[PATCH 0/1] MR3569: winex11.drv: Fix buffer allocation size in import_xdnd_selection().

[Paul Gofman (＠gofman)]

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=55443

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3569

[PATCH 1/1] winex11.drv: Fix buffer allocation size in import_xdnd_selection().

[Paul Gofman]

From: Paul Gofman <pgofman(a)codeweavers.com>

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=55443
---
 dlls/winex11.drv/clipboard.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/winex11.drv/clipboard.c b/dlls/winex11.drv/clipboard.c
index 959b59825e1..6f233418105 100644
--- a/dlls/winex11.drv/clipboard.c
+++ b/dlls/winex11.drv/clipboard.c
@@ -1308,7 +1308,7 @@ struct format_entry *import_xdnd_selection( Display *display, Window win, Atom s
         if (!(data = import_selection( display, win, selection, format, &size ))) continue;
 
         entry_size = (FIELD_OFFSET( struct format_entry, data[size] ) + 7) & ~7;
-        if (buf_size < size + entry_size)
+        if (buf_size < *ret_size + entry_size)
         {
             if (!(tmp = realloc( ret, *ret_size + entry_size + 1024 ))) continue;
             ret = tmp;
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/3569

[Torge Matthies (＠tmatthies)]

Damn, you beat me to it (I made 1:1 the same patch).

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3569#note_42277

[PATCH 0/1] MR3569: winex11.drv: Fix buffer allocation size in import_xdnd_selection(). - approved

[Jacek Caban (＠jacek)]

This merge request was approved by Jacek Caban.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/3569