[PATCH 4/5] dix: GetHosts bounds check using wrong pointer value

[Mark Kettenis]

> From: Keith Packard <keithp at keithp.com>
> Date: Tue,  9 Dec 2014 09:31:00 -0800
> 
> GetHosts saves the pointer to allocated memory in *data, and then
> wants to bounds-check writes to that region, but was mistakenly using
> a bare 'data' instead of '*data'. Also, data is declared as void **,
> so we need a cast to turn it into a byte pointer so we can actually do
> pointer comparisons.

Not sure it is needed for pointer *comparisons*, but it certainly is
necessary to be able to do pointer arithmetic without relying on GCC
extensions.

> Signed-off-by: Keith Packard <keithp at keithp.com>

Reviewed by: Mark Kettenis <kettenis at openbsd.org>

> ---
>  os/access.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/os/access.c b/os/access.c
> index f393c8d..28f2d32 100644
> --- a/os/access.c
> +++ b/os/access.c
> @@ -1308,7 +1308,7 @@ GetHosts(void **data, int *pnHosts, int *pLen, BOOL * pEnabled)
>          }
>          for (host = validhosts; host; host = host->next) {
>              len = host->len;
> -            if ((ptr + sizeof(xHostEntry) + len) > (data + n))
> +            if ((ptr + sizeof(xHostEntry) + len) > ((unsigned char *) *data + n))
>                  break;
>              ((xHostEntry *) ptr)->family = host->family;
>              ((xHostEntry *) ptr)->length = len;
> -- 
> 2.1.3
> 
> _______________________________________________
> xorg-devel at lists.x.org: X.Org development
> Archives: http://lists.x.org/archives/xorg-devel
> Info: http://lists.x.org/mailman/listinfo/xorg-devel
> 
>