CVE-2010-4819

A local attacker sends a crafted Render extension request to the X server with a large or otherwise malicious `nglyphs` value. Because the `ProcRenderAddGlyphs` function did not validate that the computed `gi` and `bits` pointers stayed within the request buffer, the subsequent loop could read arbitrary server memory or cause a crash. This is an improper input validation flaw [CWE-20].

The vulnerability is in the `ProcRenderAddGlyphs` function in `render/render.c` of the X.Org xserver. The function lacked bounds checking on the `nglyphs` parameter, allowing pointer arithmetic to produce out-of-bounds pointers (`gi` and `bits`) that could then be dereferenced in the glyph-processing loop.

The patch adds a bounds check after computing the `gi` and `bits` pointers from `nglyphs`. It verifies that both pointers lie within the valid request buffer range (`stuff` to `stuff + client->req_len`). If either pointer is out of bounds, the function returns `BadLength` and bails out, preventing any out-of-bounds memory access in the glyph-processing loop.