]>
Commit | Line | Data |
---|---|---|
c6daaf3f AM |
1 | Index: dbe/dbe.c |
2 | =================================================================== | |
3 | RCS file: /cvs/xorg/xc/programs/Xserver/dbe/dbe.c,v | |
4 | retrieving revision 1.5 | |
5 | diff -u -u -r1.5 dbe.c | |
6 | --- xc/programs/Xserver/dbe/dbe.c 3 Jul 2005 07:01:17 -0000 1.5 | |
7 | +++ xc/programs/Xserver/dbe/dbe.c 9 Jan 2007 12:45:54 -0000 | |
8 | @@ -55,6 +55,10 @@ | |
9 | #include "xf86_ansic.h" | |
10 | #endif | |
11 | ||
12 | +#if !defined(UINT32_MAX) | |
13 | +#define UINT32_MAX 0xffffffffU | |
14 | +#endif | |
15 | + | |
16 | /* GLOBALS */ | |
17 | ||
18 | /* Per-screen initialization functions [init'ed by DbeRegisterFunction()] */ | |
19 | @@ -733,11 +737,14 @@ | |
20 | return(Success); | |
21 | } | |
22 | ||
23 | + if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec)) | |
24 | + return BadAlloc; | |
25 | + | |
26 | /* Get to the swap info appended to the end of the request. */ | |
27 | dbeSwapInfo = (xDbeSwapInfo *)&stuff[1]; | |
28 | ||
29 | /* Allocate array to record swap information. */ | |
30 | - swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec)); | |
31 | + swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec)); | |
32 | if (swapInfo == NULL) | |
33 | { | |
34 | return(BadAlloc); | |
35 | @@ -752,14 +759,14 @@ | |
36 | if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client, | |
37 | SecurityWriteAccess))) | |
38 | { | |
39 | - DEALLOCATE_LOCAL(swapInfo); | |
40 | + Xfree(swapInfo); | |
41 | return(BadWindow); | |
42 | } | |
43 | ||
44 | /* Each window must be double-buffered - BadMatch. */ | |
45 | if (DBE_WINDOW_PRIV(pWin) == NULL) | |
46 | { | |
47 | - DEALLOCATE_LOCAL(swapInfo); | |
48 | + Xfree(swapInfo); | |
49 | return(BadMatch); | |
50 | } | |
51 | ||
52 | @@ -768,7 +775,7 @@ | |
53 | { | |
54 | if (dbeSwapInfo[i].window == dbeSwapInfo[j].window) | |
55 | { | |
56 | - DEALLOCATE_LOCAL(swapInfo); | |
57 | + Xfree(swapInfo); | |
58 | return(BadMatch); | |
59 | } | |
60 | } | |
61 | @@ -779,7 +786,7 @@ | |
62 | (dbeSwapInfo[i].swapAction != XdbeUntouched ) && | |
63 | (dbeSwapInfo[i].swapAction != XdbeCopied )) | |
64 | { | |
65 | - DEALLOCATE_LOCAL(swapInfo); | |
66 | + Xfree(swapInfo); | |
67 | return(BadValue); | |
68 | } | |
69 | ||
70 | @@ -809,12 +816,12 @@ | |
71 | error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo); | |
72 | if (error != Success) | |
73 | { | |
74 | - DEALLOCATE_LOCAL(swapInfo); | |
75 | + Xfree(swapInfo); | |
76 | return(error); | |
77 | } | |
78 | } | |
79 | ||
80 | - DEALLOCATE_LOCAL(swapInfo); | |
81 | + Xfree(swapInfo); | |
82 | return(Success); | |
83 | ||
84 | } /* ProcDbeSwapBuffers() */ | |
85 | @@ -898,10 +905,12 @@ | |
86 | ||
87 | REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq); | |
88 | ||
89 | + if (stuff->n > UINT32_MAX / sizeof(DrawablePtr)) | |
90 | + return BadAlloc; | |
91 | /* Make sure any specified drawables are valid. */ | |
92 | if (stuff->n != 0) | |
93 | { | |
