aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--nx-X11/CHANGELOG7
-rw-r--r--nx-X11/CHANGELOG.NX.original7
-rw-r--r--nx-X11/lib/font/bitmap/pcfread.c6
-rw-r--r--nx-X11/programs/Xserver/Xext/EVI.c15
-rw-r--r--nx-X11/programs/Xserver/Xext/cup.c3
-rw-r--r--nx-X11/programs/Xserver/Xext/sampleEVI.c29
-rw-r--r--nx-X11/programs/Xserver/Xext/security.c10
-rw-r--r--nx-X11/programs/Xserver/Xext/security.c.NX.original10
-rw-r--r--nx-X11/programs/Xserver/Xext/security.c.X.original6
-rw-r--r--nx-X11/programs/Xserver/Xext/shm.c50
-rw-r--r--nx-X11/programs/Xserver/Xi/chgfctl.c8
-rw-r--r--nx-X11/programs/Xserver/Xi/chgkmap.c15
-rw-r--r--nx-X11/programs/Xserver/Xi/chgprop.c11
-rw-r--r--nx-X11/programs/Xserver/Xi/grabdev.c13
-rw-r--r--nx-X11/programs/Xserver/Xi/grabdevb.c11
-rw-r--r--nx-X11/programs/Xserver/Xi/grabdevk.c10
-rw-r--r--nx-X11/programs/Xserver/Xi/selectev.c12
-rw-r--r--nx-X11/programs/Xserver/Xi/sendexev.c15
-rw-r--r--nx-X11/programs/Xserver/dix/dixfonts.c7
-rw-r--r--nx-X11/programs/Xserver/dix/dixfonts.c.NX.original7
-rw-r--r--nx-X11/programs/Xserver/dix/dixfonts.c.X.original7
-rw-r--r--nx-X11/programs/Xserver/hw/xfree86/common/xf86MiscExt.c4
22 files changed, 174 insertions, 89 deletions
diff --git a/nx-X11/CHANGELOG b/nx-X11/CHANGELOG
index ec5d6f8c2..fe29e19fe 100644
--- a/nx-X11/CHANGELOG
+++ b/nx-X11/CHANGELOG
@@ -1,5 +1,12 @@
ChangeLog:
+nx-X11-3.1.0-4
+
+- Imported patch fixing issues from X.Org security advisory, January
+ 17th, 2008: Multiple vulnerabilities in the X server. CVE IDs:
+ CVE-2007-5760 CVE-2007-5958 CVE-2007-6427 CVE-2007-6428
+ CVE-2007-6429 CVE-2008-0006.
+
nx-X11-3.1.0-3
- Moved a variable definition placed in _mesa_make_current().
diff --git a/nx-X11/CHANGELOG.NX.original b/nx-X11/CHANGELOG.NX.original
index ec5d6f8c2..fe29e19fe 100644
--- a/nx-X11/CHANGELOG.NX.original
+++ b/nx-X11/CHANGELOG.NX.original
@@ -1,5 +1,12 @@
ChangeLog:
+nx-X11-3.1.0-4
+
+- Imported patch fixing issues from X.Org security advisory, January
+ 17th, 2008: Multiple vulnerabilities in the X server. CVE IDs:
+ CVE-2007-5760 CVE-2007-5958 CVE-2007-6427 CVE-2007-6428
+ CVE-2007-6429 CVE-2008-0006.
+
nx-X11-3.1.0-3
- Moved a variable definition placed in _mesa_make_current().
