754e4a769d7 (diff) | |
| download | xorg-lib-libxkbcommon-e3f751be660e28e48d1477660e99e5456c864296.tar.gz | |
x11: fix out-of-bounds access in adopt_atoms() error handling
Two problems:
- `j` can be >= `SIZE`, and needs to be wrapped like in the rest of the
code.
- `cookies[j % SIZE]` is not initialized if there's no atom in `from[j]`.
The is manifested when:
- We've already gone through one batch (>= 128 atoms) (in fact this
cannot happen in call to `adopt_atoms` in the current code).
- An XCB request failed in the middle of a batch.
Signed-off-by: Ran Benita <ran234@gmail.com>
Diffstat (limited to 'NEWS')
0 files changed, 0 insertions, 0 deletions