You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
3388 lines
115 KiB
Diff
3388 lines
115 KiB
Diff
diff -Naur xorg-server-1.12.4.orig/dbe/dbe.c xorg-server-1.12.4/dbe/dbe.c
|
|
--- xorg-server-1.12.4.orig/dbe/dbe.c 2012-05-17 19:09:01.000000000 +0200
|
|
+++ xorg-server-1.12.4/dbe/dbe.c 2014-11-28 09:50:59.185807584 +0100
|
|
@@ -453,18 +453,20 @@
|
|
DbeSwapInfoPtr swapInfo;
|
|
xDbeSwapInfo *dbeSwapInfo;
|
|
int error;
|
|
- register int i, j;
|
|
- int nStuff;
|
|
+ unsigned int i, j;
|
|
+ unsigned int nStuff;
|
|
|
|
REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
|
|
nStuff = stuff->n; /* use local variable for performance. */
|
|
|
|
if (nStuff == 0) {
|
|
+ REQUEST_SIZE_MATCH(xDbeSwapBuffersReq);
|
|
return Success;
|
|
}
|
|
|
|
if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
|
|
return BadAlloc;
|
|
+ REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, nStuff * sizeof(xDbeSwapInfo));
|
|
|
|
/* Get to the swap info appended to the end of the request. */
|
|
dbeSwapInfo = (xDbeSwapInfo *) &stuff[1];
|
|
@@ -955,13 +957,16 @@
|
|
SProcDbeSwapBuffers(ClientPtr client)
|
|
{
|
|
REQUEST(xDbeSwapBuffersReq);
|
|
- register int i;
|
|
+ unsigned int i;
|
|
xDbeSwapInfo *pSwapInfo;
|
|
|
|
swaps(&stuff->length);
|
|
REQUEST_AT_LEAST_SIZE(xDbeSwapBuffersReq);
|
|
|
|
swapl(&stuff->n);
|
|
+ if (stuff->n > UINT32_MAX / sizeof(DbeSwapInfoRec))
|
|
+ return BadAlloc;
|
|
+ REQUEST_FIXED_SIZE(xDbeSwapBuffersReq, stuff->n * sizeof(xDbeSwapInfo));
|
|
|
|
if (stuff->n != 0) {
|
|
pSwapInfo = (xDbeSwapInfo *) stuff + 1;
|
|
diff -Naur xorg-server-1.12.4.orig/dix/dispatch.c xorg-server-1.12.4/dix/dispatch.c
|
|
--- xorg-server-1.12.4.orig/dix/dispatch.c 2012-05-17 19:09:01.000000000 +0200
|
|
+++ xorg-server-1.12.4/dix/dispatch.c 2014-11-28 09:50:37.761568914 +0100
|
|
@@ -1952,6 +1952,9 @@
|
|
tmpImage = (char *) &stuff[1];
|
|
lengthProto = length;
|
|
|
|
+ if (lengthProto >= (INT32_MAX / stuff->height))
|
|
+ return BadLength;
|
|
+
|
|
if ((bytes_to_int32(lengthProto * stuff->height) +
|
|
bytes_to_int32(sizeof(xPutImageReq))) != client->req_len)
|
|
return BadLength;
|
|
diff -Naur xorg-server-1.12.4.orig/dix/region.c xorg-server-1.12.4/dix/region.c
|
|
--- xorg-server-1.12.4.orig/dix/region.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/dix/region.c 2014-11-28 09:50:45.169651442 +0100
|
|
@@ -169,7 +169,6 @@
|
|
((r1)->y1 <= (r2)->y1) && \
|
|
((r1)->y2 >= (r2)->y2) )
|
|
|
|
-#define xallocData(n) malloc(RegionSizeof(n))
|
|
#define xfreeData(reg) if ((reg)->data && (reg)->data->size) free((reg)->data)
|
|
|
|
#define RECTALLOC_BAIL(pReg,n,bail) \
|
|
@@ -205,8 +204,9 @@
|
|
#define DOWNSIZE(reg,numRects) \
|
|
if (((numRects) < ((reg)->data->size >> 1)) && ((reg)->data->size > 50)) \
|
|
{ \
|
|
- RegDataPtr NewData; \
|
|
- NewData = (RegDataPtr)realloc((reg)->data, RegionSizeof(numRects)); \
|
|
+ size_t NewSize = RegionSizeof(numRects); \
|
|
+ RegDataPtr NewData = \
|
|
+ (NewSize > 0) ? realloc((reg)->data, NewSize) : NULL ; \
|
|
if (NewData) \
|
|
{ \
|
|
NewData->size = (numRects); \
|
|
@@ -330,17 +330,20 @@
|
|
RegionRectAlloc(RegionPtr pRgn, int n)
|
|
{
|
|
RegDataPtr data;
|
|
+ size_t rgnSize;
|
|
|
|
if (!pRgn->data) {
|
|
n++;
|
|
- pRgn->data = xallocData(n);
|
|
+ rgnSize = RegionSizeof(n);
|
|
+ pRgn->data = (rgnSize > 0) ? malloc(rgnSize) : NULL;
|
|
if (!pRgn->data)
|
|
return RegionBreak(pRgn);
|
|
pRgn->data->numRects = 1;
|
|
*RegionBoxptr(pRgn) = pRgn->extents;
|
|
}
|
|
else if (!pRgn->data->size) {
|
|
- pRgn->data = xallocData(n);
|
|
+ rgnSize = RegionSizeof(n);
|
|
+ pRgn->data = (rgnSize > 0) ? malloc(rgnSize) : NULL;
|
|
if (!pRgn->data)
|
|
return RegionBreak(pRgn);
|
|
pRgn->data->numRects = 0;
|
|
@@ -352,7 +355,8 @@
|
|
n = 250;
|
|
}
|
|
n += pRgn->data->numRects;
|
|
- data = (RegDataPtr) realloc(pRgn->data, RegionSizeof(n));
|
|
+ rgnSize = RegionSizeof(n);
|
|
+ data = (rgnSize > 0) ? realloc(pRgn->data, rgnSize) : NULL;
|
|
if (!data)
|
|
return RegionBreak(pRgn);
|
|
pRgn->data = data;
|
|
@@ -1297,6 +1301,7 @@
|
|
{
|
|
|
|
RegionPtr pRgn;
|
|
+ size_t rgnSize;
|
|
RegDataPtr pData;
|
|
BoxPtr pBox;
|
|
int i;
|
|
@@ -1323,7 +1328,8 @@
|
|
}
|
|
return pRgn;
|
|
}
|
|
- pData = xallocData(nrects);
|
|
+ rgnSize = RegionSizeof(nrects);
|
|
+ pData = (rgnSize > 0) ? malloc(rgnSize) : NULL;
|
|
if (!pData) {
|
|
RegionBreak(pRgn);
|
|
return pRgn;
|
|
diff -Naur xorg-server-1.12.4.orig/glx/glxcmds.c xorg-server-1.12.4/glx/glxcmds.c
|
|
--- xorg-server-1.12.4.orig/glx/glxcmds.c 2012-08-02 02:59:23.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/glxcmds.c 2014-11-28 09:51:59.834483171 +0100
|
|
@@ -1948,7 +1948,7 @@
|
|
left = (req->length << 2) - sz_xGLXRenderReq;
|
|
while (left > 0) {
|
|
__GLXrenderSizeData entry;
|
|
- int extra;
|
|
+ int extra = 0;
|
|
__GLXdispatchRenderProcPtr proc;
|
|
int err;
|
|
|
|
@@ -1967,6 +1967,9 @@
|
|
cmdlen = hdr->length;
|
|
opcode = hdr->opcode;
|
|
|
|
+ if (left < cmdlen)
|
|
+ return BadLength;
|
|
+
|
|
/*
|
|
** Check for core opcodes and grab entry data.
|
|
*/
|
|
@@ -1980,24 +1983,20 @@
|
|
return __glXError(GLXBadRenderRequest);
|
|
}
|
|
|
|
+ if (cmdlen < entry.bytes) {
|
|
+ return BadLength;
|
|
+ }
|
|
+
|
|
if (entry.varsize) {
|
|
/* variable size command */
|
|
extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
|
|
client->swapped);
|
|
if (extra < 0) {
|
|
- extra = 0;
|
|
- }
|
|
- if (cmdlen != __GLX_PAD(entry.bytes + extra)) {
|
|
- return BadLength;
|
|
- }
|
|
- }
|
|
- else {
|
|
- /* constant size command */
|
|
- if (cmdlen != __GLX_PAD(entry.bytes)) {
|
|
return BadLength;
|
|
}
|
|
}
|
|
- if (left < cmdlen) {
|
|
+
|
|
+ if (cmdlen != safe_pad(safe_add(entry.bytes, extra))) {
|
|
return BadLength;
|
|
}
|
|
|
|
@@ -2102,7 +2101,7 @@
|
|
extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE,
|
|
client->swapped);
|
|
if (extra < 0) {
|
|
- extra = 0;
|
|
+ return BadLength;
|
|
}
|
|
/* large command's header is 4 bytes longer, so add 4 */
|
|
if (cmdlen != __GLX_PAD(entry.bytes + 4 + extra)) {
|
|
diff -Naur xorg-server-1.12.4.orig/glx/glxcmdsswap.c xorg-server-1.12.4/glx/glxcmdsswap.c
|
|
--- xorg-server-1.12.4.orig/glx/glxcmdsswap.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/glxcmdsswap.c 2014-11-28 09:52:11.210609886 +0100
|
|
@@ -962,11 +962,13 @@
|
|
int
|
|
__glXDispSwap_VendorPrivate(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
xGLXVendorPrivateReq *req;
|
|
GLint vendorcode;
|
|
__GLXdispatchVendorPrivProcPtr proc;
|
|
|
|
__GLX_DECLARE_SWAP_VARIABLES;
|
|
+ REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateReq);
|
|
|
|
req = (xGLXVendorPrivateReq *) pc;
|
|
__GLX_SWAP_SHORT(&req->length);
|
|
@@ -989,11 +991,13 @@
|
|
int
|
|
__glXDispSwap_VendorPrivateWithReply(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
xGLXVendorPrivateWithReplyReq *req;
|
|
GLint vendorcode;
|
|
__GLXdispatchVendorPrivProcPtr proc;
|
|
|
|
__GLX_DECLARE_SWAP_VARIABLES;
|
|
+ REQUEST_AT_LEAST_SIZE(xGLXVendorPrivateWithReplyReq);
|
|
|
|
req = (xGLXVendorPrivateWithReplyReq *) pc;
|
|
__GLX_SWAP_SHORT(&req->length);
|
|
diff -Naur xorg-server-1.12.4.orig/glx/glxserver.h xorg-server-1.12.4/glx/glxserver.h
|
|
--- xorg-server-1.12.4.orig/glx/glxserver.h 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/glxserver.h 2014-11-28 09:51:56.474445744 +0100
|
|
@@ -218,6 +218,47 @@
|
|
* Routines for computing the size of variably-sized rendering commands.
