On Sun, Mar 27, 2011 at 19:15:18 +0200, Matthieu Herrb wrote: > Signed-off-by: Matthieu Herrb <[email protected]> > --- > Xi/extinit.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/Xi/extinit.c b/Xi/extinit.c > index 46d3459..5d695e3 100644 > --- a/Xi/extinit.c > +++ b/Xi/extinit.c > @@ -429,7 +429,7 @@ static int > SProcIDispatch(ClientPtr client) > { > REQUEST(xReq); > - if (stuff->data > IREQUESTS || !SProcIVector[stuff->data]) > + if (stuff->data > IREQUESTS + XI2REQUESTS || !SProcIVector[stuff->data]) > return BadRequest; > > return (*SProcIVector[stuff->data])(client);
This seems dangerous if you're, say, building an X server that only supports XI 2.0 against the XI 2.1 headers. Should probably be "if (stuff->data >= ARRAY_SIZE(SProcIVector)) ..." (looks like there's no ARRAY_SIZE macro outside of glx, but you get the idea) Cheers, Julien _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
