mirror of
https://github.com/X11Libre/xserver.git
synced 2026-11-15 05:23:40 +00:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
6a97f6d38e
convolutionFilterValidateParams() derives w/h from client-supplied xFixed values via the sign-extending xFixedToInt(), then checked 'w * h > nparams' as a plain (signed) int product. A client can choose negative w/h so the mathematical product is huge but the signed int product wraps to a small or negative value, defeating the bounds check that is supposed to reject a convolution kernel larger than the actual parameter list. Reject negative w/h outright and compare the product as int64_t so it cannot wrap before the comparison. Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@vnc.biz> |
||
| .. | ||
| animcur.c | ||
| filter.c | ||
| glyph.c | ||
| glyphstr_priv.h | ||
| matrix.c | ||
| meson.build | ||
| miindex.c | ||
| mipict.c | ||
| mirect.c | ||
| mitrap.c | ||
| mitri.c | ||
| picture.c | ||
| picturestr_priv.h | ||
| render.c | ||