On 2015-01-21 15:19, Ian Romanick wrote:
> On 01/20/2015 05:57 PM, Peter Harris wrote:
>> If the server returns a bogus (short) reply to a swapped QueryFont
>> request, RcvRep swaps past the end of its buffer, smashing the heap.
>>
>> Signed-off-by: Peter Harris <phar...@opentext.com>
>
> Given the calculated_length check later in that case, this change looks
> trivially correct.
>
> Reviewed-by: Ian Romanick <ian.d.roman...@intel.com>
Pushed. Thanks for the review.
Peter Harris
--
Open Text Connectivity Solutions Group
Peter Harris http://connectivity.opentext.com/
Research and Development Phone: +1 905 762 6001
phar...@opentext.com Toll Free: 1 877 359 4866
_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
