Skip to content
Snippets Groups Projects
Commit b4031fc0 authored by Alan Coopersmith's avatar Alan Coopersmith
Browse files

XCreatePixmap: trigger BadValue error for out-of-range dimensions


The CreatePixmap request specifies height & width of the image as CARD16
(unsigned 16-bit integer), so if either is larger than that, set it to 0
so the X server returns a BadValue error as the protocol requires.

Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
parent 73a37d5f
No related branches found
No related tags found
1 merge request!234Security fixes for Oct. 3 advisory
......@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h>
#endif
#include "Xlibint.h"
#include <limits.h>
#ifdef USE_DYNAMIC_XCURSOR
void
......@@ -47,6 +48,16 @@ Pixmap XCreatePixmap (
Pixmap pid;
register xCreatePixmapReq *req;
/*
* Force a BadValue X Error if the requested dimensions are larger
* than the X11 protocol has room for, since that's how callers expect
* to get notified of errors.
*/
if (width > USHRT_MAX)
width = 0;
if (height > USHRT_MAX)
height = 0;
LockDisplay(dpy);
GetReq(CreatePixmap, req);
req->drawable = d;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment