shm: Check width, height and stride for invalid values

diff --git a/compositor/shm.c b/compositor/shm.c
index 913833e..389eeaa 100644 (file)
--- a/compositor/shm.c
+++ b/compositor/shm.c
@@ -97,9 +97,9 @@ shm_create_buffer(struct wl_client *client, struct wl_shm *shm,
                             struct wlsc_compositor, shm);
        struct wlsc_shm_buffer *buffer;
 
+       /* FIXME: Define a real exception event instead of abusing the
+        * display.invalid_object error */
        if (visual->object.interface != &wl_visual_interface) {
-               /* FIXME: Define a real exception event instead of
-                * abusing this one */
                wl_client_post_event(client,
                                     (struct wl_object *) compositor->wl_display,
                                     WL_DISPLAY_INVALID_OBJECT, 0);
@@ -108,6 +108,16 @@ shm_create_buffer(struct wl_client *client, struct wl_shm *shm,
                return;
        }
 
+       if (width < 0 || height < 0 || stride < width) {
+               wl_client_post_event(client,
+                                    (struct wl_object *) compositor->wl_display,
+                                    WL_DISPLAY_INVALID_OBJECT, 0);
+               fprintf(stderr,
+                       "invalid width, height or stride in create_buffer\n");
+               close(fd);
+               return;
+       }
+
        buffer = malloc(sizeof *buffer);
        if (buffer == NULL) {
                close(fd);