patch: libXt-1.0.8 fix possible array overflow

walter harms wharms at bfs.de
Thu Sep 23 11:37:37 PDT 2010



Pat Kane schrieb:
> In the original code if 'i' is equal to 10 then the line
>    (void) memmove((char*)par, (char*)params, i * sizeof(String) );
> moves ten things, which is okay.
> 
> The next line:
>    bzero( &par[i], (10-i) * sizeof(String) );
> moves zero things to a bad address, which is probably okay,
> but I bet some code checker would complain.
> 
> The code is very ugly.
> 

yes,
i can fix that too but i still feel that
i=10
bzero( &par[i], (10-i) * sizeof(String) );

setting the limit to i=9 would fix that.

most maintainers prefer 1 fix 1 patch, i can send a revisited patch

re,
 wh


More information about the xorg-devel mailing list