From: Kristian Høgsberg <krh@bitplanet.net>
Date: Wed, 26 Jan 2011 16:46:05 +0000 (-0500)
Subject: shm: Check width, height and stride for invalid values
X-Git-Tag: 0.85.0~620
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f9edadf3f2b1ddb138a7ad47a2a80d47ba6605de;p=platform%2Fupstream%2Fweston.git

shm: Check width, height and stride for invalid values
---

diff --git a/compositor/shm.c b/compositor/shm.c
index 913833e..389eeaa 100644
--- a/compositor/shm.c
+++ b/compositor/shm.c
@@ -97,9 +97,9 @@ shm_create_buffer(struct wl_client *client, struct wl_shm *shm,
 			     struct wlsc_compositor, shm);
 	struct wlsc_shm_buffer *buffer;
 
+	/* FIXME: Define a real exception event instead of abusing the
+	 * display.invalid_object error */
 	if (visual->object.interface != &wl_visual_interface) {
-		/* FIXME: Define a real exception event instead of
-		 * abusing this one */
 		wl_client_post_event(client,
 				     (struct wl_object *) compositor->wl_display,
 				     WL_DISPLAY_INVALID_OBJECT, 0);
@@ -108,6 +108,16 @@ shm_create_buffer(struct wl_client *client, struct wl_shm *shm,
 		return;
 	}
 
+	if (width < 0 || height < 0 || stride < width) {
+		wl_client_post_event(client,
+				     (struct wl_object *) compositor->wl_display,
+				     WL_DISPLAY_INVALID_OBJECT, 0);
+		fprintf(stderr,
+			"invalid width, height or stride in create_buffer\n");
+		close(fd);
+		return;
+	}
+
 	buffer = malloc(sizeof *buffer);
 	if (buffer == NULL) {
 		close(fd);