|
|
*/
|
|
|
|
+static _X_INLINE int
|
|
+safe_add(int a, int b)
|
|
+{
|
|
+ if (a < 0 || b < 0)
|
|
+ return -1;
|
|
+
|
|
+ if (INT_MAX - a < b)
|
|
+ return -1;
|
|
+
|
|
+ return a + b;
|
|
+}
|
|
+
|
|
+static _X_INLINE int
|
|
+safe_mul(int a, int b)
|
|
+{
|
|
+ if (a < 0 || b < 0)
|
|
+ return -1;
|
|
+
|
|
+ if (a == 0 || b == 0)
|
|
+ return 0;
|
|
+
|
|
+ if (a > INT_MAX / b)
|
|
+ return -1;
|
|
+
|
|
+ return a * b;
|
|
+}
|
|
+
|
|
+static _X_INLINE int
|
|
+safe_pad(int a)
|
|
+{
|
|
+ int ret;
|
|
+
|
|
+ if (a < 0)
|
|
+ return -1;
|
|
+
|
|
+ if ((ret = safe_add(a, 3)) < 0)
|
|
+ return -1;
|
|
+
|
|
+ return ret & (GLuint)~3;
|
|
+}
|
|
+
|
|
extern int __glXTypeSize(GLenum enm);
|
|
extern int __glXImageSize(GLenum format, GLenum type,
|
|
GLenum target, GLsizei w, GLsizei h, GLsizei d,
|
|
diff -Naur xorg-server-1.12.4.orig/glx/indirect_program.c xorg-server-1.12.4/glx/indirect_program.c
|
|
--- xorg-server-1.12.4.orig/glx/indirect_program.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/indirect_program.c 2014-11-28 09:52:15.138653638 +0100
|
|
@@ -69,6 +69,8 @@
|
|
__GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error);
|
|
ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateWithReplyReq, 8);
|
|
+
|
|
pc += __GLX_VENDPRIV_HDR_SIZE;
|
|
if (cx != NULL) {
|
|
GLenum target;
|
|
diff -Naur xorg-server-1.12.4.orig/glx/indirect_util.c xorg-server-1.12.4/glx/indirect_util.c
|
|
--- xorg-server-1.12.4.orig/glx/indirect_util.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/indirect_util.c 2014-11-28 09:52:18.662692891 +0100
|
|
@@ -78,12 +78,17 @@
|
|
void *local_buffer, size_t local_size, unsigned alignment)
|
|
{
|
|
void *buffer = local_buffer;
|
|
- const unsigned mask = alignment - 1;
|
|
+ const intptr_t mask = alignment - 1;
|
|
|
|
if (local_size < required_size) {
|
|
- const size_t worst_case_size = required_size + alignment;
|
|
+ size_t worst_case_size;
|
|
intptr_t temp_buf;
|
|
|
|
+ if (required_size < SIZE_MAX - alignment)
|
|
+ worst_case_size = required_size + alignment;
|
|
+ else
|
|
+ return NULL;
|
|
+
|
|
if (cl->returnBufSize < worst_case_size) {
|
|
void *temp = realloc(cl->returnBuf, worst_case_size);
|
|
|
|
diff -Naur xorg-server-1.12.4.orig/glx/rensize.c xorg-server-1.12.4/glx/rensize.c
|
|
--- xorg-server-1.12.4.orig/glx/rensize.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/rensize.c 2014-11-28 09:52:04.398534008 +0100
|
|
@@ -43,19 +43,11 @@
|
|
(((a & 0xff000000U)>>24) | ((a & 0xff0000U)>>8) | \
|
|
((a & 0xff00U)<<8) | ((a & 0xffU)<<24))
|
|
|
|
-static int
|
|
-Map1Size(GLint k, GLint order)
|
|
-{
|
|
- if (order <= 0 || k < 0)
|
|
- return -1;
|
|
- return k * order;
|
|
-}
|
|
-
|
|
int
|
|
__glXMap1dReqSize(const GLbyte * pc, Bool swap)
|
|
{
|
|
GLenum target;
|
|
- GLint order, k;
|
|
+ GLint order;
|
|
|
|
target = *(GLenum *) (pc + 16);
|
|
order = *(GLint *) (pc + 20);
|
|
@@ -63,15 +55,16 @@
|
|
target = SWAPL(target);
|
|
order = SWAPL(order);
|
|
}
|
|
- k = __glMap1d_size(target);
|
|
- return 8 * Map1Size(k, order);
|
|
+ if (order < 1)
|
|
+ return -1;
|
|
+ return safe_mul(8, safe_mul(__glMap1d_size(target), order));
|
|
}
|
|
|
|
int
|
|
__glXMap1fReqSize(const GLbyte * pc, Bool swap)
|
|
{
|
|
GLenum target;
|
|
- GLint order, k;
|
|
+ GLint order;
|
|
|
|
target = *(GLenum *) (pc + 0);
|
|
order = *(GLint *) (pc + 12);
|
|
@@ -79,23 +72,24 @@
|
|
target = SWAPL(target);
|
|
order = SWAPL(order);
|
|
}
|
|
- k = __glMap1f_size(target);
|
|
- return 4 * Map1Size(k, order);
|
|
+ if (order < 1)
|
|
+ return -1;
|
|
+ return safe_mul(4, safe_mul(__glMap1f_size(target), order));
|
|
}
|
|
|
|
static int
|
|
Map2Size(int k, int majorOrder, int minorOrder)
|
|
{
|
|
- if (majorOrder <= 0 || minorOrder <= 0 || k < 0)
|
|
+ if (majorOrder < 1 || minorOrder < 1)
|
|
return -1;
|
|
- return k * majorOrder * minorOrder;
|
|
+ return safe_mul(k, safe_mul(majorOrder, minorOrder));
|
|
}
|
|
|
|
int
|
|
__glXMap2dReqSize(const GLbyte * pc, Bool swap)
|
|
{
|
|
GLenum target;
|
|
- GLint uorder, vorder, k;
|
|
+ GLint uorder, vorder;
|
|
|
|
target = *(GLenum *) (pc + 32);
|
|
uorder = *(GLint *) (pc + 36);
|
|
@@ -105,15 +99,14 @@
|
|
uorder = SWAPL(uorder);
|
|
vorder = SWAPL(vorder);
|
|
}
|
|
- k = __glMap2d_size(target);
|
|
- return 8 * Map2Size(k, uorder, vorder);
|
|
+ return safe_mul(8, Map2Size(__glMap2d_size(target), uorder, vorder));
|
|
}
|
|
|
|
int
|
|
__glXMap2fReqSize(const GLbyte * pc, Bool swap)
|
|
{
|
|
GLenum target;
|
|
- GLint uorder, vorder, k;
|
|
+ GLint uorder, vorder;
|
|
|
|
target = *(GLenum *) (pc + 0);
|
|
uorder = *(GLint *) (pc + 12);
|
|
@@ -123,8 +116,7 @@
|
|
uorder = SWAPL(uorder);
|
|
vorder = SWAPL(vorder);
|
|
}
|
|
- k = __glMap2f_size(target);
|
|
- return 4 * Map2Size(k, uorder, vorder);
|
|
+ return safe_mul(4, Map2Size(__glMap2f_size(target), uorder, vorder));
|
|
}
|
|
|
|
/**
|
|
@@ -175,14 +167,16 @@
|
|
GLint bytesPerElement, elementsPerGroup, groupsPerRow;
|
|
GLint groupSize, rowSize, padding, imageSize;
|
|
|
|
+ if (w == 0 || h == 0 || d == 0)
|
|
+ return 0;
|
|
+
|
|
if (w < 0 || h < 0 || d < 0 ||
|
|
(type == GL_BITMAP &&
|
|
(format != GL_COLOR_INDEX && format != GL_STENCIL_INDEX))) {
|
|
return -1;
|
|
}
|
|
- if (w == 0 || h == 0 || d == 0)
|
|
- return 0;
|
|
|
|
+ /* proxy targets have no data */
|
|
switch (target) {
|
|
case GL_PROXY_TEXTURE_1D:
|
|
case GL_PROXY_TEXTURE_2D:
|
|
@@ -199,6 +193,12 @@
|
|
return 0;
|
|
}
|
|
|
|
+ /* real data has to have real sizes */
|
|
+ if (imageHeight < 0 || rowLength < 0 || skipImages < 0 || skipRows < 0)
|
|
+ return -1;
|
|
+ if (alignment != 1 && alignment != 2 && alignment != 4 && alignment != 8)
|
|
+ return -1;
|
|
+
|
|
if (type == GL_BITMAP) {
|
|
if (rowLength > 0) {
|
|
groupsPerRow = rowLength;
|
|
@@ -207,11 +207,14 @@
|
|
groupsPerRow = w;
|
|
}
|
|
rowSize = bits_to_bytes(groupsPerRow);
|
|
+ if (rowSize < 0)
|
|
+ return -1;
|
|
padding = (rowSize % alignment);
|
|
if (padding) {
|
|
rowSize += alignment - padding;
|
|
}
|
|
- return ((h + skipRows) * rowSize);
|
|
+
|
|
+ return safe_mul(safe_add(h, skipRows), rowSize);
|
|
}
|
|
else {
|
|
switch (format) {
|
|
@@ -224,6 +227,11 @@
|
|
case GL_ALPHA:
|
|
case GL_LUMINANCE:
|
|
case GL_INTENSITY:
|
|
+ case GL_RED_INTEGER_EXT:
|
|
+ case GL_GREEN_INTEGER_EXT:
|
|
+ case GL_BLUE_INTEGER_EXT:
|
|
+ case GL_ALPHA_INTEGER_EXT:
|
|
+ case GL_LUMINANCE_INTEGER_EXT:
|
|
elementsPerGroup = 1;
|
|
break;
|
|
case GL_422_EXT:
|
|
@@ -234,14 +242,19 @@
|
|
case GL_DEPTH_STENCIL_MESA:
|
|
case GL_YCBCR_MESA:
|
|
case GL_LUMINANCE_ALPHA:
|
|
+ case GL_LUMINANCE_ALPHA_INTEGER_EXT:
|
|
elementsPerGroup = 2;
|
|
break;
|
|
case GL_RGB:
|
|
case GL_BGR:
|
|
+ case GL_RGB_INTEGER_EXT:
|
|
+ case GL_BGR_INTEGER_EXT:
|
|
elementsPerGroup = 3;
|
|
break;
|
|
case GL_RGBA:
|
|
case GL_BGRA:
|
|
+ case GL_RGBA_INTEGER_EXT:
|
|
+ case GL_BGRA_INTEGER_EXT:
|
|
case GL_ABGR_EXT:
|
|
elementsPerGroup = 4;
|
|
break;
|
|
@@ -293,6 +306,7 @@
|
|
default:
|
|
return -1;
|
|
}
|
|
+ /* known safe by the switches above, not checked */
|
|
groupSize = bytesPerElement * elementsPerGroup;
|
|
if (rowLength > 0) {
|
|
groupsPerRow = rowLength;
|
|
@@ -300,18 +314,21 @@
|
|
else {
|
|
groupsPerRow = w;
|
|
}
|
|
- rowSize = groupsPerRow * groupSize;
|
|
+
|
|
+ if ((rowSize = safe_mul(groupsPerRow, groupSize)) < 0)
|
|
+ return -1;
|
|
padding = (rowSize % alignment);
|
|
if (padding) {
|
|
rowSize += alignment - padding;
|
|
}
|
|
- if (imageHeight > 0) {
|
|
- imageSize = (imageHeight + skipRows) * rowSize;
|
|
- }
|
|
- else {
|
|
- imageSize = (h + skipRows) * rowSize;
|
|
- }
|
|
- return ((d + skipImages) * imageSize);
|
|
+
|
|
+ if (imageHeight > 0)
|
|
+ h = imageHeight;
|
|
+ h = safe_add(h, skipRows);
|
|
+
|
|
+ imageSize = safe_mul(h, rowSize);
|
|
+
|
|
+ return safe_mul(safe_add(d, skipImages), imageSize);
|
|
}
|
|
}
|
|
|
|
@@ -435,9 +452,7 @@
|
|
/* XXX Should rowLength be used for either or both image? */
|
|
image1size = __glXImageSize(format, type, 0, w, 1, 1,
|
|
0, rowLength, 0, 0, alignment);
|
|
- image1size = __GLX_PAD(image1size);
|
|
image2size = __glXImageSize(format, type, 0, h, 1, 1,
|
|
0, rowLength, 0, 0, alignment);
|
|
- return image1size + image2size;
|
|
-
|
|
+ return safe_add(safe_pad(image1size), image2size);
|
|
}
|
|
diff -Naur xorg-server-1.12.4.orig/glx/singlepix.c xorg-server-1.12.4/glx/singlepix.c
|
|
--- xorg-server-1.12.4.orig/glx/singlepix.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/singlepix.c 2014-11-28 09:51:46.254331903 +0100
|
|
@@ -69,7 +69,7 @@
|
|
lsbFirst = *(GLboolean *) (pc + 25);
|
|
compsize = __glReadPixels_size(format, type, width, height);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_LSB_FIRST, lsbFirst));
|
|
@@ -134,7 +134,7 @@
|
|
compsize =
|
|
__glGetTexImage_size(target, level, format, type, width, height, depth);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -232,9 +232,9 @@
|
|
compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
|
|
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
if (compsize2 < 0)
|
|
- compsize2 = 0;
|
|
+ return BadLength;
|
|
compsize = __GLX_PAD(compsize);
|
|
compsize2 = __GLX_PAD(compsize2);
|
|
|
|
@@ -315,7 +315,7 @@
|
|
*/
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -386,7 +386,7 @@
|
|
*/
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -447,7 +447,7 @@
|
|
|
|
compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -513,7 +513,7 @@
|
|
*/
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
diff -Naur xorg-server-1.12.4.orig/glx/singlepixswap.c xorg-server-1.12.4/glx/singlepixswap.c
|
|
--- xorg-server-1.12.4.orig/glx/singlepixswap.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/singlepixswap.c 2014-11-28 09:51:46.254331903 +0100
|
|
@@ -79,7 +79,7 @@
|
|
lsbFirst = *(GLboolean *) (pc + 25);
|
|
compsize = __glReadPixels_size(format, type, width, height);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_LSB_FIRST, lsbFirst));
|
|
@@ -155,7 +155,7 @@
|
|
compsize =
|
|
__glGetTexImage_size(target, level, format, type, width, height, depth);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -267,9 +267,9 @@
|
|
compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
|
|
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
if (compsize2 < 0)
|
|
- compsize2 = 0;
|
|
+ return BadLength;
|
|
compsize = __GLX_PAD(compsize);
|
|
compsize2 = __GLX_PAD(compsize2);
|
|
|
|
@@ -358,7 +358,7 @@
|
|
*/
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, height, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -437,7 +437,7 @@
|
|
*/
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -505,7 +505,7 @@
|
|
|
|
compsize = __glGetTexImage_size(target, 1, format, type, 2, 1, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
@@ -577,7 +577,7 @@
|
|
*/
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
|
|
if (compsize < 0)
|
|
- compsize = 0;
|
|
+ return BadLength;
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
|
|
__GLX_GET_ANSWER_BUFFER(answer, cl, compsize, 1);
|
|
diff -Naur xorg-server-1.12.4.orig/glx/swap_interval.c xorg-server-1.12.4/glx/swap_interval.c
|
|
--- xorg-server-1.12.4.orig/glx/swap_interval.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/swap_interval.c 2014-11-28 09:52:15.138653638 +0100
|
|
@@ -50,6 +50,8 @@
|
|
__GLXcontext *cx;
|
|
GLint interval;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 4);
|
|
+
|
|
cx = __glXLookupContextByTag(cl, tag);
|
|
|
|
if ((cx == NULL) || (cx->pGlxScreen == NULL)) {
|
|
diff -Naur xorg-server-1.12.4.orig/glx/unpack.h xorg-server-1.12.4/glx/unpack.h
|
|
--- xorg-server-1.12.4.orig/glx/unpack.h 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/unpack.h 2014-11-28 09:51:49.594369108 +0100
