]>
Commit | Line | Data |
---|---|---|
b2a53837 AM |
1 | diff --git a/Xext/EVI.c b/Xext/EVI.c |
2 | index 8fe3481..13bd32a 100644 | |
3 | --- a/Xext/EVI.c | |
4 | +++ b/Xext/EVI.c | |
5 | @@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. | |
6 | #include <X11/extensions/XEVIstr.h> | |
7 | #include "EVIstruct.h" | |
8 | #include "modinit.h" | |
9 | +#include "scrnintstr.h" | |
10 | ||
11 | #if 0 | |
12 | static unsigned char XEVIReqCode = 0; | |
13 | @@ -87,10 +88,22 @@ ProcEVIGetVisualInfo(ClientPtr client) | |
14 | { | |
15 | REQUEST(xEVIGetVisualInfoReq); | |
16 | xEVIGetVisualInfoReply rep; | |
17 | - int n, n_conflict, n_info, sz_info, sz_conflict; | |
18 | + int i, n, n_conflict, n_info, sz_info, sz_conflict; | |
19 | VisualID32 *conflict; | |
20 | + unsigned int total_visuals = 0; | |
21 | xExtendedVisualInfo *eviInfo; | |
22 | int status; | |
23 | + | |
24 | + /* | |
25 | + * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume | |
26 | + * here that you don't have more than 2^32 visuals over all your screens; | |
27 | + * this seems like a safe assumption. | |
28 | + */ | |
29 | + for (i = 0; i < screenInfo.numScreens; i++) | |
30 | + total_visuals += screenInfo.screens[i]->numVisuals; | |
31 | + if (stuff->n_visual > total_visuals) | |
32 | + return BadValue; | |
33 | + | |
34 | REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32); | |
35 | status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual, | |
36 | &eviInfo, &n_info, &conflict, &n_conflict); | |
37 | diff --git a/Xext/cup.c b/Xext/cup.c | |
38 | index 6bfa278..781b9ce 100644 | |
39 | --- a/Xext/cup.c | |
40 | +++ b/Xext/cup.c | |
41 | @@ -196,6 +196,9 @@ int ProcGetReservedColormapEntries( | |
42 | ||
43 | REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq); | |
44 | ||
45 | + if (stuff->screen >= screenInfo.numScreens) | |
46 | + return BadValue; | |
47 | + | |
48 | #ifndef HAVE_SPECIAL_DESKTOP_COLORS | |
49 | citems[CUP_BLACK_PIXEL].pixel = | |
50 | screenInfo.screens[stuff->screen]->blackPixel; | |
51 | diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c | |
29ab46b3 | 52 | index 7508aa7..b871bfd 100644 |
b2a53837 AM |
53 | --- a/Xext/sampleEVI.c |
54 | +++ b/Xext/sampleEVI.c | |
55 | @@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. | |
56 | #include <X11/extensions/XEVIstr.h> | |
57 | #include "EVIstruct.h" | |
58 | #include "scrnintstr.h" | |
59 | + | |
60 | +#if HAVE_STDINT_H | |
61 | +#include <stdint.h> | |
62 | +#elif !defined(UINT32_MAX) | |
63 | +#define UINT32_MAX 0xffffffffU | |
64 | +#endif | |
65 | + | |
66 | static int sampleGetVisualInfo( | |
67 | VisualID32 *visual, | |
68 | int n_visual, | |
69 | @@ -42,24 +49,36 @@ static int sampleGetVisualInfo( | |
70 | VisualID32 **conflict_rn, | |
71 | int *n_conflict_rn) | |
72 | { | |
73 | - int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; | |
74 | + unsigned int max_sz_evi; | |
75 | VisualID32 *temp_conflict; | |
76 | xExtendedVisualInfo *evi; | |
77 | - int max_visuals = 0, max_sz_conflict, sz_conflict = 0; | |
78 | + unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0; | |
79 | register int visualI, scrI, sz_evi = 0, conflictI, n_conflict; | |
