From 0ef73fcc9565a083be2f8ad401b686fdaf122635 Mon Sep 17 00:00:00 2001 From: Adam Jackson Date: Mon, 28 Jun 2010 18:08:50 -0400 Subject: [PATCH] render: Bounds check for nglyphs in ProcRenderAddGlyphs (#28801) Signed-off-by: Adam Jackson --- render/render.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/render/render.c b/render/render.c index ef233e4..00241f9 100644 --- a/render/render.c +++ b/render/render.c @@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client) gi = (xGlyphInfo *) (gids + nglyphs); bits = (CARD8 *) (gi + nglyphs); remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs; + + /* protect against bad nglyphs */ + if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) || + bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) { + err = BadLength; + goto bail; + } + for (i = 0; i < nglyphs; i++) { size_t padded_width; -- 1.7.0.1