patch: libXt-1.0.8 fix possible array overflow
Jeremy Huddleston
jeremyhu at apple.com
Thu Sep 23 11:42:56 PDT 2010
On Sep 23, 2010, at 11:37, walter harms wrote:
>
>
> Pat Kane schrieb:
>> In the original code if 'i' is equal to 10 then the line
>> (void) memmove((char*)par, (char*)params, i * sizeof(String) );
>> moves ten things, which is okay.
>>
>> The next line:
>> bzero( &par[i], (10-i) * sizeof(String) );
>> moves zero things to a bad address, which is probably okay,
>> but I bet some code checker would complain.
>>
>> The code is very ugly.
>>
>
> yes,
> i can fix that too but i still feel that
> i=10
> bzero( &par[i], (10-i) * sizeof(String) );
>
> setting the limit to i=9 would fix that.
That would break the memmove.
bzero(..., 0) is a no-op.
I fail to see the need to change this.
More information about the xorg-devel
mailing list