80 | - *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); | |
81 | - if (!*evi_rn) | |
82 | - return BadAlloc; | |
83 | + | |
84 | + if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens)) | |
85 | + return BadAlloc; | |
86 | + max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; | |
87 | + | |
88 | for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { | |
89 | if (screenInfo.screens[scrI]->numVisuals > max_visuals) | |
90 | max_visuals = screenInfo.screens[scrI]->numVisuals; | |
91 | } | |
92 | + | |
93 | + if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens | |
94 | + * max_visuals)) | |
95 | + return BadAlloc; | |
96 | max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals; | |
97 | + | |
98 | + *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); | |
99 | + if (!*evi_rn) | |
100 | + return BadAlloc; | |
101 | + | |
102 | temp_conflict = (VisualID32 *)xalloc(max_sz_conflict); | |
103 | if (!temp_conflict) { | |
104 | xfree(*evi_rn); | |
105 | return BadAlloc; | |
106 | } | |
107 | + | |
108 | for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { | |
109 | for (visualI = 0; visualI < n_visual; visualI++) { | |
110 | evi[sz_evi].core_visual_id = visual[visualI]; | |
111 | diff --git a/Xext/security.c b/Xext/security.c | |
112 | index ba057de..e9d48c9 100644 | |
113 | --- a/Xext/security.c | |
114 | +++ b/Xext/security.c | |
115 | @@ -1563,7 +1563,7 @@ SecurityLoadPropertyAccessList(void) | |
116 | if (!SecurityPolicyFile) | |
117 | return; | |
118 | ||
119 | - f = fopen(SecurityPolicyFile, "r"); | |
120 | + f = Fopen(SecurityPolicyFile, "r"); | |
121 | if (!f) | |
122 | { | |
123 | ErrorF("error opening security policy file %s\n", | |
124 | @@ -1646,7 +1646,7 @@ SecurityLoadPropertyAccessList(void) | |
125 | } | |
126 | #endif /* PROPDEBUG */ | |
127 | ||
128 | - fclose(f); | |
129 | + Fclose(f); | |
130 | } /* SecurityLoadPropertyAccessList */ | |
131 | ||
132 | ||
133 | diff --git a/Xext/shm.c b/Xext/shm.c | |
29ab46b3 | 134 | index ac587be..6f99e90 100644 |
b2a53837 AM |
135 | --- a/Xext/shm.c |
136 | +++ b/Xext/shm.c | |
137 | @@ -711,6 +711,8 @@ ProcPanoramiXShmCreatePixmap( | |
138 | int i, j, result, rc; | |
139 | ShmDescPtr shmdesc; | |
140 | REQUEST(xShmCreatePixmapReq); | |
141 | + unsigned int width, height, depth; | |
142 | + unsigned long size; | |
143 | PanoramiXRes *newPix; | |
144 | ||
145 | REQUEST_SIZE_MATCH(xShmCreatePixmapReq); | |
29ab46b3 | 146 | @@ -724,11 +726,18 @@ ProcPanoramiXShmCreatePixmap( |
b2a53837 AM |
147 | return rc; |
148 | ||
149 | VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); | |
150 | - if (!stuff->width || !stuff->height) | |
151 | + | |
152 | + width = stuff->width; | |
153 | + height = stuff->height; | |
154 | + depth = stuff->depth; | |
155 | + if (!width || !height || !depth) | |
156 | { | |
157 | client->errorValue = 0; | |
158 | return BadValue; | |
159 | } | |
160 | + if (width > 32767 || height > 32767) | |
161 | + return BadAlloc; | |
b2a53837 AM |
162 | + |
163 | if (stuff->depth != 1) | |
164 | { | |
165 | pDepth = pDraw->pScreen->allowedDepths; | |
29ab46b3 AM |
166 | @@ -738,10 +747,18 @@ ProcPanoramiXShmCreatePixmap( |