diff --git a/nx-X11/lib/font/bitmap/pcfread.c b/nx-X11/lib/font/bitmap/pcfread.c
index dd76868bf..75916dae8 100644
--- a/nx-X11/lib/font/bitmap/pcfread.c
+++ b/nx-X11/lib/font/bitmap/pcfread.c
@@ -565,6 +565,9 @@ pcfReadFont(FontPtr pFont, FontFilePtr file,
pFont->info.lastRow = pcfGetINT16(file, format);
pFont->info.defaultCh = pcfGetINT16(file, format);
if (IS_EOF(file)) goto Bail;
+ if (pFont->info.firstCol > pFont->info.lastCol ||
+ pFont->info.firstRow > pFont->info.lastRow ||
+ pFont->info.lastCol-pFont->info.firstCol > 255) goto Bail;
nencoding = (pFont->info.lastCol - pFont->info.firstCol + 1) *
(pFont->info.lastRow - pFont->info.firstRow + 1);
@@ -703,6 +706,9 @@ pcfReadFontInfo(FontInfoPtr pFontInfo, FontFilePtr file)
pFontInfo->lastRow = pcfGetINT16(file, format);
pFontInfo->defaultCh = pcfGetINT16(file, format);
if (IS_EOF(file)) goto Bail;
+ if (pFontInfo->firstCol > pFontInfo->lastCol ||
+ pFontInfo->firstRow > pFontInfo->lastRow ||
+ pFontInfo->lastCol-pFontInfo->firstCol > 255) goto Bail;
nencoding = (pFontInfo->lastCol - pFontInfo->firstCol + 1) *
(pFontInfo->lastRow - pFontInfo->firstRow + 1);
diff --git a/nx-X11/programs/Xserver/Xext/EVI.c b/nx-X11/programs/Xserver/Xext/EVI.c
index b59180685..93ed19fa6 100644
--- a/nx-X11/programs/Xserver/Xext/EVI.c
+++ b/nx-X11/programs/Xserver/Xext/EVI.c
@@ -36,6 +36,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
#include <X11/extensions/XEVIstr.h>
#include "EVIstruct.h"
#include "modinit.h"
+#include "scrnintstr.h"
#if 0
static unsigned char XEVIReqCode = 0;
@@ -89,10 +90,22 @@ ProcEVIGetVisualInfo(ClientPtr client)
{
REQUEST(xEVIGetVisualInfoReq);
xEVIGetVisualInfoReply rep;
- int n, n_conflict, n_info, sz_info, sz_conflict;
+ int i, n, n_conflict, n_info, sz_info, sz_conflict;
VisualID32 *conflict;
+ unsigned int total_visuals = 0;
xExtendedVisualInfo *eviInfo;
int status;
+
+ /*
+ * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume
+ * here that you don't have more than 2^32 visuals over all your screens;
+ * this seems like a safe assumption.
+ */
+ for (i = 0; i < screenInfo.numScreens; i++)
+ total_visuals += screenInfo.screens[i]->numVisuals;
+ if (stuff->n_visual > total_visuals)
+ return BadValue;
+
REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
&eviInfo, &n_info, &conflict, &n_conflict);
diff --git a/nx-X11/programs/Xserver/Xext/cup.c b/nx-X11/programs/Xserver/Xext/cup.c
index 4db62cf15..198aa801f 100644
--- a/nx-X11/programs/Xserver/Xext/cup.c
+++ b/nx-X11/programs/Xserver/Xext/cup.c
@@ -202,6 +202,9 @@ int ProcGetReservedColormapEntries(
REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
+ if (stuff->screen >= screenInfo.numScreens)
+ return BadValue;
+
#ifndef HAVE_SPECIAL_DESKTOP_COLORS
citems[CUP_BLACK_PIXEL].pixel =
screenInfo.screens[stuff->screen]->blackPixel;
diff --git a/nx-X11/programs/Xserver/Xext/sampleEVI.c b/nx-X11/programs/Xserver/Xext/sampleEVI.c
index 67caa5613..500a585c9 100644
--- a/nx-X11/programs/Xserver/Xext/sampleEVI.c
+++ b/nx-X11/programs/Xserver/Xext/sampleEVI.c
@@ -36,6 +36,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
#include <X11/extensions/XEVIstr.h>
#include "EVIstruct.h"
#include "scrnintstr.h"
+
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
static int sampleGetVisualInfo(
VisualID32 *visual,
int n_visual,
@@ -44,24 +51,36 @@ static int sampleGetVisualInfo(
VisualID32 **conflict_rn,
int *n_conflict_rn)
{
- int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+ unsigned int max_sz_evi;
VisualID32 *temp_conflict;
xExtendedVisualInfo *evi;
- int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
+ unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
- *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
