1523N/A--- a/unix/x0vncserver/Image.cxx Wed Oct 22 10:30:27 2014

1523N/A+++ b/unix/x0vncserver/Image.cxx Wed Oct 22 10:46:12 2014

1523N/A@@ -79,6 +79,13 @@

1523N/A

1523N/A xim = XCreateImage(dpy, vis, DefaultDepth(dpy, DefaultScreen(dpy)),

1523N/A ZPixmap, 0, 0, width, height, BitmapPad(dpy), 0);

1523N/A+ if (xim->bytes_per_line <= 0 ||

1523N/A+ xim->height <= 0 ||

1523N/A+ xim->height >= INT_MAX / xim->bytes_per_line) {

1523N/A+ vlog.error("Invalid display size");

1523N/A+ XDestroyImage(xim);

1523N/A+ exit(1);

1523N/A+ }

1523N/A

1523N/A xim->data = (char *)malloc(xim->bytes_per_line * xim->height);

1523N/A if (xim->data == NULL) {

1523N/A@@ -256,6 +263,17 @@

1523N/A return;

1523N/A }

1523N/A

1523N/A+ if (xim->bytes_per_line <= 0 ||

1523N/A+ xim->height <= 0 ||

1523N/A+ xim->height >= INT_MAX / xim->bytes_per_line) {

1523N/A+ vlog.error("Invalid display size");

1523N/A+ XDestroyImage(xim);

1523N/A+ xim = NULL;

1523N/A+ delete shminfo;

1523N/A+ shminfo = NULL;

1523N/A+ return;

1523N/A+ }

1523N/A+

1523N/A shminfo->shmid = shmget(IPC_PRIVATE,

1523N/A xim->bytes_per_line * xim->height,

1523N/A IPC_CREAT|0777);