Lines 831-838
ProcShmPutImage(client)
Link Here
|
831 |
return BadValue; |
831 |
return BadValue; |
832 |
} |
832 |
} |
833 |
|
833 |
|
834 |
VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, |
834 |
/* |
835 |
client); |
835 |
* There's a potential integer overflow in this check: |
|
|
836 |
* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, |
837 |
* client); |
838 |
* the version below ought to avoid it |
839 |
*/ |
840 |
if (stuff->totalHeight != 0 && |
841 |
length > (shmdesc->size - stuff->offset)/stuff->totalHeight) { |
842 |
client->errorValue = stuff->totalWidth; |
843 |
return BadValue; |
844 |
} |
836 |
if (stuff->srcX > stuff->totalWidth) |
845 |
if (stuff->srcX > stuff->totalWidth) |
837 |
{ |
846 |
{ |
838 |
client->errorValue = stuff->srcX; |
847 |
client->errorValue = stuff->srcX; |