|
|
@@ -83,7 +83,8 @@
|
|
** pointer.
|
|
*/
|
|
#define __GLX_GET_ANSWER_BUFFER(res,cl,size,align) \
|
|
- if ((size) > sizeof(answerBuffer)) { \
|
|
+ if (size < 0) return BadLength; \
|
|
+ else if ((size) > sizeof(answerBuffer)) { \
|
|
int bump; \
|
|
if ((cl)->returnBufSize < (size)+(align)) { \
|
|
(cl)->returnBuf = (GLbyte*)realloc((cl)->returnBuf, \
|
|
diff -Naur xorg-server-1.12.4.orig/hw/xfree86/dri2/dri2ext.c xorg-server-1.12.4/hw/xfree86/dri2/dri2ext.c
|
|
--- xorg-server-1.12.4.orig/hw/xfree86/dri2/dri2ext.c 2012-05-17 19:09:03.000000000 +0200
|
|
+++ xorg-server-1.12.4/hw/xfree86/dri2/dri2ext.c 2014-11-28 09:50:54.413754423 +0100
|
|
@@ -263,6 +263,9 @@
|
|
unsigned int *attachments;
|
|
|
|
REQUEST_FIXED_SIZE(xDRI2GetBuffersReq, stuff->count * 4);
|
|
+ if (stuff->count > (INT_MAX / 4))
|
|
+ return BadLength;
|
|
+
|
|
if (!validDrawable(client, stuff->drawable, DixReadAccess | DixWriteAccess,
|
|
&pDrawable, &status))
|
|
return status;
|
|
diff -Naur xorg-server-1.12.4.orig/include/dix.h xorg-server-1.12.4/include/dix.h
|
|
--- xorg-server-1.12.4.orig/include/dix.h 2012-05-17 19:09:04.000000000 +0200
|
|
+++ xorg-server-1.12.4/include/dix.h 2014-11-28 09:50:49.805703089 +0100
|
|
@@ -74,7 +74,8 @@
|
|
|
|
#define REQUEST_FIXED_SIZE(req, n)\
|
|
if (((sizeof(req) >> 2) > client->req_len) || \
|
|
- (((sizeof(req) + (n) + 3) >> 2) != client->req_len)) \
|
|
+ ((n >> 2) >= client->req_len) || \
|
|
+ ((((uint64_t) sizeof(req) + (n) + 3) >> 2) != (uint64_t) client->req_len)) \
|
|
return(BadLength)
|
|
|
|
#define LEGAL_NEW_RESOURCE(id,client)\
|
|
diff -Naur xorg-server-1.12.4.orig/include/regionstr.h xorg-server-1.12.4/include/regionstr.h
|
|
--- xorg-server-1.12.4.orig/include/regionstr.h 2012-05-17 19:09:04.000000000 +0200
|
|
+++ xorg-server-1.12.4/include/regionstr.h 2014-11-28 09:50:45.169651442 +0100
|
|
@@ -127,7 +127,10 @@
|
|
static inline size_t
|
|
RegionSizeof(int n)
|
|
{
|
|
- return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
|
|
+ if (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)))
|
|
+ return (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)));
|
|
+ else
|
|
+ return 0;
|
|
}
|
|
|
|
static inline void
|
|
@@ -138,9 +141,10 @@
|
|
(_pReg)->data = (RegDataPtr) NULL;
|
|
}
|
|
else {
|
|
+ size_t rgnSize;
|
|
(_pReg)->extents = RegionEmptyBox;
|
|
- if (((_size) > 1) && ((_pReg)->data =
|
|
- (RegDataPtr) malloc(RegionSizeof(_size)))) {
|
|
+ if (((_size) > 1) && ((rgnSize = RegionSizeof(_size)) > 0) &&
|
|
+ (((_pReg)->data = malloc(rgnSize)) != NULL)) {
|
|
(_pReg)->data->size = (_size);
|
|
(_pReg)->data->numRects = 0;
|
|
}
|
|
diff -Naur xorg-server-1.12.4.orig/os/access.c xorg-server-1.12.4/os/access.c
|
|
--- xorg-server-1.12.4.orig/os/access.c 2012-05-17 19:09:04.000000000 +0200
|
|
+++ xorg-server-1.12.4/os/access.c 2014-11-28 09:50:41.409609554 +0100
|
|
@@ -1331,6 +1331,10 @@
|
|
for (host = validhosts; host; host = host->next) {
|
|
nHosts++;
|
|
n += pad_to_int32(host->len) + sizeof(xHostEntry);
|
|
+ /* Could check for INT_MAX, but in reality having more than 1mb of
|
|
+ hostnames in the access list is ridiculous */
|
|
+ if (n >= 1048576)
|
|
+ break;
|
|
}
|
|
if (n) {
|
|
*data = ptr = malloc(n);
|
|
@@ -1339,6 +1343,8 @@
|
|
}
|
|
for (host = validhosts; host; host = host->next) {
|
|
len = host->len;
|
|
+ if ((ptr + sizeof(xHostEntry) + len) > (data + n))
|
|
+ break;
|
|
((xHostEntry *) ptr)->family = host->family;
|
|
((xHostEntry *) ptr)->length = len;
|
|
ptr += sizeof(xHostEntry);
|
|
diff -Naur xorg-server-1.12.4.orig/os/rpcauth.c xorg-server-1.12.4/os/rpcauth.c
|
|
--- xorg-server-1.12.4.orig/os/rpcauth.c 2012-05-17 19:09:04.000000000 +0200
|
|
+++ xorg-server-1.12.4/os/rpcauth.c 2014-11-28 09:50:32.861514326 +0100
|
|
@@ -66,6 +66,10 @@
|
|
SVCXPRT xprt;
|
|
|
|
temp_inmsg = malloc(len);
|
|
+ if (temp_inmsg == NULL) {
|
|
+ why = AUTH_FAILED; /* generic error, since there is no AUTH_BADALLOC */
|
|
+ return NULL;
|
|
+ }
|
|
memmove(temp_inmsg, inmsg, len);
|
|
|
|
memset((char *) &msg, 0, sizeof(msg));
|
|
diff -Naur xorg-server-1.12.4.orig/randr/rrsdispatch.c xorg-server-1.12.4/randr/rrsdispatch.c
|
|
--- xorg-server-1.12.4.orig/randr/rrsdispatch.c 2012-05-17 19:09:05.000000000 +0200
|
|
+++ xorg-server-1.12.4/randr/rrsdispatch.c 2014-11-28 09:51:10.885937921 +0100
|
|
@@ -27,6 +27,7 @@
|
|
{
|
|
REQUEST(xRRQueryVersionReq);
|
|
|
|
+ REQUEST_SIZE_MATCH(xRRQueryVersionReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->majorVersion);
|
|
swapl(&stuff->minorVersion);
|
|
@@ -38,6 +39,7 @@
|
|
{
|
|
REQUEST(xRRGetScreenInfoReq);
|
|
|
|
+ REQUEST_SIZE_MATCH(xRRGetScreenInfoReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->window);
|
|
return (*ProcRandrVector[stuff->randrReqType]) (client);
|
|
@@ -69,6 +71,7 @@
|
|
{
|
|
REQUEST(xRRSelectInputReq);
|
|
|
|
+ REQUEST_SIZE_MATCH(xRRSelectInputReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->window);
|
|
swaps(&stuff->enable);
|
|
@@ -152,6 +155,7 @@
|
|
{
|
|
REQUEST(xRRConfigureOutputPropertyReq);
|
|
|
|
+ REQUEST_AT_LEAST_SIZE(xRRConfigureOutputPropertyReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->output);
|
|
swapl(&stuff->property);
|
|
diff -Naur xorg-server-1.12.4.orig/render/render.c xorg-server-1.12.4/render/render.c
|
|
--- xorg-server-1.12.4.orig/render/render.c 2012-08-02 02:59:23.000000000 +0200
|
|
+++ xorg-server-1.12.4/render/render.c 2014-11-28 09:51:16.878004670 +0100
|
|
@@ -1994,7 +1994,7 @@
|
|
SProcRenderQueryVersion(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderQueryVersionReq);
|
|
-
|
|
+ REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->majorVersion);
|
|
swapl(&stuff->minorVersion);
|
|
@@ -2005,6 +2005,7 @@
|
|
SProcRenderQueryPictFormats(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderQueryPictFormatsReq);
|
|
+ REQUEST_SIZE_MATCH(xRenderQueryPictFormatsReq);
|
|
swaps(&stuff->length);
|
|
return (*ProcRenderVector[stuff->renderReqType]) (client);
|
|
}
|
|
@@ -2013,6 +2014,7 @@
|
|
SProcRenderQueryPictIndexValues(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderQueryPictIndexValuesReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xRenderQueryPictIndexValuesReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->format);
|
|
return (*ProcRenderVector[stuff->renderReqType]) (client);
|
|
@@ -2028,6 +2030,7 @@
|
|
SProcRenderCreatePicture(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderCreatePictureReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xRenderCreatePictureReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->pid);
|
|
swapl(&stuff->drawable);
|
|
@@ -2041,6 +2044,7 @@
|
|
SProcRenderChangePicture(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderChangePictureReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->picture);
|
|
swapl(&stuff->mask);
|
|
@@ -2052,6 +2056,7 @@
|
|
SProcRenderSetPictureClipRectangles(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderSetPictureClipRectanglesReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->picture);
|
|
swaps(&stuff->xOrigin);
|
|
@@ -2064,6 +2069,7 @@
|
|
SProcRenderFreePicture(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderFreePictureReq);
|
|
+ REQUEST_SIZE_MATCH(xRenderFreePictureReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->picture);
|
|
return (*ProcRenderVector[stuff->renderReqType]) (client);
|
|
@@ -2073,6 +2079,7 @@
|
|
SProcRenderComposite(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderCompositeReq);
|
|
+ REQUEST_SIZE_MATCH(xRenderCompositeReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->src);
|
|
swapl(&stuff->mask);
|
|
@@ -2092,6 +2099,7 @@
|
|
SProcRenderScale(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderScaleReq);
|
|
+ REQUEST_SIZE_MATCH(xRenderScaleReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->src);
|
|
swapl(&stuff->dst);
|
|
@@ -2192,6 +2200,7 @@
|
|
SProcRenderCreateGlyphSet(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderCreateGlyphSetReq);
|
|
+ REQUEST_SIZE_MATCH(xRenderCreateGlyphSetReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->gsid);
|
|
swapl(&stuff->format);
|
|
@@ -2202,6 +2211,7 @@
|
|
SProcRenderReferenceGlyphSet(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderReferenceGlyphSetReq);
|
|
+ REQUEST_SIZE_MATCH(xRenderReferenceGlyphSetReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->gsid);
|
|
swapl(&stuff->existing);
|
|
@@ -2212,6 +2222,7 @@
|
|
SProcRenderFreeGlyphSet(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderFreeGlyphSetReq);
|
|
+ REQUEST_SIZE_MATCH(xRenderFreeGlyphSetReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->glyphset);
|
|
return (*ProcRenderVector[stuff->renderReqType]) (client);
|
|
@@ -2226,6 +2237,7 @@
|
|
xGlyphInfo *gi;
|
|
|
|
REQUEST(xRenderAddGlyphsReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xRenderAddGlyphsReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->glyphset);
|
|
swapl(&stuff->nglyphs);
|
|
@@ -2260,6 +2272,7 @@
|
|
SProcRenderFreeGlyphs(ClientPtr client)
|
|
{
|
|
REQUEST(xRenderFreeGlyphsReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xRenderFreeGlyphsReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->glyphset);
|
|
SwapRestL(stuff);
|
|
@@ -2277,6 +2290,7 @@
|
|
int size;
|
|
|
|
REQUEST(xRenderCompositeGlyphsReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xRenderCompositeGlyphsReq);
|
|
|
|
switch (stuff->renderReqType) {
|
|
default:
|
|
diff -Naur xorg-server-1.12.4.orig/test/misc.c xorg-server-1.12.4/test/misc.c
|
|
--- xorg-server-1.12.4.orig/test/misc.c 2012-05-17 19:09:05.000000000 +0200
|
|
+++ xorg-server-1.12.4/test/misc.c 2014-11-28 09:51:33.354188205 +0100
|
|
@@ -28,6 +28,8 @@
|
|
#include <stdint.h>
|
|
#include "misc.h"
|
|
#include "scrnintstr.h"
|
|
+#include "dix.h"
|
|
+#include "dixstruct.h"
|
|
|
|
ScreenInfo screenInfo;
|
|
|
|
@@ -155,11 +157,46 @@
|
|
assert_dimensions(-w2, -h2, w2, h2);
|
|
}
|
|
|
|
+static int
|
|
+dix_request_fixed_size_overflow(ClientRec *client)
|
|
+{
|
|
+ xReq req = { 0 };
|
|
+
|
|
+ client->req_len = req.length = 1;
|
|
+ REQUEST_FIXED_SIZE(req, SIZE_MAX);
|
|
+ return Success;
|
|
+}
|
|
+
|
|
+static int
|
|
+dix_request_fixed_size_match(ClientRec *client)
|
|
+{
|
|
+ xReq req = { 0 };
|
|
+
|
|
+ client->req_len = req.length = 9;
|
|
+ REQUEST_FIXED_SIZE(req, 30);
|
|
+ return Success;
|
|
+}
|
|
+
|
|
+static void
|
|
+dix_request_size_checks(void)
|
|
+{
|
|
+ ClientRec client = { 0 };
|
|
+ int rc;
|
|
+
|
|
+ rc = dix_request_fixed_size_overflow(&client);
|
|
+ assert(rc == BadLength);
|
|
+
|
|
+ rc = dix_request_fixed_size_match(&client);
|
|
+ assert(rc == Success);
|
|
+}
|
|
+
|
|
+
|
|
int
|
|
main(int argc, char **argv)
|
|
{
|
|
dix_version_compare();
|
|
dix_update_desktop_dimensions();
|
|
+ dix_request_size_checks();
|
|
|
|
return 0;
|
|
}
|
|
diff -Naur xorg-server-1.12.4.orig/test/xi2/protocol-xigetclientpointer.c xorg-server-1.12.4/test/xi2/protocol-xigetclientpointer.c
|
|
--- xorg-server-1.12.4.orig/test/xi2/protocol-xigetclientpointer.c 2012-05-17 19:09:05.000000000 +0200
|
|
+++ xorg-server-1.12.4/test/xi2/protocol-xigetclientpointer.c 2014-11-28 09:51:28.970139371 +0100
|
|
@@ -124,6 +124,11 @@
|
|
request.win = INVALID_WINDOW_ID;
|
|
request_XIGetClientPointer(&client_request, &request, BadWindow);
