diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2019-03-09 16:20:48 -0800 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2019-03-09 16:20:48 -0800 |
| commit | c01d47c4c0e0a66e0989d40f73827d0a55f693cc (patch) | |
| tree | 2e023074a45e39e63c60ea277efab340bf143f52 | |
| parent | c9d6b0fa101238063b36182f170f4e1b0a233e15 (diff) | |
| download | xorg-lib-libXaw-c01d47c4c0e0a66e0989d40f73827d0a55f693cc.tar.gz | |
Pass correct number of atoms from SelectSave to _XawTextSaltAwaySelection
When filling in the array, we correctly limited to the 256 slots allocated
but then we reset the value to an unlimited number when passing it on to
the function that walks the array, which could lead to it walking too far.
Fixes https://gitlab.freedesktop.org/xorg/lib/libxaw/issues/2
Reported-by: Praveen Kumar <praveen.pk@samsung.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
| -rw-r--r-- | src/TextAction.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/src/TextAction.c b/src/TextAction.c index 1602098..10ac931 100644 --- a/src/TextAction.c +++ b/src/TextAction.c @@ -2778,7 +2778,7 @@ ExtendEnd(Widget w, XEvent *event, String *params, Cardinal *num_params) static void SelectSave(Widget w, XEvent *event, String *params, Cardinal *num_params) { - int num_atoms; + int num_atoms, n; Atom *sel; Display *dpy = XtDisplay(w); Atom selections[256]; @@ -2787,9 +2787,8 @@ SelectSave(Widget w, XEvent *event, String *params, Cardinal *num_params) num_atoms = *num_params; if (num_atoms > 256) num_atoms = 256; - for (sel=selections; --num_atoms >= 0; sel++, params++) + for (sel = selections, n = 0; n < num_atoms; n++, sel++, params++) *sel = XInternAtom(dpy, *params, False); - num_atoms = *num_params; _XawTextSaltAwaySelection((TextWidget)w, selections, num_atoms); EndAction((TextWidget)w); } |