[xsrc/trunk]: xsrc/external/mit/xorg-server.old/dist/Xi pull across the fixes...

[mrg <mrg%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/xsrc/rev/39197d68f5cf
branches:  trunk
changeset: 10705:39197d68f5cf
user:      mrg <mrg%NetBSD.org@localhost>
date:      Tue Apr 27 05:19:51 2021 +0000

description:
pull across the fixes for CVE-2021-3472.

diffstat:

 external/mit/xorg-server.old/dist/Xi/chgfctl.c |  5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diffs (16 lines):

diff -r 6b23c6a5a372 -r 39197d68f5cf external/mit/xorg-server.old/dist/Xi/chgfctl.c
--- a/external/mit/xorg-server.old/dist/Xi/chgfctl.c    Tue Apr 27 04:01:42 2021 +0000
+++ b/external/mit/xorg-server.old/dist/Xi/chgfctl.c    Tue Apr 27 05:19:51 2021 +0000
@@ -468,8 +468,11 @@
     case StringFeedbackClass:
     {
        char n;
-       xStringFeedbackCtl *f = ((xStringFeedbackCtl *) & stuff[1]);
+        xStringFeedbackCtl *f;
 
+        REQUEST_AT_LEAST_EXTRA_SIZE(xChangeFeedbackControlReq,
+                                    sizeof(xStringFeedbackCtl));
+        f = ((xStringFeedbackCtl *) &stuff[1]);
        if (client->swapped) {
             if (len < bytes_to_int32(sizeof(xStringFeedbackCtl)))
                 return BadLength;