167 | client->errorValue = stuff->depth; | |
b2a53837 AM |
168 | return BadValue; |
169 | } | |
29ab46b3 | 170 | + |
b2a53837 AM |
171 | CreatePmap: |
172 | - VERIFY_SHMSIZE(shmdesc, stuff->offset, | |
173 | - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, | |
174 | - client); | |
29ab46b3 AM |
175 | + size = PixmapBytePad(width, depth) * height; |
176 | + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { | |
177 | + if (size < width * height) | |
178 | + return BadAlloc; | |
179 | + /* thankfully, offset is unsigned */ | |
180 | + if (stuff->offset + size < size) | |
181 | + return BadAlloc; | |
182 | + } | |
183 | + | |
b2a53837 AM |
184 | + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); |
185 | ||
186 | if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) | |
187 | return BadAlloc; | |
29ab46b3 | 188 | @@ -1040,6 +1057,8 @@ ProcShmCreatePixmap(client) |
b2a53837 AM |
189 | register int i, rc; |
190 | ShmDescPtr shmdesc; | |
191 | REQUEST(xShmCreatePixmapReq); | |
192 | + unsigned int width, height, depth; | |
193 | + unsigned long size; | |
194 | ||
195 | REQUEST_SIZE_MATCH(xShmCreatePixmapReq); | |
196 | client->errorValue = stuff->pid; | |
29ab46b3 | 197 | @@ -1052,11 +1071,18 @@ ProcShmCreatePixmap(client) |
b2a53837 AM |
198 | return rc; |
199 | ||
200 | VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); | |
201 | - if (!stuff->width || !stuff->height) | |
202 | + | |
203 | + width = stuff->width; | |
204 | + height = stuff->height; | |
205 | + depth = stuff->depth; | |
206 | + if (!width || !height || !depth) | |
207 | { | |
208 | client->errorValue = 0; | |
209 | return BadValue; | |
210 | } | |
211 | + if (width > 32767 || height > 32767) | |
212 | + return BadAlloc; | |
b2a53837 AM |
213 | + |
214 | if (stuff->depth != 1) | |
215 | { | |
216 | pDepth = pDraw->pScreen->allowedDepths; | |
29ab46b3 AM |
217 | @@ -1066,10 +1092,18 @@ ProcShmCreatePixmap(client) |
218 | client->errorValue = stuff->depth; | |
b2a53837 AM |
219 | return BadValue; |
220 | } | |
29ab46b3 | 221 | + |
b2a53837 AM |
222 | CreatePmap: |
223 | - VERIFY_SHMSIZE(shmdesc, stuff->offset, | |
224 | - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, | |
225 | - client); | |
29ab46b3 AM |
226 | + size = PixmapBytePad(width, depth) * height; |
227 | + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { | |
228 | + if (size < width * height) | |
229 | + return BadAlloc; | |
230 | + /* thankfully, offset is unsigned */ | |
231 | + if (stuff->offset + size < size) | |
232 | + return BadAlloc; | |
233 | + } | |
234 | + | |
b2a53837 AM |
235 | + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); |
236 | pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( | |
237 | pDraw->pScreen, stuff->width, | |
238 | stuff->height, stuff->depth, | |
239 | diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c | |
240 | index 2e0e13c..235d659 100644 | |
241 | --- a/Xi/chgfctl.c | |
242 | +++ b/Xi/chgfctl.c | |
243 | @@ -327,18 +327,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev, | |
244 | xStringFeedbackCtl * f) | |
245 | { | |
246 | char n; | |
247 | - long *p; | |
248 | int i, j; | |
249 | KeySym *syms, *sup_syms; | |
