Commit 190f2cb6 authored by Adam Langley's avatar Adam Langley Committed by Bernhard Link

Fix handling of QueryExtension message.

Previously the code failed in the case that the length of the extension name
was not a multiple of eight and used non-zero padding.
parent 91c7e5e0
......@@ -1468,6 +1468,8 @@ static bool requestGrabButton(struct connection *c, bool pre, bool bigrequest,st
*/
bool requestQueryExtension(struct connection *c, bool pre, bool bigrequest UNUSED, struct expectedreply *reply) {
size_t len;
if( pre )
return false;
if( reply == NULL)
......@@ -1475,12 +1477,11 @@ bool requestQueryExtension(struct connection *c, bool pre, bool bigrequest UNUSE
if( c->clientignore <= 8 )
return false;
reply->data_type = dt_EXTENSION;
reply->data.extension = find_extension(c->clientbuffer+8,
c->clientignore-8);
len = c->clientignore-8;
if( len > clientCARD16(4) )
len = clientCARD16(4);
reply->data.extension = find_extension(c->clientbuffer+8, len);
if( reply->data.extension == NULL ) {
size_t len = c->clientignore-8;
if( len > clientCARD16(4) )
len = clientCARD16(4);
reply->data_type = dt_UNKNOWN_EXTENSION;
reply->data.uextension = register_unknown_extension(c,
c->clientbuffer+8, len);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment