aboutsummaryrefslogtreecommitdiff
path: root/debian/patches/110_nxagent_createpixmap-bounds-check.patch
diff options
context:
space:
mode:
authorMike Gabriel <mike.gabriel@das-netzwerkteam.de>2011-12-29 11:01:23 +0100
committerMike Gabriel <mike.gabriel@das-netzwerkteam.de>2011-12-29 11:01:23 +0100
commitdda2c7cd629ebd5e3ad3441708cb835bb92dcd54 (patch)
treec533932a4c96b4fe5b67d781601b95ad3cdcec47 /debian/patches/110_nxagent_createpixmap-bounds-check.patch
parentc93ae969714ee4c0a3564ebde5e6927ddb14e690 (diff)
downloadnx-libs-dda2c7cd629ebd5e3ad3441708cb835bb92dcd54.tar.gz
nx-libs-dda2c7cd629ebd5e3ad3441708cb835bb92dcd54.tar.bz2
nx-libs-dda2c7cd629ebd5e3ad3441708cb835bb92dcd54.zip
Rename patch: 008_nxproxy_add-nx-proxy-wrapper.patch to 008_nxproxy_add-nxproxy-wrapper.patch. Add patch from FreeNX patchset: 110_nxagent_createpixmap-bounds-check.patch.
Diffstat (limited to 'debian/patches/110_nxagent_createpixmap-bounds-check.patch')
-rw-r--r--debian/patches/110_nxagent_createpixmap-bounds-check.patch26
1 files changed, 26 insertions, 0 deletions
diff --git a/debian/patches/110_nxagent_createpixmap-bounds-check.patch b/debian/patches/110_nxagent_createpixmap-bounds-check.patch
new file mode 100644
index 000000000..a5d4c3afa
--- /dev/null
+++ b/debian/patches/110_nxagent_createpixmap-bounds-check.patch
@@ -0,0 +1,26 @@
+--- a/nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c
++++ b/nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c
+@@ -1973,6 +1973,23 @@
+ client->errorValue = 0;
+ return BadValue;
+ }
++ if (stuff->width > 32767 || stuff->height > 32767)
++ {
++ /* It is allowed to try and allocate a pixmap which is larger than
++ * 32767 in either dimension. However, all of the framebuffer code
++ * is buggy and does not reliably draw to such big pixmaps, basically
++ * because the Region data structure operates with signed shorts
++ * for the rectangles in it.
++ *
++ * Furthermore, several places in the X server computes the
++ * size in bytes of the pixmap and tries to store it in an
++ * integer. This integer can overflow and cause the allocated size
++ * to be much smaller.
++ *
++ * So, such big pixmaps are rejected here with a BadAlloc
++ */
++ return BadAlloc;
++ }
+ if (stuff->depth != 1)
+ {
+ pDepth = pDraw->pScreen->allowedDepths;