|
Lines 265-271
_XimAttributeToValue(
Link Here
|
| 265 |
|
265 |
|
| 266 |
if (num > (USHRT_MAX / sizeof(XIMStyle))) |
266 |
if (num > (USHRT_MAX / sizeof(XIMStyle))) |
| 267 |
return False; |
267 |
return False; |
| 268 |
if ((sizeof(num) + (num * sizeof(XIMStyle))) > data_len) |
268 |
if ((2 * sizeof(CARD16) + (num * sizeof(CARD32))) > data_len) |
| 269 |
return False; |
269 |
return False; |
| 270 |
alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num; |
270 |
alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num; |
| 271 |
if (alloc_len < sizeof(XIMStyles)) |
271 |
if (alloc_len < sizeof(XIMStyles)) |
|
Lines 379-385
_XimAttributeToValue(
Link Here
|
| 379 |
|
379 |
|
| 380 |
if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger))) |
380 |
if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger))) |
| 381 |
return False; |
381 |
return False; |
| 382 |
if ((sizeof(num) + (num * sizeof(XIMHotKeyTrigger))) > data_len) |
382 |
if ((2 * sizeof(CARD16) + (num * 3 * sizeof(CARD32))) > data_len) |
| 383 |
return False; |
383 |
return False; |
| 384 |
alloc_len = sizeof(XIMHotKeyTriggers) |
384 |
alloc_len = sizeof(XIMHotKeyTriggers) |
| 385 |
+ sizeof(XIMHotKeyTrigger) * num; |
385 |
+ sizeof(XIMHotKeyTrigger) * num; |