- if (!*evi_rn)
- return BadAlloc;
+
+ if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
+ return BadAlloc;
+ max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
if (screenInfo.screens[scrI]->numVisuals > max_visuals)
max_visuals = screenInfo.screens[scrI]->numVisuals;
}
+
+ if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens
+ * max_visuals))
+ return BadAlloc;
max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
+
+ *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
+ if (!*evi_rn)
+ return BadAlloc;
+
temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
if (!temp_conflict) {
xfree(*evi_rn);
return BadAlloc;
}
+
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
for (visualI = 0; visualI < n_visual; visualI++) {
evi[sz_evi].core_visual_id = visual[visualI];
diff --git a/nx-X11/programs/Xserver/Xext/security.c b/nx-X11/programs/Xserver/Xext/security.c
index f37be696b..cee89354a 100644
--- a/nx-X11/programs/Xserver/Xext/security.c
+++ b/nx-X11/programs/Xserver/Xext/security.c
@@ -1822,11 +1822,11 @@ SecurityLoadPropertyAccessList(void)
#ifdef NXAGENT_SERVER
- f = fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r");
+ f = Fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r");
#else
- f = fopen(SecurityPolicyFile, "r");
+ f = Fopen(SecurityPolicyFile, "r");
#endif
@@ -1834,11 +1834,11 @@ SecurityLoadPropertyAccessList(void)
#ifdef NXAGENT_SERVER
- f = fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r");
+ f = Fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r");
#else
- f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
+ f = Fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
#endif
@@ -1960,7 +1960,7 @@ SecurityLoadPropertyAccessList(void)
}
#endif /* PROPDEBUG */
- fclose(f);
+ Fclose(f);
} /* SecurityLoadPropertyAccessList */
diff --git a/nx-X11/programs/Xserver/Xext/security.c.NX.original b/nx-X11/programs/Xserver/Xext/security.c.NX.original
index f37be696b..cee89354a 100644
--- a/nx-X11/programs/Xserver/Xext/security.c.NX.original
+++ b/nx-X11/programs/Xserver/Xext/security.c.NX.original
@@ -1822,11 +1822,11 @@ SecurityLoadPropertyAccessList(void)
#ifdef NXAGENT_SERVER
- f = fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r");
+ f = Fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r");
#else
- f = fopen(SecurityPolicyFile, "r");
+ f = Fopen(SecurityPolicyFile, "r");
#endif
@@ -1834,11 +1834,11 @@ SecurityLoadPropertyAccessList(void)
#ifdef NXAGENT_SERVER
- f = fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r");
+ f = Fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r");
#else
- f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
+ f = Fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
#endif
@@ -1960,7 +1960,7 @@ SecurityLoadPropertyAccessList(void)
}
#endif /* PROPDEBUG */
- fclose(f);
+ Fclose(f);
} /* SecurityLoadPropertyAccessList */
diff --git a/nx-X11/programs/Xserver/Xext/security.c.X.original b/nx-X11/programs/Xserver/Xext/security.c.X.original
index 26c842855..765769a7c 100644
--- a/nx-X11/programs/Xserver/Xext/security.c.X.original
+++ b/nx-X11/programs/Xserver/Xext/security.c.X.original
@@ -1647,9 +1647,9 @@ SecurityLoadPropertyAccessList(void)
return;
#ifndef __UNIXOS2__
- f = fopen(SecurityPolicyFile, "r");
+ f = Fopen(SecurityPolicyFile, "r");
#else
- f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
+ f = Fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
#endif
if (!f)
{
@@ -1733,7 +1733,7 @@ SecurityLoadPropertyAccessList(void)
}
#endif /* PROPDEBUG */
- fclose(f);
+ Fclose(f);
} /* SecurityLoadPropertyAccessList */
diff --git a/nx-X11/programs/Xserver/Xext/shm.c b/nx-X11/programs/Xserver/Xext/shm.c
