From d1b0e950b7156f8391a124346a175d95af619dc5 Mon Sep 17 00:00:00 2001
From: Raymond Toy <rtoy@google.com>
Date: Wed, 4 Jan 2012 09:58:14 -0800
Subject: [PATCH] Fix potential write past end of buffer.

We wanted to read one byte into the second byte of "byte", but didn't
cast everything correctly, so we ended up reading the byte past the
end of "byte".
---
 src/motif/server/server.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/motif/server/server.c b/src/motif/server/server.c
index 62f6ebdde..fe0b22488 100644
--- a/src/motif/server/server.c
+++ b/src/motif/server/server.c
@@ -110,7 +110,10 @@ void greet_client(int socket) {
   /* Read byte-swap thing */
   result = read(socket,&byte,2);
   if( !result )  fatal_error("greet_client:  Unable to read initial data.");
-  else if( result == 1 )  read(socket,&byte+1,1);
+  else if( result == 1 ) {
+      result = read(socket, ((char *) &byte)+1,1);
+      fatal_error("greet_client:  Unable to read initial data.");
+  }
 
   swap_bytes = (byte!=1);
   if( global_will_trace ) {
-- 
GitLab