[PATCH v2 23/25] [libx11] Fixed by negative value to memcpy by checking for the negative return value of _Xlcwctomb and returning 0/XLookupNone in that case.

[Alan Coopersmith]

On 01/31/11 04:02 AM, Erkki Seppälä wrote:
> a negative value was passed to memcpy
> 
> Unfortunately the other return values for *status don't fit into the
> error (which appears to indicate some internal error or running out of
> memory). The other valid status codes are XBufferOverflow,
> XLookupNone, XLookupChars, XLookupKeySym, and XLookupBoth. Each of
> these has a specific meaning attached.
> 
> Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira at nokia.com>
> Signed-off-by: Erkki Seppälä <erkki.seppala at vincit.fi>
> ---
>  modules/im/ximcp/imLcLkup.c |    4 ++++
>  1 files changed, 4 insertions(+), 0 deletions(-)
> 
> diff --git a/modules/im/ximcp/imLcLkup.c b/modules/im/ximcp/imLcLkup.c
> index 80e4cfe..4891176 100644
> --- a/modules/im/ximcp/imLcLkup.c
> +++ b/modules/im/ximcp/imLcLkup.c
> @@ -63,6 +63,10 @@ _XimLocalMbLookupString(XIC xic, XKeyEvent *ev, char *buffer, int bytes,
>  	    unsigned char pattern = ic->private.local.brl_committed;
>  	    char mb[XLC_PUBLIC(ic->core.im->core.lcd, mb_cur_max)];
>  	    ret = _Xlcwctomb(ic->core.im->core.lcd, mb, BRL_UC_ROW | pattern);
> +	    if(ret < 0) {
> +		if(status) *status = XLookupNone;
> +		return(0);
> +	    }
>  	    if(ret > bytes) {
>  		if(status) *status = XBufferOverflow;
>  		return(ret);

Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>

-- 
	-Alan Coopersmith-        alan.coopersmith at oracle.com
	 Oracle Solaris Platform Engineering: X Window System