|
|
|
|
+ printf("Testing invalid length\n");
|
|
+ client_request.req_len -= 4;
|
|
+ request_XIGetClientPointer(&client_request, &request, BadLength);
|
|
+ client_request.req_len += 4;
|
|
+
|
|
test_data.cp_is_set = FALSE;
|
|
|
|
printf("Testing window None, unset ClientPointer.\n");
|
|
diff -Naur xorg-server-1.12.4.orig/test/xi2/protocol-xipassivegrabdevice.c xorg-server-1.12.4/test/xi2/protocol-xipassivegrabdevice.c
|
|
--- xorg-server-1.12.4.orig/test/xi2/protocol-xipassivegrabdevice.c 2012-05-17 19:09:05.000000000 +0200
|
|
+++ xorg-server-1.12.4/test/xi2/protocol-xipassivegrabdevice.c 2014-11-28 09:51:28.970139371 +0100
|
|
@@ -137,6 +137,7 @@
|
|
int rc;
|
|
int modifiers;
|
|
|
|
+ client_request.req_len = req->length;
|
|
rc = ProcXIPassiveGrabDevice(&client_request);
|
|
assert(rc == error);
|
|
|
|
@@ -187,6 +188,13 @@
|
|
request_XIPassiveGrabDevice(&client_request, request, BadDevice,
|
|
request->deviceid);
|
|
|
|
+ printf("Testing invalid length\n");
|
|
+ request->length -= 2;
|
|
+ request_XIPassiveGrabDevice(&client_request, request, BadLength,
|
|
+ client_request.errorValue);
|
|
+ /* re-init request since swapped length test leaves some values swapped */
|
|
+ request_init(request, XIPassiveGrabDevice);
|
|
+ request->grab_window = CLIENT_WINDOW_ID;
|
|
request->deviceid = XIAllMasterDevices;
|
|
|
|
printf("Testing invalid grab types\n");
|
|
diff -Naur xorg-server-1.12.4.orig/test/xi2/protocol-xiquerypointer.c xorg-server-1.12.4/test/xi2/protocol-xiquerypointer.c
|
|
--- xorg-server-1.12.4.orig/test/xi2/protocol-xiquerypointer.c 2012-05-17 19:09:05.000000000 +0200
|
|
+++ xorg-server-1.12.4/test/xi2/protocol-xiquerypointer.c 2014-11-28 09:51:28.970139371 +0100
|
|
@@ -200,6 +200,10 @@
|
|
test_data.dev = devices.mouse;
|
|
request.deviceid = devices.mouse->id;
|
|
request_XIQueryPointer(&client_request, &request, Success);
|
|
+
|
|
+ /* test REQUEST_SIZE_MATCH */
|
|
+ client_request.req_len -= 4;
|
|
+ request_XIQueryPointer(&client_request, &request, BadLength);
|
|
}
|
|
|
|
int
|
|
diff -Naur xorg-server-1.12.4.orig/test/xi2/protocol-xiwarppointer.c xorg-server-1.12.4/test/xi2/protocol-xiwarppointer.c
|
|
--- xorg-server-1.12.4.orig/test/xi2/protocol-xiwarppointer.c 2012-05-17 19:09:05.000000000 +0200
|
|
+++ xorg-server-1.12.4/test/xi2/protocol-xiwarppointer.c 2014-11-28 09:51:28.974139415 +0100
|
|
@@ -197,6 +197,9 @@
|
|
request_XIWarpPointer(&client_request, &request, Success);
|
|
|
|
/* FIXME: src_x/y checks */
|
|
+
|
|
+ client_request.req_len -= 2; /* invalid length */
|
|
+ request_XIWarpPointer(&client_request, &request, BadLength);
|
|
}
|
|
|
|
int
|
|
diff -Naur xorg-server-1.12.4.orig/Xext/xcmisc.c xorg-server-1.12.4/Xext/xcmisc.c
|
|
--- xorg-server-1.12.4.orig/Xext/xcmisc.c 2012-05-17 19:09:01.000000000 +0200
|
|
+++ xorg-server-1.12.4/Xext/xcmisc.c 2014-11-28 09:51:03.837859407 +0100
|
|
@@ -161,6 +161,7 @@
|
|
SProcXCMiscGetXIDList(ClientPtr client)
|
|
{
|
|
REQUEST(xXCMiscGetXIDListReq);
|
|
+ REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
|
|
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->count);
|
|
diff -Naur xorg-server-1.12.4.orig/Xext/xvdisp.c xorg-server-1.12.4/Xext/xvdisp.c
|
|
--- xorg-server-1.12.4.orig/Xext/xvdisp.c 2012-05-17 19:09:01.000000000 +0200
|
|
+++ xorg-server-1.12.4/Xext/xvdisp.c 2014-11-28 09:51:07.413899243 +0100
|
|
@@ -1202,6 +1202,7 @@
|
|
SProcXvQueryExtension(ClientPtr client)
|
|
{
|
|
REQUEST(xvQueryExtensionReq);
|
|
+ REQUEST_SIZE_MATCH(xvQueryExtensionReq);
|
|
swaps(&stuff->length);
|
|
return XvProcVector[xv_QueryExtension] (client);
|
|
}
|
|
@@ -1210,6 +1211,7 @@
|
|
SProcXvQueryAdaptors(ClientPtr client)
|
|
{
|
|
REQUEST(xvQueryAdaptorsReq);
|
|
+ REQUEST_SIZE_MATCH(xvQueryAdaptorsReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->window);
|
|
return XvProcVector[xv_QueryAdaptors] (client);
|
|
@@ -1219,6 +1221,7 @@
|
|
SProcXvQueryEncodings(ClientPtr client)
|
|
{
|
|
REQUEST(xvQueryEncodingsReq);
|
|
+ REQUEST_SIZE_MATCH(xvQueryEncodingsReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
return XvProcVector[xv_QueryEncodings] (client);
|
|
@@ -1228,6 +1231,7 @@
|
|
SProcXvGrabPort(ClientPtr client)
|
|
{
|
|
REQUEST(xvGrabPortReq);
|
|
+ REQUEST_SIZE_MATCH(xvGrabPortReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->time);
|
|
@@ -1238,6 +1242,7 @@
|
|
SProcXvUngrabPort(ClientPtr client)
|
|
{
|
|
REQUEST(xvUngrabPortReq);
|
|
+ REQUEST_SIZE_MATCH(xvUngrabPortReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->time);
|
|
@@ -1248,6 +1253,7 @@
|
|
SProcXvPutVideo(ClientPtr client)
|
|
{
|
|
REQUEST(xvPutVideoReq);
|
|
+ REQUEST_SIZE_MATCH(xvPutVideoReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->drawable);
|
|
@@ -1267,6 +1273,7 @@
|
|
SProcXvPutStill(ClientPtr client)
|
|
{
|
|
REQUEST(xvPutStillReq);
|
|
+ REQUEST_SIZE_MATCH(xvPutStillReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->drawable);
|
|
@@ -1286,6 +1293,7 @@
|
|
SProcXvGetVideo(ClientPtr client)
|
|
{
|
|
REQUEST(xvGetVideoReq);
|
|
+ REQUEST_SIZE_MATCH(xvGetVideoReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->drawable);
|
|
@@ -1305,6 +1313,7 @@
|
|
SProcXvGetStill(ClientPtr client)
|
|
{
|
|
REQUEST(xvGetStillReq);
|
|
+ REQUEST_SIZE_MATCH(xvGetStillReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->drawable);
|
|
@@ -1324,6 +1333,7 @@
|
|
SProcXvPutImage(ClientPtr client)
|
|
{
|
|
REQUEST(xvPutImageReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xvPutImageReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->drawable);
|
|
@@ -1347,6 +1357,7 @@
|
|
SProcXvShmPutImage(ClientPtr client)
|
|
{
|
|
REQUEST(xvShmPutImageReq);
|
|
+ REQUEST_SIZE_MATCH(xvShmPutImageReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->drawable);
|
|
@@ -1374,6 +1385,7 @@
|
|
SProcXvSelectVideoNotify(ClientPtr client)
|
|
{
|
|
REQUEST(xvSelectVideoNotifyReq);
|
|
+ REQUEST_SIZE_MATCH(xvSelectVideoNotifyReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->drawable);
|
|
return XvProcVector[xv_SelectVideoNotify] (client);
|
|
@@ -1383,6 +1395,7 @@
|
|
SProcXvSelectPortNotify(ClientPtr client)
|
|
{
|
|
REQUEST(xvSelectPortNotifyReq);
|
|
+ REQUEST_SIZE_MATCH(xvSelectPortNotifyReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
return XvProcVector[xv_SelectPortNotify] (client);
|
|
@@ -1392,6 +1405,7 @@
|
|
SProcXvStopVideo(ClientPtr client)
|
|
{
|
|
REQUEST(xvStopVideoReq);
|
|
+ REQUEST_SIZE_MATCH(xvStopVideoReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->drawable);
|
|
@@ -1402,6 +1416,7 @@
|
|
SProcXvSetPortAttribute(ClientPtr client)
|
|
{
|
|
REQUEST(xvSetPortAttributeReq);
|
|
+ REQUEST_SIZE_MATCH(xvSetPortAttributeReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->attribute);
|
|
@@ -1413,6 +1428,7 @@
|
|
SProcXvGetPortAttribute(ClientPtr client)
|
|
{
|
|
REQUEST(xvGetPortAttributeReq);
|
|
+ REQUEST_SIZE_MATCH(xvGetPortAttributeReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->attribute);
|
|
@@ -1423,6 +1439,7 @@
|
|
SProcXvQueryBestSize(ClientPtr client)
|
|
{
|
|
REQUEST(xvQueryBestSizeReq);
|
|
+ REQUEST_SIZE_MATCH(xvQueryBestSizeReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swaps(&stuff->vid_w);
|
|
@@ -1436,6 +1453,7 @@
|
|
SProcXvQueryPortAttributes(ClientPtr client)
|
|
{
|
|
REQUEST(xvQueryPortAttributesReq);
|
|
+ REQUEST_SIZE_MATCH(xvQueryPortAttributesReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
return XvProcVector[xv_QueryPortAttributes] (client);
|
|
@@ -1445,6 +1463,7 @@
|
|
SProcXvQueryImageAttributes(ClientPtr client)
|
|
{
|
|
REQUEST(xvQueryImageAttributesReq);
|
|
+ REQUEST_SIZE_MATCH(xvQueryImageAttributesReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
swapl(&stuff->id);
|
|
@@ -1457,6 +1476,7 @@
|
|
SProcXvListImageFormats(ClientPtr client)
|
|
{
|
|
REQUEST(xvListImageFormatsReq);
|
|
+ REQUEST_SIZE_MATCH(xvListImageFormatsReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->port);
|
|
return XvProcVector[xv_ListImageFormats] (client);
|
|
diff -Naur xorg-server-1.12.4.orig/xfixes/select.c xorg-server-1.12.4/xfixes/select.c
|
|
--- xorg-server-1.12.4.orig/xfixes/select.c 2012-05-17 19:09:05.000000000 +0200
|
|
+++ xorg-server-1.12.4/xfixes/select.c 2014-11-28 09:51:22.470066963 +0100
|
|
@@ -204,6 +204,7 @@
|
|
{
|
|
REQUEST(xXFixesSelectSelectionInputReq);
|
|
|
|
+ REQUEST_SIZE_MATCH(xXFixesSelectSelectionInputReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->window);
|
|
swapl(&stuff->selection);
|
|
diff -aur xorg-server-1.12.4.orig/render/render.c xorg-server-1.12.4/render/render.c
|
|
--- xorg-server-1.12.4.orig/render/render.c 2014-11-28 09:51:16.878004670 +0100
|
|
+++ xorg-server-1.12.4/render/render.c 2014-11-28 10:00:10.899950898 +0100
|
|
@@ -271,10 +271,11 @@
|
|
|
|
REQUEST(xRenderQueryVersionReq);
|
|
|
|
+ REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
|
|
+
|
|
pRenderClient->major_version = stuff->majorVersion;
|
|
pRenderClient->minor_version = stuff->minorVersion;
|
|
|
|
- REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
|
|
memset(&rep, 0, sizeof(xRenderQueryVersionReply));
|
|
rep.type = X_Reply;
|
|
rep.length = 0;
|
|
diff -Naur xorg-server-1.12.4.orig/glx/glxcmds.c xorg-server-1.12.4/glx/glxcmds.c
|
|
--- xorg-server-1.12.4.orig/glx/glxcmds.c 2014-11-28 10:01:44.068987817 +0100
|
|
+++ xorg-server-1.12.4/glx/glxcmds.c 2014-11-28 10:05:07.515246883 +0100
|
|
@@ -2032,6 +2032,8 @@
|
|
|
|
__GLX_DECLARE_SWAP_VARIABLES;
|
|
|
|
+ REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq);
|
|
+
|
|
req = (xGLXRenderLargeReq *) pc;
|
|
if (client->swapped) {
|
|
__GLX_SWAP_SHORT(&req->length);
|
|
@@ -2047,12 +2049,14 @@
|
|
__glXResetLargeCommandStatus(cl);
|
|
return error;
|
|
}
|
|
+ if (safe_pad(req->dataBytes) < 0)
|
|
+ return BadLength;
|
|
dataBytes = req->dataBytes;
|
|
|
|
/*
|
|
** Check the request length.
|
|
*/
|
|
- if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) {
|
|
+ if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) {
|
|
client->errorValue = req->length;
|
|
/* Reset in case this isn't 1st request. */
|
|
__glXResetLargeCommandStatus(cl);
|
|
@@ -2062,7 +2066,7 @@
|
|
|
|
if (cl->largeCmdRequestsSoFar == 0) {
|
|
__GLXrenderSizeData entry;
|
|
- int extra;
|
|
+ int extra = 0;
|
|
size_t cmdlen;
|
|
int err;
|
|
|
|
@@ -2075,13 +2079,17 @@
|
|
return __glXError(GLXBadLargeRequest);
|
|
}
|
|
|
|
+ if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE)
|
|
+ return BadLength;
|
|
+
|
|
hdr = (__GLXrenderLargeHeader *) pc;
|
|
if (client->swapped) {
|
|
__GLX_SWAP_INT(&hdr->length);
|
|
__GLX_SWAP_INT(&hdr->opcode);
|
|
}
|
|
- cmdlen = hdr->length;
|
|
opcode = hdr->opcode;
|
|
+ if ((cmdlen = safe_pad(hdr->length)) < 0)
|
|
+ return BadLength;
|
|
|
|
/*
|
|
** Check for core opcodes and grab entry data.
|
|
@@ -2103,17 +2111,13 @@
|
|
if (extra < 0) {
|
|
return BadLength;
|
|
}
|
|
- /* large command's header is 4 bytes longer, so add 4 */
|
|
- if (cmdlen != __GLX_PAD(entry.bytes + 4 + extra)) {
|
|
- return BadLength;
|
|
- }
|
|
}
|
|
- else {
|
|
- /* constant size command */
|
|
- if (cmdlen != __GLX_PAD(entry.bytes + 4)) {
|
|
- return BadLength;
|
|
- }
|
|
+
|
|
+ /* the +4 is safe because we know entry.bytes is small */
|
|
+ if (cmdlen != safe_pad(safe_add(entry.bytes + 4, extra))) {
|
|
+ return BadLength;