94 | - if (!(pDrawables = (DrawablePtr *)ALLOCATE_LOCAL(stuff->n * | |
95 | + if (!(pDrawables = (DrawablePtr *)Xalloc(stuff->n * | |
96 | sizeof(DrawablePtr)))) | |
97 | { | |
98 | return(BadAlloc); | |
99 | @@ -914,7 +923,7 @@ | |
100 | if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable( | |
101 | drawables[i], client, SecurityReadAccess))) | |
102 | { | |
103 | - DEALLOCATE_LOCAL(pDrawables); | |
104 | + Xfree(pDrawables); | |
105 | return(BadDrawable); | |
106 | } | |
107 | } | |
108 | @@ -926,7 +935,7 @@ | |
109 | { | |
110 | if (pDrawables) | |
111 | { | |
112 | - DEALLOCATE_LOCAL(pDrawables); | |
113 | + Xfree(pDrawables); | |
114 | } | |
115 | ||
116 | return(BadAlloc); | |
117 | @@ -953,7 +962,7 @@ | |
118 | /* Free pDrawables if we needed to allocate it above. */ | |
119 | if (pDrawables) | |
120 | { | |
121 | - DEALLOCATE_LOCAL(pDrawables); | |
122 | + Xfree(pDrawables); | |
123 | } | |
124 | ||
125 | return(BadAlloc); | |
126 | @@ -1034,7 +1043,7 @@ | |
127 | ||
128 | if (pDrawables) | |
129 | { | |
130 | - DEALLOCATE_LOCAL(pDrawables); | |
131 | + Xfree(pDrawables); | |
132 | } | |
133 | ||
134 | return(client->noClientException); | |
135 | Index: render/render.c | |
136 | =================================================================== | |
137 | RCS file: /cvs/xorg/xc/programs/Xserver/render/render.c,v | |
138 | retrieving revision 1.12 | |
139 | diff -u -u -r1.12 render.c | |
140 | --- xc/programs/Xserver/render/render.c 28 Aug 2005 19:47:39 -0000 1.12 | |
141 | +++ xc/programs/Xserver/render/render.c 9 Jan 2007 12:45:55 -0000 | |
142 | @@ -52,6 +52,10 @@ | |
143 | #include "xf86_ansic.h" | |
144 | #endif | |
145 | ||
146 | +#if !defined(UINT32_MAX) | |
147 | +#define UINT32_MAX 0xffffffffU | |
148 | +#endif | |
149 | + | |
150 | static int ProcRenderQueryVersion (ClientPtr pClient); | |
151 | static int ProcRenderQueryPictFormats (ClientPtr pClient); | |
152 | static int ProcRenderQueryPictIndexValues (ClientPtr pClient); | |
153 | @@ -1108,11 +1112,14 @@ | |
154 | } | |
155 | ||
156 | nglyphs = stuff->nglyphs; | |
157 | + if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec)) | |
158 | + return BadAlloc; | |
159 | + | |
160 | if (nglyphs <= NLOCALGLYPH) | |
161 | glyphsBase = glyphsLocal; | |
162 | else | |
163 | { | |
164 | - glyphsBase = (GlyphNewPtr) ALLOCATE_LOCAL (nglyphs * sizeof (GlyphNewRec)); | |
165 | + glyphsBase = (GlyphNewPtr) Xalloc (nglyphs * sizeof (GlyphNewRec)); | |
166 | if (!glyphsBase) | |
167 | return BadAlloc; | |
168 | } | |
169 | @@ -1169,7 +1176,7 @@ | |
170 | } | |
171 | ||
172 | if (glyphsBase != glyphsLocal) | |
173 | - DEALLOCATE_LOCAL (glyphsBase); | |
174 | + Xfree (glyphsBase); | |
175 | return client->noClientException; | |
176 | bail: | |
177 | while (glyphs != glyphsBase) | |
178 | @@ -1178,7 +1185,7 @@ | |
179 | xfree (glyphs->glyph); | |
180 | } | |
181 | if (glyphsBase != glyphsLocal) | |
182 | - DEALLOCATE_LOCAL (glyphsBase); | |
183 | + Xfree (glyphsBase); | |
184 | return err; | |
185 | } | |
186 |