[PATCH libXaw 1/1] fix potential infinte loop in XawBoxQueryGeometry()

[Ademar de Souza Reis Jr]

The problem is due to a short integer overflow when
request_mode == CWHeight.

Patch from Glenn Burkhardt <gbburkhardt at verizon.net>

---
 src/Box.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/Box.c b/src/Box.c
index f4f2939..f7b2069 100644
--- a/src/Box.c
+++ b/src/Box.c
@@ -395,9 +395,10 @@ XawBoxQueryGeometry(Widget widget, XtWidgetGeometry *constraint,
 	if (preferred_width <= constraint->width) {
 	    width = preferred_width;
 	    do { /* find some width big enough to stay within this height */
-		width <<= 1;
-		if (width > constraint->width)
+		if (width > constraint->width >> 1) /* avoid short int overflow */
 		    width = constraint->width;
+		else
+		    width <<= 1;
 		DoLayout(w, width, 0, &preferred_width, &preferred_height, False);
 	    } while (preferred_height > constraint->height
 		     && width < constraint->width);
-- 
1.5.2.2