diff options
| author | Uli Schlachter <psychon@znc.in> | 2011-03-11 11:35:07 +0100 |
|---|---|---|
| committer | Arnaud Fontaine <arnau@debian.org> | 2011-03-26 13:52:45 +0900 |
| commit | 4e5a8e47389ac54b1bae9e694d5a812388a0a380 (patch) | |
| tree | 5bc5f40098261a21f94e2f4e4aa513b1f6c0ef10 | |
| parent | 91988b08395dad5a221204e83324cb72d898334d (diff) | |
| download | util-wm-4e5a8e47389ac54b1bae9e694d5a812388a0a380.tar.gz | |
_NET_WM_ICON: Fix the length check
expected_len is the expected length in number-of-pixels, but r_value_len is the
number of bytes in the reply. Since a pixel consists of 4 bytes, we have to
divide the number of bytes by 4 to get the number of pixels.
Signed-off-by: Uli Schlachter <psychon@znc.in>
Reviewed-by: Arnaud Fontaine <arnau@debian.org>
| -rw-r--r-- | ewmh/ewmh.c.m4 | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ewmh/ewmh.c.m4 b/ewmh/ewmh.c.m4 index 23df1b0..176ba19 100644 --- a/ewmh/ewmh.c.m4 +++ b/ewmh/ewmh.c.m4 @@ -1154,9 +1154,9 @@ xcb_ewmh_get_wm_icon_from_reply(xcb_ewmh_get_wm_icon_reply_t *wm_icon, return 0; /* Check that the property is as long as it should be, handling - integer overflow */ + integer overflow. "-2" to handle the width and height fields. */ const uint64_t expected_len = r_value[0] * (uint64_t) r_value[1]; - if(!r_value[0] || !r_value[1] || expected_len > r_value_len - 2) + if(!r_value[0] || !r_value[1] || expected_len > r_value_len / 4 - 2) return 0; wm_icon->_reply = r; |