|
|
}
|
|
+
|
|
/*
|
|
** Make enough space in the buffer, then copy the entire request.
|
|
*/
|
|
@@ -2143,6 +2147,7 @@
|
|
** We are receiving subsequent (i.e. not the first) requests of a
|
|
** multi request command.
|
|
*/
|
|
+ int bytesSoFar; /* including this packet */
|
|
|
|
/*
|
|
** Check the request number and the total request count.
|
|
@@ -2161,11 +2166,18 @@
|
|
/*
|
|
** Check that we didn't get too much data.
|
|
*/
|
|
- if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) {
|
|
+ if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) {
|
|
client->errorValue = dataBytes;
|
|
__glXResetLargeCommandStatus(cl);
|
|
return __glXError(GLXBadLargeRequest);
|
|
}
|
|
+
|
|
+ if (bytesSoFar > cl->largeCmdBytesTotal) {
|
|
+ client->errorValue = dataBytes;
|
|
+ __glXResetLargeCommandStatus(cl);
|
|
+ return __glXError(GLXBadLargeRequest);
|
|
+ }
|
|
+
|
|
memcpy(cl->largeCmdBuf + cl->largeCmdBytesSoFar, pc, dataBytes);
|
|
cl->largeCmdBytesSoFar += dataBytes;
|
|
cl->largeCmdRequestsSoFar++;
|
|
@@ -2186,8 +2198,7 @@
|
|
** the padding done below fixes a bug that did not allow
|
|
** large commands of odd sizes to be accepted by the server.
|
|
*/
|
|
- if (__GLX_PAD(cl->largeCmdBytesSoFar) !=
|
|
- __GLX_PAD(cl->largeCmdBytesTotal)) {
|
|
+ if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) {
|
|
client->errorValue = dataBytes;
|
|
__glXResetLargeCommandStatus(cl);
|
|
return __glXError(GLXBadLargeRequest);
|
|
diff -Naur xorg-server-1.12.4.orig/glx/indirect_texture_compression.c xorg-server-1.12.4/glx/indirect_texture_compression.c
|
|
--- xorg-server-1.12.4.orig/glx/indirect_texture_compression.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/indirect_texture_compression.c 2014-11-28 10:26:39.461548117 +0100
|
|
@@ -47,6 +47,8 @@
|
|
__GLXcontext *const cx = __glXForceCurrent(cl, req->contextTag, &error);
|
|
ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
|
|
+
|
|
pc += __GLX_SINGLE_HDR_SIZE;
|
|
if (cx != NULL) {
|
|
const GLenum target = *(GLenum *) (pc + 0);
|
|
@@ -93,6 +95,8 @@
|
|
__glXForceCurrent(cl, bswap_32(req->contextTag), &error);
|
|
ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
|
|
+
|
|
pc += __GLX_SINGLE_HDR_SIZE;
|
|
if (cx != NULL) {
|
|
const GLenum target = (GLenum) bswap_32(*(int *) (pc + 0));
|
|
diff -Naur xorg-server-1.12.4.orig/glx/single2.c xorg-server-1.12.4/glx/single2.c
|
|
--- xorg-server-1.12.4.orig/glx/single2.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/single2.c 2014-11-28 10:26:39.461548117 +0100
|
|
@@ -49,11 +49,14 @@
|
|
int
|
|
__glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
GLsizei size;
|
|
GLenum type;
|
|
__GLXcontext *cx;
|
|
int error;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -80,10 +83,13 @@
|
|
int
|
|
__glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
GLsizei size;
|
|
int error;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -108,7 +114,7 @@
|
|
int
|
|
__glXDisp_RenderMode(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
- ClientPtr client;
|
|
+ ClientPtr client = cl->client;
|
|
xGLXRenderModeReply reply;
|
|
__GLXcontext *cx;
|
|
GLint nitems = 0, retBytes = 0, retval, newModeCheck;
|
|
@@ -116,6 +122,8 @@
|
|
GLenum newMode;
|
|
int error;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -192,7 +200,6 @@
|
|
** selection array, as per the API for glRenderMode itself.
|
|
*/
|
|
noChangeAllowed:;
|
|
- client = cl->client;
|
|
reply.length = nitems;
|
|
reply.type = X_Reply;
|
|
reply.sequenceNumber = client->sequence;
|
|
@@ -209,9 +216,12 @@
|
|
int
|
|
__glXDisp_Flush(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
int error;
|
|
|
|
+ REQUEST_SIZE_MATCH(xGLXSingleReq);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -225,10 +235,12 @@
|
|
int
|
|
__glXDisp_Finish(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
- ClientPtr client;
|
|
int error;
|
|
|
|
+ REQUEST_SIZE_MATCH(xGLXSingleReq);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -319,7 +331,7 @@
|
|
int
|
|
DoGetString(__GLXclientState * cl, GLbyte * pc, GLboolean need_swap)
|
|
{
|
|
- ClientPtr client;
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
GLenum name;
|
|
const char *string;
|
|
@@ -329,6 +341,8 @@
|
|
char *buf = NULL, *buf1 = NULL;
|
|
GLint length = 0;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
|
|
+
|
|
/* If the client has the opposite byte order, swap the contextTag and
|
|
* the name.
|
|
*/
|
|
@@ -345,7 +359,6 @@
|
|
pc += __GLX_SINGLE_HDR_SIZE;
|
|
name = *(GLenum *) (pc + 0);
|
|
string = (const char *) CALL_GetString(GET_DISPATCH(), (name));
|
|
- client = cl->client;
|
|
|
|
if (string == NULL)
|
|
string = "";
|
|
diff -Naur xorg-server-1.12.4.orig/glx/single2swap.c xorg-server-1.12.4/glx/single2swap.c
|
|
--- xorg-server-1.12.4.orig/glx/single2swap.c 2012-05-17 19:09:02.000000000 +0200
|
|
+++ xorg-server-1.12.4/glx/single2swap.c 2014-11-28 10:26:39.465548161 +0100
|
|
@@ -45,6 +45,7 @@
|
|
int
|
|
__glXDispSwap_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
GLsizei size;
|
|
GLenum type;
|
|
|
|
@@ -52,6 +53,8 @@
|
|
__GLXcontext *cx;
|
|
int error;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 8);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -81,12 +84,15 @@
|
|
int
|
|
__glXDispSwap_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
GLsizei size;
|
|
|
|
__GLX_DECLARE_SWAP_VARIABLES;
|
|
int error;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -113,7 +119,7 @@
|
|
int
|
|
__glXDispSwap_RenderMode(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
- ClientPtr client;
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
xGLXRenderModeReply reply;
|
|
GLint nitems = 0, retBytes = 0, retval, newModeCheck;
|
|
@@ -124,6 +130,8 @@
|
|
__GLX_DECLARE_SWAP_ARRAY_VARIABLES;
|
|
int error;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -204,7 +212,6 @@
|
|
** selection array, as per the API for glRenderMode itself.
|
|
*/
|
|
noChangeAllowed:;
|
|
- client = cl->client;
|
|
reply.length = nitems;
|
|
reply.type = X_Reply;
|
|
reply.sequenceNumber = client->sequence;
|
|
@@ -226,11 +233,14 @@
|
|
int
|
|
__glXDispSwap_Flush(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
int error;
|
|
|
|
__GLX_DECLARE_SWAP_VARIABLES;
|
|
|
|
+ REQUEST_SIZE_MATCH(xGLXSingleReq);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -245,12 +255,14 @@
|
|
int
|
|
__glXDispSwap_Finish(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
+ ClientPtr client = cl->client;
|
|
__GLXcontext *cx;
|
|
- ClientPtr client;
|
|
int error;
|
|
|
|
__GLX_DECLARE_SWAP_VARIABLES;
|
|
|
|
+ REQUEST_SIZE_MATCH(xGLXSingleReq);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -262,7 +274,6 @@
|
|
cx->hasUnflushedCommands = GL_FALSE;
|
|
|
|
/* Send empty reply packet to indicate finish is finished */
|
|
- client = cl->client;
|
|
__GLX_BEGIN_REPLY(0);
|
|
__GLX_PUT_RETVAL(0);
|
|
__GLX_SWAP_REPLY_HEADER();
|
|
diff -Naur xorg-server-1.12.4.orig/glx/singlepix.c xorg-server-1.12.4/glx/singlepix.c
|
|
--- xorg-server-1.12.4.orig/glx/singlepix.c 2014-11-28 10:06:28.116140360 +0100
|
|
+++ xorg-server-1.12.4/glx/singlepix.c 2014-11-28 10:26:39.465548161 +0100
|
|
@@ -55,6 +55,8 @@
|
|
int error;
|
|
char *answer, answerBuffer[200];
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 28);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -107,6 +109,8 @@
|
|
char *answer, answerBuffer[200];
|
|
GLint width = 0, height = 0, depth = 1;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 20);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -169,6 +173,8 @@
|
|
GLubyte answerBuffer[200];
|
|
char *answer;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
|
|
+
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
return error;
|
|
@@ -231,15 +237,15 @@
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
|
|
compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
|
|
|
|
- if (compsize < 0)
|
|
+ if ((compsize = safe_pad(compsize)) < 0)
|
|
return BadLength;
|
|
- if (compsize2 < 0)
|
|
+
|
|
+ if ((compsize2 = safe_pad(compsize2)) < 0)
|
|
return BadLength;
|
|
- compsize = __GLX_PAD(compsize);
|
|
- compsize2 = __GLX_PAD(compsize2);
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, swapBytes));
|
|
- __GLX_GET_ANSWER_BUFFER(answer, cl, compsize + compsize2, 1);
|
|
+ __GLX_GET_ANSWER_BUFFER(answer, cl, safe_add(compsize, compsize2), 1);
|
|
+
|
|
__glXClearErrorOccured();
|
|
CALL_GetSeparableFilter(GET_DISPATCH(), (*(GLenum *) (pc + 0),
|
|
*(GLenum *) (pc + 4),
|
|
@@ -265,7 +271,8 @@
|
|
__glXDisp_GetSeparableFilter(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetSeparableFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -273,7 +280,8 @@
|
|
__glXDisp_GetSeparableFilterEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetSeparableFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -343,7 +351,8 @@
|
|
__glXDisp_GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetConvolutionFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -351,7 +360,8 @@
|
|
__glXDisp_GetConvolutionFilterEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetConvolutionFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -411,7 +421,8 @@
|
|
__glXDisp_GetHistogram(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetHistogram(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -419,7 +430,8 @@
|
|
__glXDisp_GetHistogramEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetHistogram(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -471,7 +483,8 @@
|
|
__glXDisp_GetMinmax(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetMinmax(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -479,7 +492,8 @@
|
|
__glXDisp_GetMinmaxEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetMinmax(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -540,7 +554,8 @@
|
|
__glXDisp_GetColorTable(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetColorTable(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -548,6 +563,7 @@
|
|
__glXDisp_GetColorTableSGI(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
-
|
|
+ ClientPtr client = cl->client;
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetColorTable(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
diff -Naur xorg-server-1.12.4.orig/glx/singlepixswap.c xorg-server-1.12.4/glx/singlepixswap.c
|
|
