X-Git-Url: http://git.demorecorder.com/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=src%2Fxcb_in.c;h=8a7af920b30f26f748fbc468882ff3be2c04227c;hb=1b33867fa996034deb50819ae54640be501f8d20;hp=4998cdda31d2f1e0ae74a0a968ffb4d8c140d2c1;hpb=236f914ea7205f5f74e87fcc1b06d87bd0789a7a;p=free-sw%2Fxcb%2Flibxcb

diff --git a/src/xcb_in.c b/src/xcb_in.c
index 4998cdd..8a7af92 100644
--- a/src/xcb_in.c
+++ b/src/xcb_in.c
@@ -25,6 +25,10 @@
 
 /* Stuff that reads stuff from the server. */
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <assert.h>
 #include <string.h>
 #include <stdlib.h>
@@ -89,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
 static int read_packet(xcb_connection_t *c)
 {
     xcb_generic_reply_t genrep;
-    int length = 32;
-    int eventlength = 0; /* length after first 32 bytes for GenericEvents */
+    uint64_t length = 32;
+    uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
+    uint64_t bufsize;
     void *buf;
     pending_reply *pend = 0;
     struct event_list *event;
@@ -165,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
     if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
         eventlength = genrep.length * 4;
 
-    buf = malloc(length + eventlength +
-            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
+    bufsize = length + eventlength +
+        (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
+    if (bufsize < INT32_MAX)
+        buf = malloc((size_t) bufsize);
+    else
+        buf = NULL;
     if(!buf)
     {
         _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);