On 2015-01-21 15:19, Ian Romanick wrote:
> On 01/20/2015 05:57 PM, Peter Harris wrote:
>> If the server returns a bogus (short) reply to a swapped QueryFont
>> request, RcvRep swaps past the end of its buffer, smashing the heap.
>>
>> Signed-off-by: Peter Harris <[email protected]>
>
> Given the calculated_length check later in that case, this change looks
> trivially correct.
>
> Reviewed-by: Ian Romanick <[email protected]>
Pushed. Thanks for the review.
Peter Harris
--
Open Text Connectivity Solutions Group
Peter Harris http://connectivity.opentext.com/
Research and Development Phone: +1 905 762 6001
[email protected] Toll Free: 1 877 359 4866
_______________________________________________
[email protected]: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