250 | ||
251 | syms = (KeySym *) (f + 1); | |
252 | if (client->swapped) { | |
253 | swaps(&f->length, n); /* swapped num_keysyms in calling proc */ | |
254 | - p = (long *)(syms); | |
255 | - for (i = 0; i < f->num_keysyms; i++) { | |
256 | - swapl(p, n); | |
257 | - p++; | |
258 | - } | |
259 | + SwapLongs((CARD32 *) syms, f->num_keysyms); | |
260 | } | |
261 | ||
262 | if (f->num_keysyms > s->ctrl.max_symbols) { | |
263 | diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c | |
264 | index eac520f..75ee9f5 100644 | |
265 | --- a/Xi/chgkmap.c | |
266 | +++ b/Xi/chgkmap.c | |
267 | @@ -79,18 +79,14 @@ int | |
268 | SProcXChangeDeviceKeyMapping(ClientPtr client) | |
269 | { | |
270 | char n; | |
271 | - long *p; | |
272 | - int i, count; | |
273 | + unsigned int count; | |
274 | ||
275 | REQUEST(xChangeDeviceKeyMappingReq); | |
276 | swaps(&stuff->length, n); | |
277 | REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); | |
278 | - p = (long *)&stuff[1]; | |
279 | count = stuff->keyCodes * stuff->keySymsPerKeyCode; | |
280 | - for (i = 0; i < count; i++) { | |
281 | - swapl(p, n); | |
282 | - p++; | |
283 | - } | |
284 | + REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); | |
285 | + SwapLongs((CARD32 *) (&stuff[1]), count); | |
286 | return (ProcXChangeDeviceKeyMapping(client)); | |
287 | } | |
288 | ||
289 | @@ -106,10 +102,14 @@ ProcXChangeDeviceKeyMapping(ClientPtr client) | |
290 | int ret; | |
291 | unsigned len; | |
292 | DeviceIntPtr dev; | |
293 | + unsigned int count; | |
294 | ||
295 | REQUEST(xChangeDeviceKeyMappingReq); | |
296 | REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); | |
297 | ||
298 | + count = stuff->keyCodes * stuff->keySymsPerKeyCode; | |
299 | + REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); | |
300 | + | |
301 | dev = LookupDeviceIntRec(stuff->deviceid); | |
302 | if (dev == NULL) { | |
303 | SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0, | |
304 | diff --git a/Xi/chgprop.c b/Xi/chgprop.c | |
305 | index 59a93c6..21bda5b 100644 | |
306 | --- a/Xi/chgprop.c | |
307 | +++ b/Xi/chgprop.c | |
308 | @@ -81,19 +81,15 @@ int | |
309 | SProcXChangeDeviceDontPropagateList(ClientPtr client) | |
310 | { | |
311 | char n; | |
312 | - long *p; | |
313 | - int i; | |
314 | ||
315 | REQUEST(xChangeDeviceDontPropagateListReq); | |
316 | swaps(&stuff->length, n); | |
317 | REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq); | |
318 | swapl(&stuff->window, n); | |
319 | swaps(&stuff->count, n); | |
320 | - p = (long *)&stuff[1]; | |
321 | - for (i = 0; i < stuff->count; i++) { | |
322 | - swapl(p, n); | |
323 | - p++; | |
324 | - } | |
325 | + REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq, | |
326 | + stuff->count * sizeof(CARD32)); | |
327 | + SwapLongs((CARD32 *) (&stuff[1]), stuff->count); | |
328 | return (ProcXChangeDeviceDontPropagateList(client)); | |
329 | } | |
330 | ||
331 | diff --git a/Xi/grabdev.c b/Xi/grabdev.c | |
332 | index e2809ef..d0b4ae7 100644 | |
333 | --- a/Xi/grabdev.c | |
334 | +++ b/Xi/grabdev.c | |
335 | @@ -82,8 +82,6 @@ int | |
336 | SProcXGrabDevice(ClientPtr client) | |
337 | { | |
338 | char n; | |
339 | - long *p; | |
