2 ===================================================================
3 RCS file: /cvs/xorg/xc/programs/Xserver/dbe/dbe.c,v
4 retrieving revision 1.5
6 --- xc/programs/Xserver/dbe/dbe.c 3 Jul 2005 07:01:17 -0000 1.5
7 +++ xc/programs/Xserver/dbe/dbe.c 9 Jan 2007 12:45:54 -0000
9 #include "xf86_ansic.h"
12 +#if !defined(UINT32_MAX)
13 +#define UINT32_MAX 0xffffffffU
18 /* Per-screen initialization functions [init'ed by DbeRegisterFunction()] */
23 + if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
26 /* Get to the swap info appended to the end of the request. */
27 dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
29 /* Allocate array to record swap information. */
30 - swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec));
31 + swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec));
36 if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client,
37 SecurityWriteAccess)))
39 - DEALLOCATE_LOCAL(swapInfo);
44 /* Each window must be double-buffered - BadMatch. */
45 if (DBE_WINDOW_PRIV(pWin) == NULL)
47 - DEALLOCATE_LOCAL(swapInfo);
54 if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)
56 - DEALLOCATE_LOCAL(swapInfo);
62 (dbeSwapInfo[i].swapAction != XdbeUntouched ) &&
63 (dbeSwapInfo[i].swapAction != XdbeCopied ))
65 - DEALLOCATE_LOCAL(swapInfo);
71 error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);
74 - DEALLOCATE_LOCAL(swapInfo);
80 - DEALLOCATE_LOCAL(swapInfo);
84 } /* ProcDbeSwapBuffers() */
87 REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
89 + if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
91 /* Make sure any specified drawables are valid. */
94 - if (!(pDrawables = (DrawablePtr *)ALLOCATE_LOCAL(stuff->n *
95 + if (!(pDrawables = (DrawablePtr *)Xalloc(stuff->n *
96 sizeof(DrawablePtr))))
100 if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable(
101 drawables[i], client, SecurityReadAccess)))
103 - DEALLOCATE_LOCAL(pDrawables);
112 - DEALLOCATE_LOCAL(pDrawables);
118 /* Free pDrawables if we needed to allocate it above. */
121 - DEALLOCATE_LOCAL(pDrawables);
126 @@ -1034,7 +1043,7 @@
130 - DEALLOCATE_LOCAL(pDrawables);
134 return(client->noClientException);
135 Index: render/render.c
136 ===================================================================
137 RCS file: /cvs/xorg/xc/programs/Xserver/render/render.c,v
138 retrieving revision 1.12
139 diff -u -u -r1.12 render.c
140 --- xc/programs/Xserver/render/render.c 28 Aug 2005 19:47:39 -0000 1.12
141 +++ xc/programs/Xserver/render/render.c 9 Jan 2007 12:45:55 -0000
143 #include "xf86_ansic.h"
146 +#if !defined(UINT32_MAX)
147 +#define UINT32_MAX 0xffffffffU
150 static int ProcRenderQueryVersion (ClientPtr pClient);
151 static int ProcRenderQueryPictFormats (ClientPtr pClient);
152 static int ProcRenderQueryPictIndexValues (ClientPtr pClient);
153 @@ -1108,11 +1112,14 @@
156 nglyphs = stuff->nglyphs;
157 + if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))
160 if (nglyphs <= NLOCALGLYPH)
161 glyphsBase = glyphsLocal;
164 - glyphsBase = (GlyphNewPtr) ALLOCATE_LOCAL (nglyphs * sizeof (GlyphNewRec));
165 + glyphsBase = (GlyphNewPtr) Xalloc (nglyphs * sizeof (GlyphNewRec));
169 @@ -1169,7 +1176,7 @@
172 if (glyphsBase != glyphsLocal)
173 - DEALLOCATE_LOCAL (glyphsBase);
174 + Xfree (glyphsBase);
175 return client->noClientException;
177 while (glyphs != glyphsBase)
178 @@ -1178,7 +1185,7 @@
179 xfree (glyphs->glyph);
181 if (glyphsBase != glyphsLocal)
182 - DEALLOCATE_LOCAL (glyphsBase);
183 + Xfree (glyphsBase);