index 806008c60..e2cf8cd24 100644
--- a/nx-X11/programs/Xserver/Xext/shm.c
+++ b/nx-X11/programs/Xserver/Xext/shm.c
@@ -728,6 +728,8 @@ ProcPanoramiXShmCreatePixmap(
int i, j, result;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
+ unsigned int width, height, depth;
+ unsigned long size;
PanoramiXRes *newPix;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
@@ -737,11 +739,18 @@ ProcPanoramiXShmCreatePixmap(
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
- if (!stuff->width || !stuff->height)
+
+ width = stuff->width;
+ height = stuff->height;
+ depth = stuff->depth;
+ if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
+ if (width > 32767 || height > 32767)
+ return BadAlloc;
+
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
@@ -751,10 +760,18 @@ ProcPanoramiXShmCreatePixmap(
client->errorValue = stuff->depth;
return BadValue;
}
+
CreatePmap:
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
- client);
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
return BadAlloc;
@@ -1052,6 +1069,8 @@ ProcShmCreatePixmap(client)
register int i;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
+ unsigned int width, height, depth;
+ unsigned long size;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
client->errorValue = stuff->pid;
@@ -1060,11 +1079,18 @@ ProcShmCreatePixmap(client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
- if (!stuff->width || !stuff->height)
+
+ width = stuff->width;
+ height = stuff->height;
+ depth = stuff->depth;
+ if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
+ if (width > 32767 || height > 32767)
+ return BadAlloc;
+
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
@@ -1074,10 +1100,18 @@ ProcShmCreatePixmap(client)
client->errorValue = stuff->depth;
return BadValue;
}
+
CreatePmap:
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
- client);
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
pDraw->pScreen, stuff->width,
stuff->height, stuff->depth,
diff --git a/nx-X11/programs/Xserver/Xi/chgfctl.c b/nx-X11/programs/Xserver/Xi/chgfctl.c
index c502db325..fe8bd1fac 100644
--- a/nx-X11/programs/Xserver/Xi/chgfctl.c
+++ b/nx-X11/programs/Xserver/Xi/chgfctl.c
@@ -506,7 +506,6 @@ ChangeStringFeedback (client, dev, mask, s, f)
xStringFeedbackCtl *f;
{
register char n;
- register long *p;
int i, j;
KeySym *syms, *sup_syms;
@@ -514,12 +513,7 @@ ChangeStringFeedback (client, dev, mask, s, f)
if (client->swapped)
{
swaps(&f->length,n); /* swapped num_keysyms in calling proc */
- p = (long *) (syms);
- for (i=0; i<f->num_keysyms; i++)
- {
- swapl(p, n);
- p++;
- }
+ SwapLongs((CARD32 *) syms, f->num_keysyms);
}
if (f->num_keysyms > s->ctrl.max_symbols)
diff --git a/nx-X11/programs/Xserver/Xi/chgkmap.c b/nx-X11/programs/Xserver/Xi/chgkmap.c
index 6b2a15aa2..3df376d9a 100644
--- a/nx-X11/programs/Xserver/Xi/chgkmap.c
+++ b/nx-X11/programs/Xserver/Xi/chgkmap.c
@@ -83,19 +83,14 @@ SProcXChangeDeviceKeyMapping(client)
register ClientPtr client;
{
register char n;
- register long *p;
- register int i, count;
+ unsigned int count;
REQUEST(xChangeDeviceKeyMappingReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
- p = (long *) &stuff[1];
count = stuff->keyCodes * stuff->keySymsPerKeyCode;
- for (i = 0; i < count; i++)
- {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), count);
return(ProcXChangeDeviceKeyMapping(client));
}
@@ -112,10 +107,14 @@ ProcXChangeDeviceKeyMapping(client)
int ret;
unsigned len;
DeviceIntPtr dev;
+ unsigned int count;
REQUEST(xChangeDeviceKeyMappingReq);
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
+ count = stuff->keyCodes * stuff->keySymsPerKeyCode;
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+
dev = LookupDeviceIntRec (stuff->deviceid);