340 | - int i; | |
341 | ||
342 | REQUEST(xGrabDeviceReq); | |
343 | swaps(&stuff->length, n); | |
344 | @@ -91,11 +89,11 @@ SProcXGrabDevice(ClientPtr client) | |
345 | swapl(&stuff->grabWindow, n); | |
346 | swapl(&stuff->time, n); | |
347 | swaps(&stuff->event_count, n); | |
348 | - p = (long *)&stuff[1]; | |
349 | - for (i = 0; i < stuff->event_count; i++) { | |
350 | - swapl(p, n); | |
351 | - p++; | |
352 | - } | |
353 | + | |
354 | + if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count) | |
355 | + return BadLength; | |
356 | + | |
357 | + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); | |
358 | ||
359 | return (ProcXGrabDevice(client)); | |
360 | } | |
361 | diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c | |
362 | index df62d0c..18db1f7 100644 | |
363 | --- a/Xi/grabdevb.c | |
364 | +++ b/Xi/grabdevb.c | |
365 | @@ -80,8 +80,6 @@ int | |
366 | SProcXGrabDeviceButton(ClientPtr client) | |
367 | { | |
368 | char n; | |
369 | - long *p; | |
370 | - int i; | |
371 | ||
372 | REQUEST(xGrabDeviceButtonReq); | |
373 | swaps(&stuff->length, n); | |
374 | @@ -89,11 +87,9 @@ SProcXGrabDeviceButton(ClientPtr client) | |
375 | swapl(&stuff->grabWindow, n); | |
376 | swaps(&stuff->modifiers, n); | |
377 | swaps(&stuff->event_count, n); | |
378 | - p = (long *)&stuff[1]; | |
379 | - for (i = 0; i < stuff->event_count; i++) { | |
380 | - swapl(p, n); | |
381 | - p++; | |
382 | - } | |
383 | + REQUEST_FIXED_SIZE(xGrabDeviceButtonReq, | |
384 | + stuff->event_count * sizeof(CARD32)); | |
385 | + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); | |
386 | ||
387 | return (ProcXGrabDeviceButton(client)); | |
388 | } | |
389 | diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c | |
390 | index b74592f..429b2f7 100644 | |
391 | --- a/Xi/grabdevk.c | |
392 | +++ b/Xi/grabdevk.c | |
393 | @@ -80,8 +80,6 @@ int | |
394 | SProcXGrabDeviceKey(ClientPtr client) | |
395 | { | |
396 | char n; | |
397 | - long *p; | |
398 | - int i; | |
399 | ||
400 | REQUEST(xGrabDeviceKeyReq); | |
401 | swaps(&stuff->length, n); | |
402 | @@ -89,11 +87,8 @@ SProcXGrabDeviceKey(ClientPtr client) | |
403 | swapl(&stuff->grabWindow, n); | |
404 | swaps(&stuff->modifiers, n); | |
405 | swaps(&stuff->event_count, n); | |
406 | - p = (long *)&stuff[1]; | |
407 | - for (i = 0; i < stuff->event_count; i++) { | |
408 | - swapl(p, n); | |
409 | - p++; | |
410 | - } | |
411 | + REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32)); | |
412 | + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); | |
413 | return (ProcXGrabDeviceKey(client)); | |
414 | } | |
415 | ||
416 | diff --git a/Xi/selectev.c b/Xi/selectev.c | |
417 | index d52db1b..19415c5 100644 | |
418 | --- a/Xi/selectev.c | |
419 | +++ b/Xi/selectev.c | |
420 | @@ -131,19 +131,16 @@ int | |
421 | SProcXSelectExtensionEvent(ClientPtr client) | |
422 | { | |
423 | char n; | |
424 | - long *p; | |
425 | - int i; | |
426 | ||
427 | REQUEST(xSelectExtensionEventReq); | |
428 | swaps(&stuff->length, n); | |
429 | REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq); | |
430 | swapl(&stuff->window, n); | |
431 | swaps(&stuff->count, n); | |
432 | - p = (long *)&stuff[1]; | |
