patch: libXt-1.0.8 fix possible array overflow

walter harms wharms at bfs.de
Wed Sep 22 00:18:21 PDT 2010


hi List,
the code checks the upperlimit to 10 while the upperlimit is actualy 9.

re,
 wh


--- libXt-1.0.8/src/Error.c.org 2010-09-21 23:23:00.000000000 +0200
+++ libXt-1.0.8/src/Error.c     2010-09-21 23:24:03.000000000 +0200
@@ -257,7 +257,7 @@
             */
            Cardinal i = *num_params;
            String par[10];
-           if (i > 10) i = 10;
+           if (i > 9) i = 9;
            (void) memmove((char*)par, (char*)params, i * sizeof(String) );
            bzero( &par[i], (10-i) * sizeof(String) );
            (void) fprintf (stderr, "%s%s",
@@ -292,7 +292,7 @@
         */
        Cardinal i = *num_params;
        String par[10];
-       if (i > 10) i = 10;
+       if (i > 9) i = 9;
        (void) memmove((char*)par, (char*)params, i * sizeof(String) );
        bzero( &par[i], (10-i) * sizeof(String) );
        if (i != *num_params)



More information about the xorg mailing list