From: dottedmag <dottedmag@7cbeb6ba-43b4-40fd-8cce-4c39aea84d33>
Date: Tue, 22 Sep 2009 18:18:28 +0000 (+0000)
Subject: Fix memory corruption in ecore_xcb_window.c::ecore_x_window_children_get
X-Git-Tag: accepted/2.0/20130306.224007~195^2~1368
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=061695812b7fec6732427e7705b7b1b9e6cdc35f;p=profile%2Fivi%2Fecore.git

Fix memory corruption in ecore_xcb_window.c::ecore_x_window_children_get

Function allocated reply->children_len bytes, and then copied
sizeof(Ecore_X_Window) * reply->childen_len bytes into the buffer, leading
to memory corruption.

git-svn-id: svn+ssh://svn.enlightenment.org/var/svn/e/trunk/ecore@42624 7cbeb6ba-43b4-40fd-8cce-4c39aea84d33
---

diff --git a/src/lib/ecore_x/xcb/ecore_xcb_window.c b/src/lib/ecore_x/xcb/ecore_xcb_window.c
index a9eabb3..44c27b7 100644
--- a/src/lib/ecore_x/xcb/ecore_xcb_window.c
+++ b/src/lib/ecore_x/xcb/ecore_xcb_window.c
@@ -1416,7 +1416,7 @@ ecore_x_window_children_get(Ecore_X_Window window __UNUSED__,
    reply = _ecore_xcb_reply_get();
    if (!reply) return NULL;
 
-   windows = malloc(reply->children_len);
+   windows = malloc(sizeof(Ecore_X_Window) * reply->children_len);
    if (!windows)
      return NULL;