if (dev == NULL)
{
diff --git a/nx-X11/programs/Xserver/Xi/chgprop.c b/nx-X11/programs/Xserver/Xi/chgprop.c
index 20c654e2f..6e345d554 100644
--- a/nx-X11/programs/Xserver/Xi/chgprop.c
+++ b/nx-X11/programs/Xserver/Xi/chgprop.c
@@ -85,20 +85,15 @@ SProcXChangeDeviceDontPropagateList(client)
register ClientPtr client;
{
register char n;
- register long *p;
- register int i;
REQUEST(xChangeDeviceDontPropagateListReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
swapl(&stuff->window, n);
swaps(&stuff->count, n);
- p = (long *) &stuff[1];
- for (i=0; i<stuff->count; i++)
- {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
+ stuff->count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
return(ProcXChangeDeviceDontPropagateList(client));
}
diff --git a/nx-X11/programs/Xserver/Xi/grabdev.c b/nx-X11/programs/Xserver/Xi/grabdev.c
index 3b124a0f4..21e920a35 100644
--- a/nx-X11/programs/Xserver/Xi/grabdev.c
+++ b/nx-X11/programs/Xserver/Xi/grabdev.c
@@ -87,8 +87,6 @@ SProcXGrabDevice(client)
register ClientPtr client;
{
register char n;
- register long *p;
- register int i;
REQUEST(xGrabDeviceReq);
swaps(&stuff->length, n);
@@ -96,12 +94,11 @@ SProcXGrabDevice(client)
swapl(&stuff->grabWindow, n);
swapl(&stuff->time, n);
swaps(&stuff->event_count, n);
- p = (long *) &stuff[1];
- for (i=0; i<stuff->event_count; i++)
- {
- swapl(p, n);
- p++;
- }
+
+ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
+ return BadLength;
+
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return(ProcXGrabDevice(client));
}
diff --git a/nx-X11/programs/Xserver/Xi/grabdevb.c b/nx-X11/programs/Xserver/Xi/grabdevb.c
index 84f061086..ad43c29a0 100644
--- a/nx-X11/programs/Xserver/Xi/grabdevb.c
+++ b/nx-X11/programs/Xserver/Xi/grabdevb.c
@@ -84,8 +84,6 @@ SProcXGrabDeviceButton(client)
register ClientPtr client;
{
register char n;
- register long *p;
- register int i;
REQUEST(xGrabDeviceButtonReq);
swaps(&stuff->length, n);
@@ -93,12 +91,9 @@ SProcXGrabDeviceButton(client)
swapl(&stuff->grabWindow, n);
swaps(&stuff->modifiers, n);
swaps(&stuff->event_count, n);
- p = (long *) &stuff[1];
- for (i=0; i<stuff->event_count; i++)
- {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
+ stuff->event_count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return(ProcXGrabDeviceButton(client));
}
diff --git a/nx-X11/programs/Xserver/Xi/grabdevk.c b/nx-X11/programs/Xserver/Xi/grabdevk.c
index 17a9a9cf6..952c5d89a 100644
--- a/nx-X11/programs/Xserver/Xi/grabdevk.c
+++ b/nx-X11/programs/Xserver/Xi/grabdevk.c
@@ -84,8 +84,6 @@ SProcXGrabDeviceKey(client)
register ClientPtr client;
{
register char n;
- register long *p;
- register int i;
REQUEST(xGrabDeviceKeyReq);
swaps(&stuff->length, n);
@@ -93,12 +91,8 @@ SProcXGrabDeviceKey(client)
swapl(&stuff->grabWindow, n);
swaps(&stuff->modifiers, n);
swaps(&stuff->event_count, n);
- p = (long *) &stuff[1];
- for (i=0; i<stuff->event_count; i++)
- {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return(ProcXGrabDeviceKey(client));
}
diff --git a/nx-X11/programs/Xserver/Xi/selectev.c b/nx-X11/programs/Xserver/Xi/selectev.c
index c8a55f5b0..a9b731864 100644
--- a/nx-X11/programs/Xserver/Xi/selectev.c
+++ b/nx-X11/programs/Xserver/Xi/selectev.c
@@ -88,20 +88,16 @@ SProcXSelectExtensionEvent (client)
register ClientPtr client;
{
register char n;
- register long *p;
- register int i;
REQUEST(xSelectExtensionEventReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
swapl(&stuff->window, n);
swaps(&stuff->count, n);
- p = (long *) &stuff[1];
- for (i=0; i<stuff->count; i++)
- {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
+ stuff->count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
+