--- xorg-server-1.12.4.orig/glx/singlepixswap.c 2014-11-28 10:06:28.116140360 +0100
|
|
+++ xorg-server-1.12.4/glx/singlepixswap.c 2014-11-28 10:26:39.465548161 +0100
|
|
@@ -57,6 +57,8 @@
|
|
int error;
|
|
char *answer, answerBuffer[200];
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 28);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -122,6 +124,8 @@
|
|
char *answer, answerBuffer[200];
|
|
GLint width = 0, height = 0, depth = 1;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 20);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -197,6 +201,8 @@
|
|
|
|
__GLX_DECLARE_SWAP_VARIABLES;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 4);
|
|
+
|
|
__GLX_SWAP_INT(&((xGLXSingleReq *) pc)->contextTag);
|
|
cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error);
|
|
if (!cx) {
|
|
@@ -266,15 +272,13 @@
|
|
compsize = __glGetTexImage_size(target, 1, format, type, width, 1, 1);
|
|
compsize2 = __glGetTexImage_size(target, 1, format, type, height, 1, 1);
|
|
|
|
- if (compsize < 0)
|
|
+ if ((compsize = safe_pad(compsize)) < 0)
|
|
return BadLength;
|
|
- if (compsize2 < 0)
|
|
+ if ((compsize2 = safe_pad(compsize2)) < 0)
|
|
return BadLength;
|
|
- compsize = __GLX_PAD(compsize);
|
|
- compsize2 = __GLX_PAD(compsize2);
|
|
|
|
CALL_PixelStorei(GET_DISPATCH(), (GL_PACK_SWAP_BYTES, !swapBytes));
|
|
- __GLX_GET_ANSWER_BUFFER(answer, cl, compsize + compsize2, 1);
|
|
+ __GLX_GET_ANSWER_BUFFER(answer, cl, safe_add(compsize, compsize2), 1);
|
|
__glXClearErrorOccured();
|
|
CALL_GetSeparableFilter(GET_DISPATCH(), (*(GLenum *) (pc + 0),
|
|
*(GLenum *) (pc + 4),
|
|
@@ -302,7 +306,9 @@
|
|
__glXDispSwap_GetSeparableFilter(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetSeparableFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -310,7 +316,9 @@
|
|
__glXDispSwap_GetSeparableFilterEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetSeparableFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -388,7 +396,9 @@
|
|
__glXDispSwap_GetConvolutionFilter(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetConvolutionFilter(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -396,7 +406,9 @@
|
|
__glXDispSwap_GetConvolutionFilterEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetConvolutionFilter(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -463,7 +475,9 @@
|
|
__glXDispSwap_GetHistogram(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetHistogram(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -471,7 +485,9 @@
|
|
__glXDispSwap_GetHistogramEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetHistogram(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -529,7 +545,9 @@
|
|
__glXDispSwap_GetMinmax(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetMinmax(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -537,7 +555,9 @@
|
|
__glXDispSwap_GetMinmaxEXT(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetMinmax(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -605,7 +625,9 @@
|
|
__glXDispSwap_GetColorTable(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_SINGLE_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXSingleReq, 16);
|
|
return GetColorTable(cl, pc + __GLX_SINGLE_HDR_SIZE, tag);
|
|
}
|
|
|
|
@@ -613,6 +635,8 @@
|
|
__glXDispSwap_GetColorTableSGI(__GLXclientState * cl, GLbyte * pc)
|
|
{
|
|
const GLXContextTag tag = __GLX_GET_VENDPRIV_CONTEXT_TAG(pc);
|
|
+ ClientPtr client = cl->client;
|
|
|
|
+ REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 16);
|
|
return GetColorTable(cl, pc + __GLX_VENDPRIV_HDR_SIZE, tag);
|
|
}
|
|
diff --git a/Xi/chgdctl.c b/Xi/chgdctl.c
|
|
index ff5d69a..e87df42 100644
|
|
--- a/Xi/chgdctl.c
|
|
+++ b/Xi/chgdctl.c
|
|
@@ -78,7 +78,7 @@ SProcXChangeDeviceControl(ClientPtr client)
|
|
|
|
REQUEST(xChangeDeviceControlReq);
|
|
swaps(&stuff->length);
|
|
- REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq);
|
|
+ REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl));
|
|
swaps(&stuff->control);
|
|
ctl = (xDeviceCtl *) &stuff[1];
|
|
swaps(&ctl->control);
|
|
@@ -116,7 +116,7 @@ ProcXChangeDeviceControl(ClientPtr client)
|
|
devicePresenceNotify dpn;
|
|
|
|
REQUEST(xChangeDeviceControlReq);
|
|
- REQUEST_AT_LEAST_SIZE(xChangeDeviceControlReq);
|
|
+ REQUEST_AT_LEAST_EXTRA_SIZE(xChangeDeviceControlReq, sizeof(xDeviceCtl));
|
|
|
|
len = stuff->length - bytes_to_int32(sizeof(xChangeDeviceControlReq));
|
|
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixManageAccess);
|
|
@@ -184,6 +184,10 @@ ProcXChangeDeviceControl(ClientPtr client)
|
|
break;
|
|
case DEVICE_ENABLE:
|
|
e = (xDeviceEnableCtl *) &stuff[1];
|
|
+ if ((len != bytes_to_int32(sizeof(xDeviceEnableCtl)))) {
|
|
+ ret = BadLength;
|
|
+ goto out;
|
|
+ }
|
|
|
|
status = ChangeDeviceControl(client, dev, (xDeviceCtl *) e);
|
|
|
|
diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c
|
|
index 6dcf60c..224c2ba 100644
|
|
--- a/Xi/chgfctl.c
|
|
+++ b/Xi/chgfctl.c
|
|
@@ -467,6 +467,8 @@ ProcXChangeFeedbackControl(ClientPtr client)
|
|
xStringFeedbackCtl *f = ((xStringFeedbackCtl *) &stuff[1]);
|
|
|
|
if (client->swapped) {
|
|
+ if (len < bytes_to_int32(sizeof(xStringFeedbackCtl)))
|
|
+ return BadLength;
|
|
swaps(&f->num_keysyms);
|
|
}
|
|
if (len !=
|
|
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
|
|
index 3c21386..183f88d 100644
|
|
--- a/Xi/sendexev.c
|
|
+++ b/Xi/sendexev.c
|
|
@@ -135,6 +135,9 @@ ProcXSendExtensionEvent(ClientPtr client)
|
|
if (ret != Success)
|
|
return ret;
|
|
|
|
+ if (stuff->num_events == 0)
|
|
+ return ret;
|
|
+
|
|
/* The client's event type must be one defined by an extension. */
|
|
|
|
first = ((xEvent *) &stuff[1]);
|
|
diff --git a/Xi/xiallowev.c b/Xi/xiallowev.c
|
|
index 62a0727..156c738 100644
|
|
--- a/Xi/xiallowev.c
|
|
+++ b/Xi/xiallowev.c
|
|
@@ -48,6 +48,7 @@ int
|
|
SProcXIAllowEvents(ClientPtr client)
|
|
{
|
|
REQUEST(xXIAllowEventsReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xXIAllowEventsReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
@@ -55,6 +56,7 @@ SProcXIAllowEvents(ClientPtr client)
|
|
if (stuff->length > 3) {
|
|
xXI2_2AllowEventsReq *req_xi22 = (xXI2_2AllowEventsReq *) stuff;
|
|
|
|
+ REQUEST_AT_LEAST_SIZE(xXI2_2AllowEventsReq);
|
|
swapl(&req_xi22->touchid);
|
|
swapl(&req_xi22->grab_window);
|
|
}
|
|
diff --git a/Xi/xichangecursor.c b/Xi/xichangecursor.c
|
|
index 0be6bc0..33e9e9c 100644
|
|
--- a/Xi/xichangecursor.c
|
|
+++ b/Xi/xichangecursor.c
|
|
@@ -57,11 +57,11 @@ int
|
|
SProcXIChangeCursor(ClientPtr client)
|
|
{
|
|
REQUEST(xXIChangeCursorReq);
|
|
+ REQUEST_SIZE_MATCH(xXIChangeCursorReq);
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->win);
|
|
swapl(&stuff->cursor);
|
|
swaps(&stuff->deviceid);
|
|
- REQUEST_SIZE_MATCH(xXIChangeCursorReq);
|
|
return (ProcXIChangeCursor(client));
|
|
}
|
|
|
|
diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
|
|
index 756aaac..d2244cf 100644
|
|
--- a/Xi/xichangehierarchy.c
|
|
+++ b/Xi/xichangehierarchy.c
|
|
@@ -407,7 +407,7 @@ int
|
|
ProcXIChangeHierarchy(ClientPtr client)
|
|
{
|
|
xXIAnyHierarchyChangeInfo *any;
|
|
- int required_len = sizeof(xXIChangeHierarchyReq);
|
|
+ size_t len; /* length of data remaining in request */
|
|
int rc = Success;
|
|
int flags[MAXDEVICES] = { 0 };
|
|
|
|
@@ -417,21 +417,46 @@ ProcXIChangeHierarchy(ClientPtr client)
|
|
if (!stuff->num_changes)
|
|
return rc;
|
|
|
|
+ if (stuff->length > (INT_MAX >> 2))
|
|
+ return BadAlloc;
|
|
+ len = (stuff->length << 2) - sizeof(xXIAnyHierarchyChangeInfo);
|
|
+
|
|
any = (xXIAnyHierarchyChangeInfo *) &stuff[1];
|
|
while (stuff->num_changes--) {
|
|
+ if (len < sizeof(xXIAnyHierarchyChangeInfo)) {
|
|
+ rc = BadLength;
|
|
+ goto unwind;
|
|
+ }
|
|
+
|
|
SWAPIF(swaps(&any->type));
|
|
SWAPIF(swaps(&any->length));
|
|
|
|
- required_len += any->length;
|
|
- if ((stuff->length * 4) < required_len)
|
|
+ if ((any->length > (INT_MAX >> 2)) || (len < (any->length << 2)))
|
|
return BadLength;
|
|
|
|
+#define CHANGE_SIZE_MATCH(type) \
|
|
+ do { \
|
|
+ if ((len < sizeof(type)) || (any->length != (sizeof(type) >> 2))) { \
|
|
+ rc = BadLength; \
|
|
+ goto unwind; \
|
|
+ } \
|
|
+ } while(0)
|
|
+
|
|
switch (any->type) {
|
|
case XIAddMaster:
|
|
{
|
|
xXIAddMasterInfo *c = (xXIAddMasterInfo *) any;
|
|
|
|
+ /* Variable length, due to appended name string */
|
|
+ if (len < sizeof(xXIAddMasterInfo)) {
|
|
+ rc = BadLength;
|
|
+ goto unwind;
|
|
+ }
|
|
SWAPIF(swaps(&c->name_len));
|
|
+ if (c->name_len > (len - sizeof(xXIAddMasterInfo))) {
|
|
+ rc = BadLength;
|
|
+ goto unwind;
|
|
+ }
|
|
|
|
rc = add_master(client, c, flags);
|
|
if (rc != Success)
|
|
@@ -442,6 +467,7 @@ ProcXIChangeHierarchy(ClientPtr client)
|
|
{
|
|
xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any;
|
|
|
|
+ CHANGE_SIZE_MATCH(xXIRemoveMasterInfo);
|
|
rc = remove_master(client, r, flags);
|
|
if (rc != Success)
|
|
goto unwind;
|
|
@@ -451,6 +477,7 @@ ProcXIChangeHierarchy(ClientPtr client)
|
|
{
|
|
xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any;
|
|
|
|
+ CHANGE_SIZE_MATCH(xXIDetachSlaveInfo);
|
|
rc = detach_slave(client, c, flags);
|
|
if (rc != Success)
|
|
goto unwind;
|
|
@@ -460,6 +487,7 @@ ProcXIChangeHierarchy(ClientPtr client)
|
|
{
|
|
xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any;
|
|
|
|
+ CHANGE_SIZE_MATCH(xXIAttachSlaveInfo);
|
|
rc = attach_slave(client, c, flags);
|
|
if (rc != Success)
|
|
goto unwind;
|
|
@@ -467,6 +495,7 @@ ProcXIChangeHierarchy(ClientPtr client)
|
|
break;
|
|
}
|
|
|
|
+ len -= any->length * 4;
|
|
any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4);
|
|
}
|
|
|
|
diff --git a/Xi/xigetclientpointer.c b/Xi/xigetclientpointer.c
|
|
index 07dbf18..a066497 100644
|
|
--- a/Xi/xigetclientpointer.c
|
|
+++ b/Xi/xigetclientpointer.c
|
|
@@ -50,6 +50,7 @@ int
|
|
SProcXIGetClientPointer(ClientPtr client)
|
|
{
|
|
REQUEST(xXIGetClientPointerReq);
|
|
+ REQUEST_SIZE_MATCH(xXIGetClientPointerReq);
|
|
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->win);
|
|
diff --git a/Xi/xigrabdev.c b/Xi/xigrabdev.c
|
|
index 8d2cf0b..3dafbbd 100644
|
|
--- a/Xi/xigrabdev.c
|
|
+++ b/Xi/xigrabdev.c
|
|
@@ -47,6 +47,11 @@ int
|
|
SProcXIGrabDevice(ClientPtr client)
|
|
{
|
|
REQUEST(xXIGrabDeviceReq);
|
|
+ /*
|
|
+ * Check here for at least the length of the struct we swap, then
|
|
+ * let ProcXIGrabDevice check the full size after we swap mask_len.
