From 061695812b7fec6732427e7705b7b1b9e6cdc35f Mon Sep 17 00:00:00 2001 From: dottedmag Date: Tue, 22 Sep 2009 18:18:28 +0000 Subject: [PATCH] Fix memory corruption in ecore_xcb_window.c::ecore_x_window_children_get Function allocated reply->children_len bytes, and then copied sizeof(Ecore_X_Window) * reply->childen_len bytes into the buffer, leading to memory corruption. git-svn-id: svn+ssh://svn.enlightenment.org/var/svn/e/trunk/ecore@42624 7cbeb6ba-43b4-40fd-8cce-4c39aea84d33 --- src/lib/ecore_x/xcb/ecore_xcb_window.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/ecore_x/xcb/ecore_xcb_window.c b/src/lib/ecore_x/xcb/ecore_xcb_window.c index a9eabb3..44c27b7 100644 --- a/src/lib/ecore_x/xcb/ecore_xcb_window.c +++ b/src/lib/ecore_x/xcb/ecore_xcb_window.c @@ -1416,7 +1416,7 @@ ecore_x_window_children_get(Ecore_X_Window window __UNUSED__, reply = _ecore_xcb_reply_get(); if (!reply) return NULL; - windows = malloc(reply->children_len); + windows = malloc(sizeof(Ecore_X_Window) * reply->children_len); if (!windows) return NULL; -- 2.7.4