hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-09-18 19:52:21 +00:00
Code Issues Projects Releases Wiki Activity

Use calloc to zero fill buffers being allocated for replies & events

Browse source 
Ensures padding bytes are zero-filled

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Daniel Stone <daniel@fooishbar.org>
This commit is contained in:
Alan Coopersmith 2012-07-09 19:12:42 -07:00
commit cdf5bcd420
9 changed files with 15 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

7
xfixes/cursor.c
View file

@ -380,7 +380,8 @@ ProcXFixesGetCursorImage(ClientPtr client)
width = pCursor->bits->width;
height = pCursor->bits->height;
npixels = width * height;
rep = malloc(sizeof(xXFixesGetCursorImageReply) + npixels * sizeof(CARD32));
rep = calloc(sizeof(xXFixesGetCursorImageReply) + npixels * sizeof(CARD32),
1);
if (!rep)
return BadAlloc;
@ -529,8 +530,8 @@ ProcXFixesGetCursorImageAndName(ClientPtr client)
name = pCursor->name ? NameForAtom(pCursor->name) : "";
nbytes = strlen(name);
nbytesRound = pad_to_int32(nbytes);
rep = malloc(sizeof(xXFixesGetCursorImageAndNameReply) +
npixels * sizeof(CARD32) + nbytesRound);
rep = calloc(sizeof(xXFixesGetCursorImageAndNameReply) +
npixels * sizeof(CARD32) + nbytesRound, 1);
if (!rep)
return BadAlloc;

3
xfixes/region.c
View file

@ -557,7 +557,8 @@ ProcXFixesFetchRegion(ClientPtr client)
pBox = RegionRects(pRegion);
nBox = RegionNumRects(pRegion);
reply = malloc(sizeof(xXFixesFetchRegionReply) + nBox * sizeof(xRectangle));
reply = calloc(sizeof(xXFixesFetchRegionReply) + nBox * sizeof(xRectangle),
1);
if (!reply)
return BadAlloc;
reply->type = X_Reply;