aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
diff options
context:
space:
mode:
authorReinhard Tartler <siretart@tauware.de>2011-10-10 17:58:31 +0200
committerReinhard Tartler <siretart@tauware.de>2011-10-10 17:58:31 +0200
commit1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a (patch)
tree56b1d4196538a8abb7747e8455b59aa778d6b948 /nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
parent266b5554943baffafbf1d574f567283cc9792278 (diff)
downloadnx-libs-1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a.tar.gz
nx-libs-1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a.tar.bz2
nx-libs-1c25e92b9ea5811d8ab9c2bfdc0dcb2e4d21bd0a.zip
Imported nxagent-3.2.0-10.tar.gznxagent/3.2.0-10
Summary: Imported nxagent-3.2.0-10.tar.gz Keywords: Imported nxagent-3.2.0-10.tar.gz into Git repository
Diffstat (limited to 'nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c')
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c18
1 files changed, 14 insertions, 4 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
index 00c55cde7..de2df855f 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
@@ -1893,6 +1893,8 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height;
+ if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+ return BadAlloc;
if ( stuff->x > width
|| stuff->y > height )
return (BadMatch);
@@ -2353,6 +2355,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -2955,18 +2959,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client);
}
-static void swapStops(void *stuff, int n)
+static void swapStops(void *stuff, int num)
{
- int i;
+ int i, n;
CARD32 *stops;
CARD16 *colors;
stops = (CARD32 *)(stuff);
- for (i = 0; i < n; ++i) {
+ for (i = 0; i < num; ++i) {
swapl(stops, n);
++stops;
}
colors = (CARD16 *)(stops);
- for (i = 0; i < 4*n; ++i) {
+ for (i = 0; i < 4*num; ++i) {
swaps(stops, n);
++stops;
}
@@ -2989,6 +2993,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -3016,6 +3022,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -3040,6 +3048,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;