Code: XvQueryAdaptors(
    Display *dpy,
    Window window,
    unsigned int *p_nAdaptors,
    XvAdaptorInfo **p_pAdaptors)
{
    XExtDisplayInfo *info = xv_find_display(dpy);
    xvQueryAdaptorsReq *req;
    xvQueryAdaptorsReply rep;
     size_t size;
     unsigned int ii, jj;
     char *name;
     XvAdaptorInfo *pas = NULL, *pa;
     XvFormat *pfs, *pf;
     char *buffer = NULL;
        char *buffer;
        char *string;
        xvAdaptorInfo *pa;
        xvFormat *pf;
    } u;

Vulnerability Type: 
CWE ID: CWE-125
Summary: The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
Commit Message: 