return(ProcXSelectExtensionEvent(client));
}
diff --git a/nx-X11/programs/Xserver/Xi/sendexev.c b/nx-X11/programs/Xserver/Xi/sendexev.c
index c005aecab..9b441f2d8 100644
--- a/nx-X11/programs/Xserver/Xi/sendexev.c
+++ b/nx-X11/programs/Xserver/Xi/sendexev.c
@@ -87,7 +87,7 @@ SProcXSendExtensionEvent(client)
register ClientPtr client;
{
register char n;
- register long *p;
+ CARD32 *p;
register int i;
xEvent eventT;
xEvent *eventP;
@@ -98,6 +98,11 @@ SProcXSendExtensionEvent(client)
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
swapl(&stuff->destination, n);
swaps(&stuff->count, n);
+
+ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
+ (stuff->num_events * (sizeof(xEvent) >> 2)))
+ return BadLength;
+
eventP = (xEvent *) &stuff[1];
for (i=0; i<stuff->num_events; i++,eventP++)
{
@@ -108,12 +113,8 @@ SProcXSendExtensionEvent(client)
*eventP = eventT;
}
- p = (long *) (((xEvent *) &stuff[1]) + stuff->num_events);
- for (i=0; i<stuff->count; i++)
- {
- swapl(p, n);
- p++;
- }
+ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);
+ SwapLongs(p, stuff->count);
return(ProcXSendExtensionEvent(client));
}
diff --git a/nx-X11/programs/Xserver/dix/dixfonts.c b/nx-X11/programs/Xserver/dix/dixfonts.c
index e62f61432..b66fe23bd 100644
--- a/nx-X11/programs/Xserver/dix/dixfonts.c
+++ b/nx-X11/programs/Xserver/dix/dixfonts.c
@@ -393,6 +393,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
err = BadFontName;
goto bail;
}
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
+ if (pfont->info.firstCol > pfont->info.lastCol ||
+ pfont->info.firstRow > pfont->info.lastRow ||
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
+ err = AllocError;
+ goto bail;
+ }
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;
diff --git a/nx-X11/programs/Xserver/dix/dixfonts.c.NX.original b/nx-X11/programs/Xserver/dix/dixfonts.c.NX.original
index e62f61432..b66fe23bd 100644
--- a/nx-X11/programs/Xserver/dix/dixfonts.c.NX.original
+++ b/nx-X11/programs/Xserver/dix/dixfonts.c.NX.original
@@ -393,6 +393,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
err = BadFontName;
goto bail;
}
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
+ if (pfont->info.firstCol > pfont->info.lastCol ||
+ pfont->info.firstRow > pfont->info.lastRow ||
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
+ err = AllocError;
+ goto bail;
+ }
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;
diff --git a/nx-X11/programs/Xserver/dix/dixfonts.c.X.original b/nx-X11/programs/Xserver/dix/dixfonts.c.X.original
index 9de998417..2c5874e8d 100644
--- a/nx-X11/programs/Xserver/dix/dixfonts.c.X.original
+++ b/nx-X11/programs/Xserver/dix/dixfonts.c.X.original
@@ -336,6 +336,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
err = BadFontName;
goto bail;
}
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
+ if (pfont->info.firstCol > pfont->info.lastCol ||
+ pfont->info.firstRow > pfont->info.lastRow ||
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
+ err = AllocError;
+ goto bail;
+ }
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;
diff --git a/nx-X11/programs/Xserver/hw/xfree86/common/xf86MiscExt.c b/nx-X11/programs/Xserver/hw/xfree86/common/xf86MiscExt.c
index 54c0cd510..de4802744 100644
--- a/nx-X11/programs/Xserver/hw/xfree86/common/xf86MiscExt.c
+++ b/nx-X11/programs/Xserver/hw/xfree86/common/xf86MiscExt.c
@@ -647,6 +647,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval,
DEBUG_P("MiscExtPassMessage");
+ /* should check this in the protocol, but xf86NumScreens isn't exported */
+ if (scrnIndex >= xf86NumScreens)
+ return BadValue;
+
if (*pScr->HandleMessage == NULL)
return BadImplementation;
return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);