[PATCH:libXt 2/3] GetResources: protect against underflow when type conversion fails

walter harms wharms at bfs.de
Sat Feb 5 02:47:35 PST 2011



	    for (i = num_typed_args - typed[j]; i > 0; i--, arg++) {

IMHO this violates the rule of least surprise. the other way around is much more
common. Since i is only a counter i do not see why we need to count down.
(More adventures people may want to use memmove, but i did not see the rest of code)

		    for (i=0; i < num_typed_args - typed[j]; i++) {
 			*arg = *(arg+1);
		        arg++;
  		    }

just my 2 cents,

re,
 wh



Am 05.02.2011 07:29, schrieb Alan Coopersmith:
> Fix originally created by Leo Binchy for Sun to fix Solaris bug 1211553:
>  XtVaCreateManagedWidget with list of resources XtVaTypedArg cause core dump
> 
> Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
> ---
>  src/Resources.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/src/Resources.c b/src/Resources.c
> index 304d3d5..dc0f563 100644
> --- a/src/Resources.c
> +++ b/src/Resources.c
> @@ -857,7 +857,7 @@ static XtCacheRef *GetResources(
>  		    register XtTypedArg* arg = typed_args + typed[j] - 1;
>  		    register int i;
>  
> -		    for (i = num_typed_args - typed[j]; i; i--, arg++) {
> +		    for (i = num_typed_args - typed[j]; i > 0; i--, arg++) {
>  			*arg = *(arg+1);
>  		    }
>  		    num_typed_args--;


More information about the xorg-devel mailing list