433 | - for (i = 0; i < stuff->count; i++) { | |
434 | - swapl(p, n); | |
435 | - p++; | |
436 | - } | |
437 | + REQUEST_FIXED_SIZE(xSelectExtensionEventReq, | |
438 | + stuff->count * sizeof(CARD32)); | |
439 | + SwapLongs((CARD32 *) (&stuff[1]), stuff->count); | |
440 | + | |
441 | return (ProcXSelectExtensionEvent(client)); | |
442 | } | |
443 | ||
444 | diff --git a/Xi/sendexev.c b/Xi/sendexev.c | |
445 | index eac9abe..9803cf3 100644 | |
446 | --- a/Xi/sendexev.c | |
447 | +++ b/Xi/sendexev.c | |
448 | @@ -83,7 +83,7 @@ int | |
449 | SProcXSendExtensionEvent(ClientPtr client) | |
450 | { | |
451 | char n; | |
452 | - long *p; | |
453 | + CARD32 *p; | |
454 | int i; | |
455 | xEvent eventT; | |
456 | xEvent *eventP; | |
457 | @@ -94,6 +94,11 @@ SProcXSendExtensionEvent(ClientPtr client) | |
458 | REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); | |
459 | swapl(&stuff->destination, n); | |
460 | swaps(&stuff->count, n); | |
461 | + | |
462 | + if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + | |
463 | + (stuff->num_events * (sizeof(xEvent) >> 2))) | |
464 | + return BadLength; | |
465 | + | |
466 | eventP = (xEvent *) & stuff[1]; | |
467 | for (i = 0; i < stuff->num_events; i++, eventP++) { | |
468 | proc = EventSwapVector[eventP->u.u.type & 0177]; | |
469 | @@ -103,11 +108,8 @@ SProcXSendExtensionEvent(ClientPtr client) | |
470 | *eventP = eventT; | |
471 | } | |
472 | ||
473 | - p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events); | |
474 | - for (i = 0; i < stuff->count; i++) { | |
475 | - swapl(p, n); | |
476 | - p++; | |
477 | - } | |
478 | + p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events); | |
479 | + SwapLongs(p, stuff->count); | |
480 | return (ProcXSendExtensionEvent(client)); | |
481 | } | |
482 | ||
483 | diff --git a/dix/dixfonts.c b/dix/dixfonts.c | |
484 | index c21b3ec..7bb2404 100644 | |
485 | --- a/dix/dixfonts.c | |
486 | +++ b/dix/dixfonts.c | |
487 | @@ -325,6 +325,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c) | |
488 | err = BadFontName; | |
489 | goto bail; | |
490 | } | |
491 | + /* check values for firstCol, lastCol, firstRow, and lastRow */ | |
492 | + if (pfont->info.firstCol > pfont->info.lastCol || | |
493 | + pfont->info.firstRow > pfont->info.lastRow || | |
494 | + pfont->info.lastCol - pfont->info.firstCol > 255) { | |
495 | + err = AllocError; | |
496 | + goto bail; | |
497 | + } | |
498 | if (!pfont->fpe) | |
499 | pfont->fpe = fpe; | |
500 | pfont->refcnt++; | |
501 | diff --git a/hw/xfree86/common/xf86MiscExt.c b/hw/xfree86/common/xf86MiscExt.c | |
502 | index 655304e..ccb4f75 100644 | |
503 | --- a/hw/xfree86/common/xf86MiscExt.c | |
504 | +++ b/hw/xfree86/common/xf86MiscExt.c | |
505 | @@ -568,6 +568,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval, | |
506 | ||
507 | DEBUG_P("MiscExtPassMessage"); | |
508 | ||
509 | + /* should check this in the protocol, but xf86NumScreens isn't exported */ | |
510 | + if (scrnIndex >= xf86NumScreens) | |
511 | + return BadValue; | |
512 | + | |
513 | if (*pScr->HandleMessage == NULL) | |
514 | return BadImplementation; | |
515 | return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr); |