[PATCH 29/32] [libx11] a negative value was passed to memcpy

Erkki Seppälä erkki.seppala at vincit.fi
Wed Jan 26 23:54:12 PST 2011


Fixed by checking for the negative return value of _Xlcwctomb and
returning 0/XLookupNone in that case.

Unfortunately the other return values for *status don't fit into the
error (which appears to indicate some internal error or running out of
memory). The other valid status codes are XBufferOverflow,
XLookupNone, XLookupChars, XLookupKeySym, and XLookupBoth. Each of
these has a specific meaning attached.

Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala at vincit.fi>
---
 modules/im/ximcp/imLcLkup.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/modules/im/ximcp/imLcLkup.c b/modules/im/ximcp/imLcLkup.c
index 80e4cfe..4891176 100644
--- a/modules/im/ximcp/imLcLkup.c
+++ b/modules/im/ximcp/imLcLkup.c
@@ -63,6 +63,10 @@ _XimLocalMbLookupString(XIC xic, XKeyEvent *ev, char *buffer, int bytes,
 	    unsigned char pattern = ic->private.local.brl_committed;
 	    char mb[XLC_PUBLIC(ic->core.im->core.lcd, mb_cur_max)];
 	    ret = _Xlcwctomb(ic->core.im->core.lcd, mb, BRL_UC_ROW | pattern);
+	    if(ret < 0) {
+		if(status) *status = XLookupNone;
+		return(0);
+	    }
 	    if(ret > bytes) {
 		if(status) *status = XBufferOverflow;
 		return(ret);
-- 
1.7.0.4



More information about the xorg-devel mailing list