|
|
+ */
|
|
+ REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
@@ -69,7 +74,7 @@ ProcXIGrabDevice(ClientPtr client)
|
|
int mask_len;
|
|
|
|
REQUEST(xXIGrabDeviceReq);
|
|
- REQUEST_AT_LEAST_SIZE(xXIGrabDeviceReq);
|
|
+ REQUEST_FIXED_SIZE(xXIGrabDeviceReq, ((size_t) stuff->mask_len) * 4);
|
|
|
|
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
|
|
if (ret != Success)
|
|
@@ -118,6 +123,7 @@ int
|
|
SProcXIUngrabDevice(ClientPtr client)
|
|
{
|
|
REQUEST(xXIUngrabDeviceReq);
|
|
+ REQUEST_SIZE_MATCH(xXIUngrabDeviceReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
@@ -135,6 +141,7 @@ ProcXIUngrabDevice(ClientPtr client)
|
|
TimeStamp time;
|
|
|
|
REQUEST(xXIUngrabDeviceReq);
|
|
+ REQUEST_SIZE_MATCH(xXIUngrabDeviceReq);
|
|
|
|
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixGetAttrAccess);
|
|
if (ret != Success)
|
|
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
|
|
index 7130328..06f44d7 100644
|
|
--- a/Xi/xipassivegrab.c
|
|
+++ b/Xi/xipassivegrab.c
|
|
@@ -53,6 +53,7 @@ SProcXIPassiveGrabDevice(ClientPtr client)
|
|
xXIModifierInfo *mods;
|
|
|
|
REQUEST(xXIPassiveGrabDeviceReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
@@ -63,7 +64,9 @@ SProcXIPassiveGrabDevice(ClientPtr client)
|
|
swaps(&stuff->mask_len);
|
|
swaps(&stuff->num_modifiers);
|
|
|
|
- mods = (xXIModifierInfo *) &stuff[1];
|
|
+ REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
|
|
+ ((uint32_t) stuff->mask_len + stuff->num_modifiers) *4);
|
|
+ mods = (uint32_t *) &stuff[1] + stuff->mask_len;
|
|
|
|
for (i = 0; i < stuff->num_modifiers; i++, mods++) {
|
|
swapl(&mods->base_mods);
|
|
@@ -88,7 +91,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
|
int mask_len;
|
|
|
|
REQUEST(xXIPassiveGrabDeviceReq);
|
|
- REQUEST_AT_LEAST_SIZE(xXIPassiveGrabDeviceReq);
|
|
+ REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
|
|
+ ((uint32_t) stuff->mask_len + stuff->num_modifiers) * 4);
|
|
|
|
if (stuff->deviceid == XIAllDevices)
|
|
dev = inputInfo.all_devices;
|
|
@@ -250,6 +254,7 @@ SProcXIPassiveUngrabDevice(ClientPtr client)
|
|
uint32_t *modifiers;
|
|
|
|
REQUEST(xXIPassiveUngrabDeviceReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq);
|
|
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->grab_window);
|
|
@@ -257,6 +262,8 @@ SProcXIPassiveUngrabDevice(ClientPtr client)
|
|
swapl(&stuff->detail);
|
|
swaps(&stuff->num_modifiers);
|
|
|
|
+ REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,
|
|
+ ((uint32_t) stuff->num_modifiers) << 2);
|
|
modifiers = (uint32_t *) &stuff[1];
|
|
|
|
for (i = 0; i < stuff->num_modifiers; i++, modifiers++)
|
|
@@ -275,7 +282,8 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
|
|
int i, rc;
|
|
|
|
REQUEST(xXIPassiveUngrabDeviceReq);
|
|
- REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq);
|
|
+ REQUEST_FIXED_SIZE(xXIPassiveUngrabDeviceReq,
|
|
+ ((uint32_t) stuff->num_modifiers) << 2);
|
|
|
|
if (stuff->deviceid == XIAllDevices)
|
|
dev = inputInfo.all_devices;
|
|
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
|
|
index e51aadb..37dc0c6 100644
|
|
--- a/Xi/xiproperty.c
|
|
+++ b/Xi/xiproperty.c
|
|
@@ -1007,10 +1007,9 @@ int
|
|
SProcXListDeviceProperties(ClientPtr client)
|
|
{
|
|
REQUEST(xListDevicePropertiesReq);
|
|
+ REQUEST_SIZE_MATCH(xListDevicePropertiesReq);
|
|
|
|
swaps(&stuff->length);
|
|
-
|
|
- REQUEST_SIZE_MATCH(xListDevicePropertiesReq);
|
|
return (ProcXListDeviceProperties(client));
|
|
}
|
|
|
|
@@ -1031,10 +1030,10 @@ int
|
|
SProcXDeleteDeviceProperty(ClientPtr client)
|
|
{
|
|
REQUEST(xDeleteDevicePropertyReq);
|
|
+ REQUEST_SIZE_MATCH(xDeleteDevicePropertyReq);
|
|
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->property);
|
|
- REQUEST_SIZE_MATCH(xDeleteDevicePropertyReq);
|
|
return (ProcXDeleteDeviceProperty(client));
|
|
}
|
|
|
|
@@ -1042,13 +1041,13 @@ int
|
|
SProcXGetDeviceProperty(ClientPtr client)
|
|
{
|
|
REQUEST(xGetDevicePropertyReq);
|
|
+ REQUEST_SIZE_MATCH(xGetDevicePropertyReq);
|
|
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->property);
|
|
swapl(&stuff->type);
|
|
swapl(&stuff->longOffset);
|
|
swapl(&stuff->longLength);
|
|
- REQUEST_SIZE_MATCH(xGetDevicePropertyReq);
|
|
return (ProcXGetDeviceProperty(client));
|
|
}
|
|
|
|
@@ -1243,11 +1242,10 @@ int
|
|
SProcXIListProperties(ClientPtr client)
|
|
{
|
|
REQUEST(xXIListPropertiesReq);
|
|
+ REQUEST_SIZE_MATCH(xXIListPropertiesReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
-
|
|
- REQUEST_SIZE_MATCH(xXIListPropertiesReq);
|
|
return (ProcXIListProperties(client));
|
|
}
|
|
|
|
@@ -1269,11 +1267,11 @@ int
|
|
SProcXIDeleteProperty(ClientPtr client)
|
|
{
|
|
REQUEST(xXIDeletePropertyReq);
|
|
+ REQUEST_SIZE_MATCH(xXIDeletePropertyReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
swapl(&stuff->property);
|
|
- REQUEST_SIZE_MATCH(xXIDeletePropertyReq);
|
|
return (ProcXIDeleteProperty(client));
|
|
}
|
|
|
|
@@ -1281,6 +1279,7 @@ int
|
|
SProcXIGetProperty(ClientPtr client)
|
|
{
|
|
REQUEST(xXIGetPropertyReq);
|
|
+ REQUEST_SIZE_MATCH(xXIGetPropertyReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
@@ -1288,7 +1287,6 @@ SProcXIGetProperty(ClientPtr client)
|
|
swapl(&stuff->type);
|
|
swapl(&stuff->offset);
|
|
swapl(&stuff->len);
|
|
- REQUEST_SIZE_MATCH(xXIGetPropertyReq);
|
|
return (ProcXIGetProperty(client));
|
|
}
|
|
|
|
diff --git a/Xi/xiquerydevice.c b/Xi/xiquerydevice.c
|
|
index 15c8b2a..5e5c875 100644
|
|
--- a/Xi/xiquerydevice.c
|
|
+++ b/Xi/xiquerydevice.c
|
|
@@ -54,6 +54,7 @@ int
|
|
SProcXIQueryDevice(ClientPtr client)
|
|
{
|
|
REQUEST(xXIQueryDeviceReq);
|
|
+ REQUEST_SIZE_MATCH(xXIQueryDeviceReq);
|
|
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
|
|
index 169436e..e61fa04 100644
|
|
--- a/Xi/xiquerypointer.c
|
|
+++ b/Xi/xiquerypointer.c
|
|
@@ -62,6 +62,8 @@ int
|
|
SProcXIQueryPointer(ClientPtr client)
|
|
{
|
|
REQUEST(xXIQueryPointerReq);
|
|
+ REQUEST_SIZE_MATCH(xXIQueryPointerReq);
|
|
+
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
swapl(&stuff->win);
|
|
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
|
|
index 07d3218..fc02034 100644
|
|
--- a/Xi/xiselectev.c
|
|
+++ b/Xi/xiselectev.c
|
|
@@ -63,6 +63,7 @@ int
|
|
SProcXISelectEvents(ClientPtr client)
|
|
{
|
|
int i;
|
|
+ int len;
|
|
xXIEventMask *evmask;
|
|
|
|
REQUEST(xXISelectEventsReq);
|
|
@@ -71,10 +72,17 @@ SProcXISelectEvents(ClientPtr client)
|
|
swapl(&stuff->win);
|
|
swaps(&stuff->num_masks);
|
|
|
|
+ len = stuff->length - bytes_to_int32(sizeof(xXISelectEventsReq));
|
|
evmask = (xXIEventMask *) &stuff[1];
|
|
for (i = 0; i < stuff->num_masks; i++) {
|
|
+ if (len < bytes_to_int32(sizeof(xXIEventMask)))
|
|
+ return BadLength;
|
|
+ len -= bytes_to_int32(sizeof(xXIEventMask));
|
|
swaps(&evmask->deviceid);
|
|
swaps(&evmask->mask_len);
|
|
+ if (len < evmask->mask_len)
|
|
+ return BadLength;
|
|
+ len -= evmask->mask_len;
|
|
evmask =
|
|
(xXIEventMask *) (((char *) &evmask[1]) + evmask->mask_len * 4);
|
|
}
|
|
diff --git a/Xi/xisetclientpointer.c b/Xi/xisetclientpointer.c
|
|
index 38ff51e..24d4a53 100644
|
|
--- a/Xi/xisetclientpointer.c
|
|
+++ b/Xi/xisetclientpointer.c
|
|
@@ -51,10 +51,11 @@ int
|
|
SProcXISetClientPointer(ClientPtr client)
|
|
{
|
|
REQUEST(xXISetClientPointerReq);
|
|
+ REQUEST_SIZE_MATCH(xXISetClientPointerReq);
|
|
+
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->win);
|
|
swaps(&stuff->deviceid);
|
|
- REQUEST_SIZE_MATCH(xXISetClientPointerReq);
|
|
return (ProcXISetClientPointer(client));
|
|
}
|
|
|
|
diff --git a/Xi/xisetdevfocus.c b/Xi/xisetdevfocus.c
|
|
index b52c9cc..a32ccb1 100644
|
|
--- a/Xi/xisetdevfocus.c
|
|
+++ b/Xi/xisetdevfocus.c
|
|
@@ -44,6 +44,8 @@ int
|
|
SProcXISetFocus(ClientPtr client)
|
|
{
|
|
REQUEST(xXISetFocusReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xXISetFocusReq);
|
|
+
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
swapl(&stuff->focus);
|
|
@@ -56,6 +58,8 @@ int
|
|
SProcXIGetFocus(ClientPtr client)
|
|
{
|
|
REQUEST(xXIGetFocusReq);
|
|
+ REQUEST_AT_LEAST_SIZE(xXIGetFocusReq);
|
|
+
|
|
swaps(&stuff->length);
|
|
swaps(&stuff->deviceid);
|
|
|
|
diff --git a/Xi/xiwarppointer.c b/Xi/xiwarppointer.c
|
|
index 3f051f7..780758a 100644
|
|
--- a/Xi/xiwarppointer.c
|
|
+++ b/Xi/xiwarppointer.c
|
|
@@ -56,6 +56,8 @@ int
|
|
SProcXIWarpPointer(ClientPtr client)
|
|
{
|
|
REQUEST(xXIWarpPointerReq);
|
|
+ REQUEST_SIZE_MATCH(xXIWarpPointerReq);
|
|
+
|
|
swaps(&stuff->length);
|
|
swapl(&stuff->src_win);
|
|
swapl(&stuff->dst_win);
|
|
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
|
|
index badc2cf..1479634 100644
|
|
--- a/glx/glxcmds.c
|
|
+++ b/glx/glxcmds.c
|
|
@@ -1990,7 +1990,8 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
|
|
if (entry.varsize) {
|
|
/* variable size command */
|
|
extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
|
|
- client->swapped);
|
|
+ client->swapped,
|
|
+ left - __GLX_RENDER_HDR_SIZE);
|
|
if (extra < 0) {
|
|
return BadLength;
|
|
}
|
|
@@ -2067,6 +2068,7 @@ __glXDisp_RenderLarge(__GLXclientState * cl, GLbyte * pc)
|
|
if (cl->largeCmdRequestsSoFar == 0) {
|
|
__GLXrenderSizeData entry;
|
|
int extra = 0;
|
|
+ int left = (req->length << 2) - sz_xGLXRenderLargeReq;
|
|
size_t cmdlen;
|
|
int err;
|
|
|
|
@@ -2107,7 +2109,8 @@ __glXDisp_RenderLarge(__GLXclientState * cl, GLbyte * pc)
|
|
** will be in the 1st request, so it's okay to do this.
|
|
*/
|
|
extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE,
|
|
- client->swapped);
|
|
+ client->swapped,
|
|
+ left - __GLX_RENDER_LARGE_HDR_SIZE);
|
|
if (extra < 0) {
|
|
return BadLength;
|
|
}
|
|
diff --git a/glx/glxserver.h b/glx/glxserver.h
|
|
index 9bffcd8..ccb895e 100644
|
|
--- a/glx/glxserver.h
|
|
+++ b/glx/glxserver.h
|
|
@@ -167,7 +167,7 @@ typedef int (*__GLXprocPtr) (__GLXclientState *, char *pc);
|
|
/*
|
|
* Tables for computing the size of each rendering command.
|
|
*/
|
|
-typedef int (*gl_proto_size_func) (const GLbyte *, Bool);
|
|
+typedef int (*gl_proto_size_func) (const GLbyte *, Bool, int);
|
|
|
|
typedef struct {
|
|
int bytes;
|
|
diff --git a/glx/indirect_reqsize.c b/glx/indirect_reqsize.c
|
|
index 86ea970..ce58214 100644
|
|
--- a/glx/indirect_reqsize.c
|
|
+++ b/glx/indirect_reqsize.c
|
|
@@ -31,24 +31,22 @@
|
|
#include "indirect_size.h"
|
|
#include "indirect_reqsize.h"
|
|
|
|
-#define __GLX_PAD(x) (((x) + 3) & ~3)
|
|
-
|
|
#if defined(__CYGWIN__) || defined(__MINGW32__)
|
|
#undef HAVE_ALIAS
|
|
#endif
|
|
#ifdef HAVE_ALIAS
|
|
#define ALIAS2(from,to) \
|
|
- GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
|
|
+ GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
|
|
__attribute__ ((alias( # to )));
|
|
#define ALIAS(from,to) ALIAS2( from, __glX ## to ## ReqSize )
|
|
#else
|
|
#define ALIAS(from,to) \
|
|
- GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
|
|
- { return __glX ## to ## ReqSize( pc, swap ); }
|
|
+ GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
|
|
+ { return __glX ## to ## ReqSize( pc, swap, reqlen ); }
|
|
#endif
|
|
|
|
int
|
|
-__glXCallListsReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXCallListsReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 0);
|
|
GLenum type = *(GLenum *) (pc + 4);
|
|
@@ -60,11 +58,11 @@ __glXCallListsReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glCallLists_size(type);
|
|
- return __GLX_PAD((compsize * n));
|
|
+ return safe_pad(safe_mul(compsize, n));
|
|
}
|
|
|
|
int
|
|
-__glXBitmapReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXBitmapReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -88,7 +86,7 @@ __glXBitmapReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXFogfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXFogfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 0);
|
|
GLsizei compsize;
|
|
@@ -98,11 +96,11 @@ __glXFogfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glFogfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXLightfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXLightfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -112,11 +110,11 @@ __glXLightfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glLightfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXLightModelfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXLightModelfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 0);
|
|
GLsizei compsize;
|
|
@@ -126,11 +124,11 @@ __glXLightModelfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glLightModelfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXMaterialfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXMaterialfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -140,11 +138,11 @@ __glXMaterialfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glMaterialfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -164,7 +162,7 @@ __glXPolygonStippleReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -174,11 +172,11 @@ __glXTexParameterfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glTexParameterfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXTexImage1DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -206,7 +204,7 @@ __glXTexImage1DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXTexImage2DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -236,7 +234,7 @@ __glXTexImage2DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -246,11 +244,11 @@ __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glTexEnvfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXTexGendvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexGendvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -260,11 +258,11 @@ __glXTexGendvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glTexGendv_size(pname);
|
|
- return __GLX_PAD((compsize * 8));
|
|
+ return safe_pad(safe_mul(compsize, 8));
|
|
}
|
|
|
|
int
|
|
-__glXTexGenfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexGenfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -274,11 +272,11 @@ __glXTexGenfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glTexGenfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei mapsize = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -286,11 +284,11 @@ __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap)
|
|
mapsize = bswap_32(mapsize);
|
|
}
|
|
|
|
- return __GLX_PAD((mapsize * 4));
|
|
+ return safe_pad(safe_mul(mapsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei mapsize = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -298,11 +296,11 @@ __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap)
|
|
mapsize = bswap_32(mapsize);
|
|
}
|
|
|
|
- return __GLX_PAD((mapsize * 2));
|
|
+ return safe_pad(safe_mul(mapsize, 2));
|
|
}
|
|
|
|
int
|
|
-__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -330,7 +328,7 @@ __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 0);
|
|
|
|
@@ -338,11 +336,11 @@ __glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 4) + (n * 4));
|
|
+ return safe_pad(safe_add(safe_mul(n, 4), safe_mul(n, 4)));
|
|
}
|
|
|
|
int
|
|
