diff options
| author | Adam Jackson <ajax@redhat.com> | 2014-11-10 12:13:47 -0500 |
|---|---|---|
| committer | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> | 2015-02-14 16:14:32 +0100 |
| commit | 8931066077a04999d973932e04da577bd6906c82 (patch) | |
| tree | 1e6c672df74f3a65848772b8365b2cdd26847fc3 /nx-X11/programs/Xserver/GL/glx/single2swap.c | |
| parent | ad29acd7697e18333e164b1746f61c5a9e29a436 (diff) | |
| download | nx-libs-8931066077a04999d973932e04da577bd6906c82.tar.gz nx-libs-8931066077a04999d973932e04da577bd6906c82.tar.bz2 nx-libs-8931066077a04999d973932e04da577bd6906c82.zip | |
glx: Length checking for non-generated single requests (v2) [CVE-2014-8098 7/8]
v2:
Fix single versus vendor-private length checking for ARB_imaging subset
extensions. (Julien Cristau)
v3:
Fix single versus vendor-private length checking for ARB_imaging subset
extensions. (Julien Cristau)
v4: backport to nx-libs 3.6.x (Mike DePaulo)
Reviewed-by: Michal Srb <msrb@suse.com>
Reviewed-by: Andy Ritger <aritger@nvidia.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Fedora X Ninjas <x@fedoraproject.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
fix safe_Add
Diffstat (limited to 'nx-X11/programs/Xserver/GL/glx/single2swap.c')
| -rw-r--r-- | nx-X11/programs/Xserver/GL/glx/single2swap.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/nx-X11/programs/Xserver/GL/glx/single2swap.c b/nx-X11/programs/Xserver/GL/glx/single2swap.c index dab98ade9..4b8541bf2 100644 --- a/nx-X11/programs/Xserver/GL/glx/single2swap.c +++ b/nx-X11/programs/Xserver/GL/glx/single2swap.c @@ -48,12 +48,14 @@ int __glXDispSwap_FeedbackBuffer(__GLXclientState *cl, GLbyte *pc) { + ClientPtr client = cl->client; GLsizei size; GLenum type; __GLX_DECLARE_SWAP_VARIABLES; __GLXcontext *cx; int error; + REQUEST_FIXED_SIZE(xGLXSingleReq, 8); __GLX_SWAP_INT(&((xGLXSingleReq *)pc)->contextTag); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { @@ -82,11 +84,13 @@ int __glXDispSwap_FeedbackBuffer(__GLXclientState *cl, GLbyte *pc) int __glXDispSwap_SelectBuffer(__GLXclientState *cl, GLbyte *pc) { + ClientPtr client = cl->client; __GLXcontext *cx; GLsizei size; __GLX_DECLARE_SWAP_VARIABLES; int error; + REQUEST_FIXED_SIZE(xGLXSingleReq, 4); __GLX_SWAP_INT(&((xGLXSingleReq *)pc)->contextTag); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { @@ -113,7 +117,7 @@ int __glXDispSwap_SelectBuffer(__GLXclientState *cl, GLbyte *pc) int __glXDispSwap_RenderMode(__GLXclientState *cl, GLbyte *pc) { - ClientPtr client; + ClientPtr client = cl->client; __GLXcontext *cx; xGLXRenderModeReply reply; GLint nitems=0, retBytes=0, retval, newModeCheck; @@ -123,6 +127,8 @@ int __glXDispSwap_RenderMode(__GLXclientState *cl, GLbyte *pc) __GLX_DECLARE_SWAP_ARRAY_VARIABLES; int error; + REQUEST_FIXED_SIZE(xGLXSingleReq, 4); + __GLX_SWAP_INT(&((xGLXSingleReq *)pc)->contextTag); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { @@ -201,7 +207,6 @@ int __glXDispSwap_RenderMode(__GLXclientState *cl, GLbyte *pc) ** selection array, as per the API for glRenderMode itself. */ noChangeAllowed:; - client = cl->client; reply.length = nitems; reply.type = X_Reply; reply.sequenceNumber = client->sequence; @@ -222,10 +227,12 @@ int __glXDispSwap_RenderMode(__GLXclientState *cl, GLbyte *pc) int __glXDispSwap_Flush(__GLXclientState *cl, GLbyte *pc) { + ClientPtr client = cl->client; __GLXcontext *cx; int error; __GLX_DECLARE_SWAP_VARIABLES; + REQUEST_SIZE_MATCH(xGLXSingleReq); __GLX_SWAP_INT(&((xGLXSingleReq *)pc)->contextTag); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { @@ -239,11 +246,12 @@ int __glXDispSwap_Flush(__GLXclientState *cl, GLbyte *pc) int __glXDispSwap_Finish(__GLXclientState *cl, GLbyte *pc) { + ClientPtr client = cl->client; __GLXcontext *cx; - ClientPtr client; int error; __GLX_DECLARE_SWAP_VARIABLES; + REQUEST_SIZE_MATCH(xGLXSingleReq); __GLX_SWAP_INT(&((xGLXSingleReq *)pc)->contextTag); cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc), &error); if (!cx) { @@ -255,7 +263,6 @@ int __glXDispSwap_Finish(__GLXclientState *cl, GLbyte *pc) __GLX_NOTE_FLUSHED_CMDS(cx); /* Send empty reply packet to indicate finish is finished */ - client = cl->client; __GLX_BEGIN_REPLY(0); __GLX_PUT_RETVAL(0); __GLX_SWAP_REPLY_HEADER(); |