x11r6.9.0-dbe-render.diff

   1 Index: dbe/dbe.c
   2 ===================================================================
   3 RCS file: /cvs/xorg/xc/programs/Xserver/dbe/dbe.c,v
   4 retrieving revision 1.5
   5 diff -u -u -r1.5 dbe.c
   6 --- xc/programs/Xserver/dbe/dbe.c       3 Jul 2005 07:01:17 -0000       1.5
   7 +++ xc/programs/Xserver/dbe/dbe.c       9 Jan 2007 12:45:54 -0000
   8 @@ -55,6 +55,10 @@
   9  #include "xf86_ansic.h"
  10  #endif
  11
  12 +#if !defined(UINT32_MAX)
  13 +#define UINT32_MAX 0xffffffffU
  14 +#endif
  15 +
  16  /* GLOBALS */
  17
  18  /* Per-screen initialization functions [init'ed by DbeRegisterFunction()] */
  19 @@ -733,11 +737,14 @@
  20          return(Success);
  21      }
  22
  23 +    if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
  24 +           return BadAlloc;
  25 +
  26      /* Get to the swap info appended to the end of the request. */
  27      dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
  28
  29      /* Allocate array to record swap information. */
  30 -    swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec));
  31 +    swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec));
  32      if (swapInfo == NULL)
  33      {
  34          return(BadAlloc);
  35 @@ -752,14 +759,14 @@
  36          if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client,
  37                                           SecurityWriteAccess)))
  38          {
  39 -            DEALLOCATE_LOCAL(swapInfo);
  40 +            Xfree(swapInfo);
  41             return(BadWindow);
  42          }
  43
  44          /* Each window must be double-buffered - BadMatch. */
  45          if (DBE_WINDOW_PRIV(pWin) == NULL)
  46          {
  47 -            DEALLOCATE_LOCAL(swapInfo);
  48 +            Xfree(swapInfo);
  49              return(BadMatch);
  50          }
  51
  52 @@ -768,7 +775,7 @@
  53          {
  54              if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)
  55              {
  56 -                DEALLOCATE_LOCAL(swapInfo);
  57 +                Xfree(swapInfo);
  58                  return(BadMatch);
  59             }
  60          }
  61 @@ -779,7 +786,7 @@
  62              (dbeSwapInfo[i].swapAction != XdbeUntouched ) &&
  63              (dbeSwapInfo[i].swapAction != XdbeCopied    ))
  64          {
  65 -            DEALLOCATE_LOCAL(swapInfo);
  66 +            Xfree(swapInfo);
  67              return(BadValue);
  68          }
  69
  70 @@ -809,12 +816,12 @@
  71          error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);
  72          if (error != Success)
  73          {
  74 -            DEALLOCATE_LOCAL(swapInfo);
  75 +            Xfree(swapInfo);
  76              return(error);
  77          }
  78      }
  79
  80 -    DEALLOCATE_LOCAL(swapInfo);
  81 +    Xfree(swapInfo);
  82      return(Success);
  83
  84  } /* ProcDbeSwapBuffers() */
  85 @@ -898,10 +905,12 @@
  86
  87      REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
  88
  89 +    if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
  90 +           return BadAlloc;
  91      /* Make sure any specified drawables are valid. */
  92      if (stuff->n != 0)
  93      {
  94 -        if (!(pDrawables = (DrawablePtr *)ALLOCATE_LOCAL(stuff->n *
  95 +        if (!(pDrawables = (DrawablePtr *)Xalloc(stuff->n *
  96                                                   sizeof(DrawablePtr))))
  97          {
  98              return(BadAlloc);
  99 @@ -914,7 +923,7 @@
 100              if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable(
 101                                 drawables[i], client, SecurityReadAccess)))
 102              {
 103 -                DEALLOCATE_LOCAL(pDrawables);
 104 +                Xfree(pDrawables);
 105                  return(BadDrawable);
 106              }
 107          }
 108 @@ -926,7 +935,7 @@
 109      {
 110          if (pDrawables)
 111          {
 112 -            DEALLOCATE_LOCAL(pDrawables);
 113 +            Xfree(pDrawables);
 114          }
 115
 116          return(BadAlloc);
 117 @@ -953,7 +962,7 @@
 118              /* Free pDrawables if we needed to allocate it above. */
 119              if (pDrawables)
 120              {
 121 -                DEALLOCATE_LOCAL(pDrawables);
 122 +                Xfree(pDrawables);
 123              }
 124
 125              return(BadAlloc);
 126 @@ -1034,7 +1043,7 @@
 127
 128      if (pDrawables)
 129      {
 130 -        DEALLOCATE_LOCAL(pDrawables);
 131 +        Xfree(pDrawables);
 132      }
 133
 134      return(client->noClientException);
 135 Index: render/render.c
 136 ===================================================================
 137 RCS file: /cvs/xorg/xc/programs/Xserver/render/render.c,v
 138 retrieving revision 1.12
 139 diff -u -u -r1.12 render.c
 140 --- xc/programs/Xserver/render/render.c 28 Aug 2005 19:47:39 -0000      1.12
 141 +++ xc/programs/Xserver/render/render.c 9 Jan 2007 12:45:55 -0000
 142 @@ -52,6 +52,10 @@
 143  #include "xf86_ansic.h"
 144  #endif
 145
 146 +#if !defined(UINT32_MAX)
 147 +#define UINT32_MAX 0xffffffffU
 148 +#endif
 149 +
 150  static int ProcRenderQueryVersion (ClientPtr pClient);
 151  static int ProcRenderQueryPictFormats (ClientPtr pClient);
 152  static int ProcRenderQueryPictIndexValues (ClientPtr pClient);
 153 @@ -1108,11 +1112,14 @@
 154      }
 155
 156      nglyphs = stuff->nglyphs;
 157 +    if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))
 158 +           return BadAlloc;
 159 +
 160      if (nglyphs <= NLOCALGLYPH)
 161         glyphsBase = glyphsLocal;
 162      else
 163      {
 164 -       glyphsBase = (GlyphNewPtr) ALLOCATE_LOCAL (nglyphs * sizeof (GlyphNewRec));
 165 +       glyphsBase = (GlyphNewPtr) Xalloc (nglyphs * sizeof (GlyphNewRec));
 166         if (!glyphsBase)
 167             return BadAlloc;
 168      }
 169 @@ -1169,7 +1176,7 @@
 170      }
 171
 172      if (glyphsBase != glyphsLocal)
 173 -       DEALLOCATE_LOCAL (glyphsBase);
 174 +       Xfree (glyphsBase);
 175      return client->noClientException;
 176  bail:
 177      while (glyphs != glyphsBase)
 178 @@ -1178,7 +1185,7 @@
 179         xfree (glyphs->glyph);
 180      }
 181      if (glyphsBase != glyphsLocal)
 182 -       DEALLOCATE_LOCAL (glyphsBase);
 183 +       Xfree (glyphsBase);
 184      return err;
 185  }
 186