From 616b4ae6180499b112734d544f217a2704509c13 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Thu, 16 Sep 2021 11:11:05 +0200 Subject: [PATCH] shm: Relax shm_pool_create_buffer() validity check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit shm_pool_create_buffer() can raise a false WL_SHM_ERROR_INVALID_STRIDE error under some circumstances because of integer division. Fix this by using a strict comparison operator instead of lower or equal. Signed-off-by: Olivier Fourdan Reviewed-by: Demi Marie Obenour Reviewed-by: Simon Ser Reviewed-by: Jonas Ådahl Closes: https://gitlab.freedesktop.org/wayland/wayland/-/issues/235 --- src/wayland-shm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wayland-shm.c b/src/wayland-shm.c index 5ff794aa..27d5b008 100644 --- a/src/wayland-shm.c +++ b/src/wayland-shm.c @@ -213,7 +213,7 @@ shm_pool_create_buffer(struct wl_client *client, struct wl_resource *resource, } if (offset < 0 || width <= 0 || height <= 0 || stride < width || - INT32_MAX / stride <= height || + INT32_MAX / stride < height || offset > pool->size - stride * height) { wl_resource_post_error(resource, WL_SHM_ERROR_INVALID_STRIDE,