mirror of
https://gitlab.freedesktop.org/wayland/wayland.git
synced 2026-02-07 04:06:37 -05:00
f5b9e3b9a1
The DIV_ROUNDUP macro would overflow when trying to round values higher than MAX_UINT32 - (a - 1). The result is 0 after the division. This is potential security issue when demarshalling an array because the length check is performed with the overflowed value, but then the original huge value is stored for later use. The issue was present only on 32bit platforms. The use of size_t in the DIV_ROUNDUP macro already promoted everything to 64 bit size on 64 bit systems. Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk> Reviewed-by: Derek Foreman <derek.foreman.samsung@gmail.com> Style changes by Derek Foreman |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| connection.c | ||
| dtddata.S | ||
| event-loop.c | ||
| scanner.c | ||
| wayland-client-core.h | ||
| wayland-client-uninstalled.pc.in | ||
| wayland-client.c | ||
| wayland-client.h | ||
| wayland-client.pc.in | ||
| wayland-os.c | ||
| wayland-os.h | ||
| wayland-private.h | ||
| wayland-scanner-uninstalled.pc.in | ||
| wayland-scanner.pc.in | ||
| wayland-server-core.h | ||
| wayland-server-uninstalled.pc.in | ||
| wayland-server.c | ||
| wayland-server.h | ||
| wayland-server.pc.in | ||
| wayland-shm.c | ||
| wayland-util.c | ||
| wayland-util.h | ||
| wayland-version.h.in | ||