diff options
author | Reinhard Tartler <siretart@tauware.de> | 2011-10-10 17:46:43 +0200 |
---|---|---|
committer | Reinhard Tartler <siretart@tauware.de> | 2011-10-10 17:46:43 +0200 |
commit | 3d1c57d5ef429e51ab7a626540c30b81e74a8f17 (patch) | |
tree | 2589846dd73cb0a86156fc5f2575ea2373431a57 /nx-X11/programs/Xserver/Xext/shm.c | |
parent | 844a4094f098684dd1da5bc11e73479fb61373a3 (diff) | |
download | nx-libs-3d1c57d5ef429e51ab7a626540c30b81e74a8f17.tar.gz nx-libs-3d1c57d5ef429e51ab7a626540c30b81e74a8f17.tar.bz2 nx-libs-3d1c57d5ef429e51ab7a626540c30b81e74a8f17.zip |
Imported nx-X11-3.1.0-4.tar.gznx-X11/3.1.0-4
Summary: Imported nx-X11-3.1.0-4.tar.gz
Keywords:
Imported nx-X11-3.1.0-4.tar.gz
into Git repository
Diffstat (limited to 'nx-X11/programs/Xserver/Xext/shm.c')
-rw-r--r-- | nx-X11/programs/Xserver/Xext/shm.c | 50 |
1 files changed, 42 insertions, 8 deletions
diff --git a/nx-X11/programs/Xserver/Xext/shm.c b/nx-X11/programs/Xserver/Xext/shm.c index 806008c60..e2cf8cd24 100644 --- a/nx-X11/programs/Xserver/Xext/shm.c +++ b/nx-X11/programs/Xserver/Xext/shm.c @@ -728,6 +728,8 @@ ProcPanoramiXShmCreatePixmap( int i, j, result; ShmDescPtr shmdesc; REQUEST(xShmCreatePixmapReq); + unsigned int width, height, depth; + unsigned long size; PanoramiXRes *newPix; REQUEST_SIZE_MATCH(xShmCreatePixmapReq); @@ -737,11 +739,18 @@ ProcPanoramiXShmCreatePixmap( LEGAL_NEW_RESOURCE(stuff->pid, client); VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client); VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); - if (!stuff->width || !stuff->height) + + width = stuff->width; + height = stuff->height; + depth = stuff->depth; + if (!width || !height || !depth) { client->errorValue = 0; return BadValue; } + if (width > 32767 || height > 32767) + return BadAlloc; + if (stuff->depth != 1) { pDepth = pDraw->pScreen->allowedDepths; @@ -751,10 +760,18 @@ ProcPanoramiXShmCreatePixmap( client->errorValue = stuff->depth; return BadValue; } + CreatePmap: - VERIFY_SHMSIZE(shmdesc, stuff->offset, - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, - client); + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + } + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) return BadAlloc; @@ -1052,6 +1069,8 @@ ProcShmCreatePixmap(client) register int i; ShmDescPtr shmdesc; REQUEST(xShmCreatePixmapReq); + unsigned int width, height, depth; + unsigned long size; REQUEST_SIZE_MATCH(xShmCreatePixmapReq); client->errorValue = stuff->pid; @@ -1060,11 +1079,18 @@ ProcShmCreatePixmap(client) LEGAL_NEW_RESOURCE(stuff->pid, client); VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client); VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); - if (!stuff->width || !stuff->height) + + width = stuff->width; + height = stuff->height; + depth = stuff->depth; + if (!width || !height || !depth) { client->errorValue = 0; return BadValue; } + if (width > 32767 || height > 32767) + return BadAlloc; + if (stuff->depth != 1) { pDepth = pDraw->pScreen->allowedDepths; @@ -1074,10 +1100,18 @@ ProcShmCreatePixmap(client) client->errorValue = stuff->depth; return BadValue; } + CreatePmap: - VERIFY_SHMSIZE(shmdesc, stuff->offset, - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, - client); + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + } + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( pDraw->pScreen, stuff->width, stuff->height, stuff->depth, |