-__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -370,7 +368,7 @@ __glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -400,7 +398,7 @@ __glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXColorTableReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXColorTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -428,7 +426,7 @@ __glXColorTableReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -438,11 +436,11 @@ __glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glColorTableParameterfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXColorSubTableReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXColorSubTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -470,7 +468,7 @@ __glXColorSubTableReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -498,7 +496,7 @@ __glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = 0;
|
|
@@ -528,7 +526,7 @@ __glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 4);
|
|
GLsizei compsize;
|
|
@@ -538,11 +536,11 @@ __glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glConvolutionParameterfv_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXTexImage3DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = *(GLint *) (pc + 8);
|
|
@@ -579,7 +577,7 @@ __glXTexImage3DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLint row_length = *(GLint *) (pc + 4);
|
|
GLint image_height = *(GLint *) (pc + 8);
|
|
@@ -613,7 +611,7 @@ __glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXCompressedTexImage1DARBReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXCompressedTexImage1DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei imageSize = *(GLsizei *) (pc + 20);
|
|
|
|
@@ -621,11 +619,11 @@ __glXCompressedTexImage1DARBReqSize(const GLbyte * pc, Bool swap)
|
|
imageSize = bswap_32(imageSize);
|
|
}
|
|
|
|
- return __GLX_PAD(imageSize);
|
|
+ return safe_pad(imageSize);
|
|
}
|
|
|
|
int
|
|
-__glXCompressedTexImage2DARBReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXCompressedTexImage2DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei imageSize = *(GLsizei *) (pc + 24);
|
|
|
|
@@ -633,11 +631,11 @@ __glXCompressedTexImage2DARBReqSize(const GLbyte * pc, Bool swap)
|
|
imageSize = bswap_32(imageSize);
|
|
}
|
|
|
|
- return __GLX_PAD(imageSize);
|
|
+ return safe_pad(imageSize);
|
|
}
|
|
|
|
int
|
|
-__glXCompressedTexImage3DARBReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXCompressedTexImage3DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei imageSize = *(GLsizei *) (pc + 28);
|
|
|
|
@@ -645,11 +643,11 @@ __glXCompressedTexImage3DARBReqSize(const GLbyte * pc, Bool swap)
|
|
imageSize = bswap_32(imageSize);
|
|
}
|
|
|
|
- return __GLX_PAD(imageSize);
|
|
+ return safe_pad(imageSize);
|
|
}
|
|
|
|
int
|
|
-__glXCompressedTexSubImage3DARBReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXCompressedTexSubImage3DARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei imageSize = *(GLsizei *) (pc + 36);
|
|
|
|
@@ -657,11 +655,11 @@ __glXCompressedTexSubImage3DARBReqSize(const GLbyte * pc, Bool swap)
|
|
imageSize = bswap_32(imageSize);
|
|
}
|
|
|
|
- return __GLX_PAD(imageSize);
|
|
+ return safe_pad(imageSize);
|
|
}
|
|
|
|
int
|
|
-__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei len = *(GLsizei *) (pc + 8);
|
|
|
|
@@ -669,11 +667,11 @@ __glXProgramStringARBReqSize(const GLbyte * pc, Bool swap)
|
|
len = bswap_32(len);
|
|
}
|
|
|
|
- return __GLX_PAD(len);
|
|
+ return safe_pad(len);
|
|
}
|
|
|
|
int
|
|
-__glXDrawBuffersARBReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXDrawBuffersARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 0);
|
|
|
|
@@ -681,11 +679,11 @@ __glXDrawBuffersARBReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 4));
|
|
+ return safe_pad(safe_mul(n, 4));
|
|
}
|
|
|
|
int
|
|
-__glXPointParameterfvEXTReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXPointParameterfvEXTReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum pname = *(GLenum *) (pc + 0);
|
|
GLsizei compsize;
|
|
@@ -695,11 +693,11 @@ __glXPointParameterfvEXTReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
compsize = __glPointParameterfvEXT_size(pname);
|
|
- return __GLX_PAD((compsize * 4));
|
|
+ return safe_pad(safe_mul(compsize, 4));
|
|
}
|
|
|
|
int
|
|
-__glXProgramParameters4dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXProgramParameters4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei num = *(GLsizei *) (pc + 8);
|
|
|
|
@@ -707,11 +705,11 @@ __glXProgramParameters4dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
num = bswap_32(num);
|
|
}
|
|
|
|
- return __GLX_PAD((num * 32));
|
|
+ return safe_pad(safe_mul(num, 32));
|
|
}
|
|
|
|
int
|
|
-__glXProgramParameters4fvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXProgramParameters4fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei num = *(GLsizei *) (pc + 8);
|
|
|
|
@@ -719,11 +717,11 @@ __glXProgramParameters4fvNVReqSize(const GLbyte * pc, Bool swap)
|
|
num = bswap_32(num);
|
|
}
|
|
|
|
- return __GLX_PAD((num * 16));
|
|
+ return safe_pad(safe_mul(num, 16));
|
|
}
|
|
|
|
int
|
|
-__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -731,11 +729,11 @@ __glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 8));
|
|
+ return safe_pad(safe_mul(n, 8));
|
|
}
|
|
|
|
int
|
|
-__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -743,11 +741,11 @@ __glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 16));
|
|
+ return safe_pad(safe_mul(n, 16));
|
|
}
|
|
|
|
int
|
|
-__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -755,11 +753,11 @@ __glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 24));
|
|
+ return safe_pad(safe_mul(n, 24));
|
|
}
|
|
|
|
int
|
|
-__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -767,11 +765,11 @@ __glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 12));
|
|
+ return safe_pad(safe_mul(n, 12));
|
|
}
|
|
|
|
int
|
|
-__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -779,11 +777,11 @@ __glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 6));
|
|
+ return safe_pad(safe_mul(n, 6));
|
|
}
|
|
|
|
int
|
|
-__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei n = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -791,11 +789,11 @@ __glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap)
|
|
n = bswap_32(n);
|
|
}
|
|
|
|
- return __GLX_PAD((n * 32));
|
|
+ return safe_pad(safe_mul(n, 32));
|
|
}
|
|
|
|
int
|
|
-__glXProgramNamedParameter4fvNVReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXProgramNamedParameter4fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLsizei len = *(GLsizei *) (pc + 4);
|
|
|
|
@@ -803,7 +801,7 @@ __glXProgramNamedParameter4fvNVReqSize(const GLbyte * pc, Bool swap)
|
|
len = bswap_32(len);
|
|
}
|
|
|
|
- return __GLX_PAD(len);
|
|
+ return safe_pad(len);
|
|
}
|
|
|
|
ALIAS(Fogiv, Fogfv)
|
|
diff --git a/glx/indirect_reqsize.h b/glx/indirect_reqsize.h
|
|
index d2c1da7..22e1350 100644
|
|
--- a/glx/indirect_reqsize.h
|
|
+++ b/glx/indirect_reqsize.h
|
|
@@ -36,128 +36,128 @@
|
|
#define PURE
|
|
#endif
|
|
|
|
-extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap);
|
|
+extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXPolygonStippleReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXTexParameterfvReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXTexParameterivReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXPrioritizeTexturesReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXTexSubImage1DReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXTexSubImage2DReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXColorTableParameterfvReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXColorTableParameterivReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXColorSubTableReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXConvolutionFilter1DReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXConvolutionFilter2DReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXConvolutionParameterfvReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXConvolutionParameterivReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXSeparableFilter2DReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
-extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
+extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXTexSubImage3DReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXCompressedTexImage1DARBReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXCompressedTexImage2DARBReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXCompressedTexImage3DARBReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXCompressedTexSubImage1DARBReqSize(const GLbyte *
|
|
- pc, Bool swap);
|
|
+ pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXCompressedTexSubImage2DARBReqSize(const GLbyte *
|
|
- pc, Bool swap);
|
|
+ pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXCompressedTexSubImage3DARBReqSize(const GLbyte *
|
|
- pc, Bool swap);
|
|
+ pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXProgramStringARBReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXDrawBuffersARBReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXPointParameterfvEXTReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXLoadProgramNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXProgramParameters4dvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXProgramParameters4fvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXRequestResidentProgramsNVReqSize(const GLbyte *
|
|
- pc, Bool swap);
|
|
+ pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs1dvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs1fvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs1svNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs2dvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs2fvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs2svNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs3dvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs3fvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs3svNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs4dvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs4fvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs4svNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXVertexAttribs4ubvNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXPointParameterivNVReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXProgramNamedParameter4dvNVReqSize(const GLbyte *
|
|
- pc, Bool swap);
|
|
+ pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXProgramNamedParameter4fvNVReqSize(const GLbyte *
|
|
- pc, Bool swap);
|
|
+ pc, Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXDeleteFramebuffersEXTReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
extern PURE _X_HIDDEN int __glXDeleteRenderbuffersEXTReqSize(const GLbyte * pc,
|
|
- Bool swap);
|
|
+ Bool swap, int reqlen);
|
|
|
|
#undef PURE
|
|
|
|
diff --git a/glx/rensize.c b/glx/rensize.c
|
|
index 6ee0f9c..a532467 100644
|
|
--- a/glx/rensize.c
|
|
+++ b/glx/rensize.c
|
|
@@ -44,7 +44,7 @@
|
|
((a & 0xff00U)<<8) | ((a & 0xffU)<<24))
|
|
|
|
int
|
|
-__glXMap1dReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXMap1dReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum target;
|
|
GLint order;
|
|
@@ -61,7 +61,7 @@ __glXMap1dReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXMap1fReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXMap1fReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum target;
|
|
GLint order;
|
|
@@ -86,7 +86,7 @@ Map2Size(int k, int majorOrder, int minorOrder)
|
|
}
|
|
|
|
int
|
|
-__glXMap2dReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXMap2dReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum target;
|
|
GLint uorder, vorder;
|
|
@@ -103,7 +103,7 @@ __glXMap2dReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
int
|
|
-__glXMap2fReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXMap2fReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
GLenum target;
|
|
GLint uorder, vorder;
|
|
@@ -359,13 +359,14 @@ __glXTypeSize(GLenum enm)
|
|
}
|
|
|
|
int
|
|
-__glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXDrawArraysReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
__GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc;
|
|
__GLXdispatchDrawArraysComponentHeader *compHeader;
|
|
GLint numVertexes = hdr->numVertexes;
|
|
GLint numComponents = hdr->numComponents;
|
|
GLint arrayElementSize = 0;
|
|
+ GLint x, size;
|
|
int i;
|
|
|
|
if (swap) {
|
|
@@ -374,6 +375,13 @@ __glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
|
|
}
|
|
|
|
pc += sizeof(__GLXdispatchDrawArraysHeader);
|
|
+ reqlen -= sizeof(__GLXdispatchDrawArraysHeader);
|
|
+
|
|
+ size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader),
|
|
+ numComponents);
|
|
+ if (size < 0 || reqlen < 0 || reqlen < size)
|
|
+ return -1;
|
|
+
|
|
compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc;
|
|
|
|
for (i = 0; i < numComponents; i++) {
|
|
@@ -417,17 +425,18 @@ __glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
|
|
return -1;
|
|
}
|
|
|
|
- arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype));
|
|
+ x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype)));
|
|
+ if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0)
|
|
+ return -1;
|
|
|
|
pc += sizeof(__GLXdispatchDrawArraysComponentHeader);
|
|
}
|
|
|
|
- return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) +
|
|
- (numVertexes * arrayElementSize));
|
|
+ return safe_add(size, safe_mul(numVertexes, arrayElementSize));
|
|
}
|
|
|
|
int
|
|
-__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap)
|
|
+__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
|
|
{
|
|
__GLXdispatchConvolutionFilterHeader *hdr =
|
|
(__GLXdispatchConvolutionFilterHeader *) pc;
|
|
diff --git a/include/dix.h b/include/dix.h
|
|
index ea9d2cc..b48d828 100644
|
|
--- a/include/dix.h
|
|
+++ b/include/dix.h
|
|
@@ -72,6 +72,10 @@ SOFTWARE.
|
|
if ((sizeof(req) >> 2) > client->req_len )\
|
|
return(BadLength)
|
|
|
|
+#define REQUEST_AT_LEAST_EXTRA_SIZE(req, extra) \
|
|
+ if (((sizeof(req) + ((uint64_t) extra)) >> 2) > client->req_len ) \
|
|
+ return(BadLength)
|
|
+
|
|
#define REQUEST_FIXED_SIZE(req, n)\
|
|
if (((sizeof(req) >> 2) > client->req_len) || \
|
|
((n >> 2) >= client->req_len) || \
|
|
diff --git a/test/xi2/protocol-xipassivegrabdevice.c b/test/xi2/protocol-xipassivegrabdevice.c
|
|
index ff9aec5..25eb6e9 100644
|
|
--- a/test/xi2/protocol-xipassivegrabdevice.c
|
|
+++ b/test/xi2/protocol-xipassivegrabdevice.c
|
|
@@ -136,6 +136,7 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req,
|
|
{
|
|
int rc;
|
|
int modifiers;
|
|
+ int mask_len;
|
|
|
|
client_request.req_len = req->length;
|
|
rc = ProcXIPassiveGrabDevice(&client_request);
|
|
@@ -153,10 +154,11 @@ request_XIPassiveGrabDevice(ClientPtr client, xXIPassiveGrabDeviceReq * req,
|
|
swaps(&req->deviceid);
|
|
modifiers = req->num_modifiers;
|
|
swaps(&req->num_modifiers);
|
|
+ mask_len = req->mask_len;
|
|
swaps(&req->mask_len);
|
|
|
|
while (modifiers--) {
|
|
- CARD32 *mod = ((CARD32 *) (req + 1)) + modifiers;
|
|
+ CARD32 *mod = (CARD32 *) (req + 1) + mask_len + modifiers;
|
|
|
|
swapl(mod);
|
|
}
|
|
@@ -235,6 +237,11 @@ test_XIPassiveGrabDevice(void)
|
|
request->detail = XIAnyButton;
|
|
request_XIPassiveGrabDevice(&client_request, request, Success, 0);
|
|
|
|
+ /* Set a few random masks to make sure we handle modifiers correctly */
|
|
+ SetBit(mask, XI_ButtonPress);
|
|
+ SetBit(mask, XI_KeyPress);
|
|
+ SetBit(mask, XI_Enter);
|
|
+
|
|
/* some modifiers */
|
|
request->num_modifiers = N_MODS;
|
|
request->length += N_MODS;
|