Comment 7 for bug 563457

Revision history for this message
Kees Cook (kees) wrote :

Ah-ha, got it. Atoms are packed as 32bit values, and on 64bit systems, this will mean the last atom in the list copies 4 bytes out of xinput's heap after the end of the data buffer. This patch is a real fix and corrects the dereferenced size so that the resulting atom is zero-extended instead of filling the high half with garbage.