forked from pool/xorg-x11-server
19 lines
578 B
Diff
19 lines
578 B
Diff
|
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
|
||
|
|
index 2979c64..04f1f1b 100644
|
||
|
|
--- a/dix/dixfonts.c
|
||
|
|
+++ b/dix/dixfonts.c
|
||
|
|
@@ -326,6 +326,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
|
||
|
|
err = BadFontName;
|
||
|
|
goto bail;
|
||
|
|
}
|
||
|
|
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
|
||
|
|
+ if (pfont->info.firstCol > pfont->info.lastCol ||
|
||
|
|
+ pfont->info.firstRow > pfont->info.lastRow ||
|
||
|
|
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
|
||
|
|
+ err = AllocError;
|
||
|
|
+ goto bail;
|
||
|
|
+ }
|
||
|
|
if (!pfont->fpe)
|
||
|
|
pfont->fpe = fpe;
|
||
|
|
pfont->refcnt++;
|