Fix memory corruption in ecore_xcb_window.c::ecore_x_window_children_get

Function allocated reply->children_len bytes, and then copied
sizeof(Ecore_X_Window) * reply->childen_len bytes into the buffer, leading
to memory corruption.

git-svn-id: svn+ssh://svn.enlightenment.org/var/svn/e/trunk/ecore@42624 7cbeb6ba-43b4-40fd-8cce-4c39aea84d33

diff --git a/src/lib/ecore_x/xcb/ecore_xcb_window.c b/src/lib/ecore_x/xcb/ecore_xcb_window.c
index a9eabb3..44c27b7 100644 (file)
--- a/src/lib/ecore_x/xcb/ecore_xcb_window.c
+++ b/src/lib/ecore_x/xcb/ecore_xcb_window.c
@@ -1416,7 +1416,7 @@ ecore_x_window_children_get(Ecore_X_Window window __UNUSED__,
    reply = _ecore_xcb_reply_get();
    if (!reply) return NULL;
 
-   windows = malloc(reply->children_len);
+   windows = malloc(sizeof(Ecore_X_Window) * reply->children_len);
    if (!windows)
      return NULL;