diff options
Diffstat (limited to 'debian/patches/1040-glx-Pass-remaining-request-length-into-varsize-.full.patch')
| -rw-r--r-- | debian/patches/1040-glx-Pass-remaining-request-length-into-varsize-.full.patch | 611 |
1 files changed, 0 insertions, 611 deletions
diff --git a/debian/patches/1040-glx-Pass-remaining-request-length-into-varsize-.full.patch b/debian/patches/1040-glx-Pass-remaining-request-length-into-varsize-.full.patch deleted file mode 100644 index dd3269190..000000000 --- a/debian/patches/1040-glx-Pass-remaining-request-length-into-varsize-.full.patch +++ /dev/null @@ -1,611 +0,0 @@ -From 1ea1cd8c4f93b0c03e5b34fe174b3fc9f27c7dfa Mon Sep 17 00:00:00 2001 -From: Adam Jackson <ajax@redhat.com> -Date: Mon, 10 Nov 2014 12:13:48 -0500 -Subject: [PATCH 40/40] glx: Pass remaining request length into ->varsize (v2) - [CVE-2014-8098 8/8] (V3) - -v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) - -v3: RHEL5 backport - -v4: backport to nx-libs 3.6.x (Mike DePaulo) - -Reviewed-by: Julien Cristau <jcristau@debian.org> -Reviewed-by: Michal Srb <msrb@suse.com> -Reviewed-by: Andy Ritger <aritger@nvidia.com> -Signed-off-by: Adam Jackson <ajax@redhat.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Signed-off-by: Fedora X Ninjas <x@fedoraproject.org> -Signed-off-by: Dave Airlie <airlied@redhat.com> ---- - nx-X11/programs/Xserver/GL/glx/glxcmds.c | 6 +- - nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c | 7 +- - nx-X11/programs/Xserver/GL/glx/glxserver.h | 90 +++++++++---------- - nx-X11/programs/Xserver/GL/glx/rensize.c | 125 ++++++++++++++------------- - 4 files changed, 121 insertions(+), 107 deletions(-) - ---- a/nx-X11/programs/Xserver/GL/glx/glxcmds.c -+++ b/nx-X11/programs/Xserver/GL/glx/glxcmds.c -@@ -1490,7 +1490,7 @@ int __glXRender(__GLXclientState *cl, GL - - if (entry->varsize) { - /* variable size command */ -- extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, False); -+ extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, False, left - __GLX_RENDER_HDR_SIZE); - if (extra < 0) { - return BadLength; - } -@@ -1563,6 +1563,7 @@ int __glXRenderLarge(__GLXclientState *c - if (cl->largeCmdRequestsSoFar == 0) { - __GLXrenderSizeData *entry; - int extra = 0, cmdlen; -+ int left = (req->length << 2) - sz_xGLXRenderLargeReq; - /* - ** This is the first request of a multi request command. - ** Make enough space in the buffer, then copy the entire request. -@@ -1608,7 +1609,8 @@ int __glXRenderLarge(__GLXclientState *c - ** be computed from its parameters), all the parameters needed - ** will be in the 1st request, so it's okay to do this. - */ -- extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, False); -+ extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, False, -+ left - __GLX_RENDER_LARGE_HDR_SIZE); - if (extra < 0) { - return BadLength; - } ---- a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c -+++ b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c -@@ -541,7 +541,8 @@ int __glXSwapRender(__GLXclientState *cl - - if (entry->varsize) { - /* variable size command */ -- extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, True); -+ extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, True, -+ left - __GLX_RENDER_HDR_SIZE); - if (extra < 0) { - return BadLength; - } -@@ -620,6 +621,7 @@ int __glXSwapRenderLarge(__GLXclientStat - if (cl->largeCmdRequestsSoFar == 0) { - __GLXrenderSizeData *entry; - int extra = 0; -+ int left = (req->length << 2) - sz_xGLXRenderLargeReq; - size_t cmdlen; - /* - ** This is the first request of a multi request command. -@@ -667,7 +669,8 @@ int __glXSwapRenderLarge(__GLXclientStat - ** be computed from its parameters), all the parameters needed - ** will be in the 1st request, so it's okay to do this. - */ -- extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, True); -+ extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, True, -+ left - __GLX_RENDER_LARGE_HDR_SIZE); - if (extra < 0) { - return BadLength; - } ---- a/nx-X11/programs/Xserver/GL/glx/glxserver.h -+++ b/nx-X11/programs/Xserver/GL/glx/glxserver.h -@@ -179,7 +179,7 @@ extern __GLXprocPtr __glXProcTable[]; - */ - typedef struct { - int bytes; -- int (*varsize)(GLbyte *pc, Bool swap); -+ int (*varsize)(GLbyte *pc, Bool swap, int left); - } __GLXrenderSizeData; - extern __GLXrenderSizeData __glXRenderSizeTable[]; - extern __GLXrenderSizeData __glXRenderSizeTable_EXT[]; -@@ -271,48 +271,48 @@ extern int __glXImageSize(GLenum format, - GLint imageHeight, GLint rowLength, GLint skipImages, GLint skipRows, - GLint alignment); - --extern int __glXCallListsReqSize(GLbyte *pc, Bool swap); --extern int __glXBitmapReqSize(GLbyte *pc, Bool swap); --extern int __glXFogfvReqSize(GLbyte *pc, Bool swap); --extern int __glXFogivReqSize(GLbyte *pc, Bool swap); --extern int __glXLightfvReqSize(GLbyte *pc, Bool swap); --extern int __glXLightivReqSize(GLbyte *pc, Bool swap); --extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap); --extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap); --extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap); --extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap); --extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap); --extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap); --extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap); --extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap); --extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap); --extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap); --extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap); --extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap); --extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap); --extern int __glXMap1dReqSize(GLbyte *pc, Bool swap); --extern int __glXMap1fReqSize(GLbyte *pc, Bool swap); --extern int __glXMap2dReqSize(GLbyte *pc, Bool swap); --extern int __glXMap2fReqSize(GLbyte *pc, Bool swap); --extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap); --extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap); --extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap); --extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap); --extern int __glXDrawArraysSize(GLbyte *pc, Bool swap); --extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap); --extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap); --extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap); --extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ); --extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap); --extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap); --extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap); --extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap); --extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap); --extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap); --extern int __glXColorTableReqSize(GLbyte *pc, Bool swap); --extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap); --extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap); --extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap); -+extern int __glXCallListsReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXBitmapReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXFogfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXFogivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXLightfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXLightivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXMap1dReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXMap1fReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXMap2dReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXMap2fReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXDrawArraysSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap, int reqlen ); -+extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXColorTableReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); - - /* - * Routines for computing the size of returned data. -@@ -322,7 +322,7 @@ extern int __glXConvolutionParameterfvSi - extern int __glXColorTableParameterfvSize(GLenum pname); - extern int __glXColorTableParameterivSize(GLenum pname); - --extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap); --extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap); -+extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap, int reqlen); -+extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); - - #endif /* !__GLX_server_h__ */ ---- a/nx-X11/programs/Xserver/GL/glx/rensize.c -+++ b/nx-X11/programs/Xserver/GL/glx/rensize.c -@@ -48,7 +48,7 @@ - (((a & 0xff000000U)>>24) | ((a & 0xff0000U)>>8) | \ - ((a & 0xff00U)<<8) | ((a & 0xffU)<<24)) - --int __glXCallListsReqSize(GLbyte *pc, Bool swap ) -+int __glXCallListsReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLsizei n = *(GLsizei *)(pc + 0); - GLenum type = *(GLenum *)(pc + 4); -@@ -60,7 +60,7 @@ int __glXCallListsReqSize(GLbyte *pc, Bo - return n * __glCallLists_size( type ); - } - --int __glXFogivReqSize(GLbyte *pc, Bool swap ) -+int __glXFogivReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 0); - if (swap) { -@@ -69,12 +69,12 @@ int __glXFogivReqSize(GLbyte *pc, Bool s - return 4 * __glFogiv_size( pname ); /* defined in samplegl lib */ - } - --int __glXFogfvReqSize(GLbyte *pc, Bool swap ) -+int __glXFogfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXFogivReqSize( pc, swap ); -+ return __glXFogivReqSize( pc, swap, reqlen); - } - --int __glXLightfvReqSize(GLbyte *pc, Bool swap ) -+int __glXLightfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -83,12 +83,12 @@ int __glXLightfvReqSize(GLbyte *pc, Bool - return 4 * __glLightfv_size( pname ); /* defined in samplegl lib */ - } - --int __glXLightivReqSize(GLbyte *pc, Bool swap ) -+int __glXLightivReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXLightfvReqSize( pc, swap ); -+ return __glXLightfvReqSize( pc, swap, reqlen); - } - --int __glXLightModelfvReqSize(GLbyte *pc, Bool swap ) -+int __glXLightModelfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 0); - if (swap) { -@@ -97,12 +97,12 @@ int __glXLightModelfvReqSize(GLbyte *pc, - return 4 * __glLightModelfv_size( pname ); /* defined in samplegl lib */ - } - --int __glXLightModelivReqSize(GLbyte *pc, Bool swap ) -+int __glXLightModelivReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXLightModelfvReqSize( pc, swap ); -+ return __glXLightModelfvReqSize( pc, swap, reqlen); - } - --int __glXMaterialfvReqSize(GLbyte *pc, Bool swap ) -+int __glXMaterialfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -111,12 +111,12 @@ int __glXMaterialfvReqSize(GLbyte *pc, B - return 4 * __glMaterialfv_size( pname ); /* defined in samplegl lib */ - } - --int __glXMaterialivReqSize(GLbyte *pc, Bool swap ) -+int __glXMaterialivReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXMaterialfvReqSize( pc, swap ); -+ return __glXMaterialfvReqSize( pc, swap, reqlen); - } - --int __glXTexGendvReqSize(GLbyte *pc, Bool swap ) -+int __glXTexGendvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -125,7 +125,7 @@ int __glXTexGendvReqSize(GLbyte *pc, Boo - return 8 * __glTexGendv_size( pname ); /* defined in samplegl lib */ - } - --int __glXTexGenfvReqSize(GLbyte *pc, Bool swap ) -+int __glXTexGenfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -134,12 +134,12 @@ int __glXTexGenfvReqSize(GLbyte *pc, Boo - return 4 * __glTexGenfv_size( pname ); /* defined in samplegl lib */ - } - --int __glXTexGenivReqSize(GLbyte *pc, Bool swap ) -+int __glXTexGenivReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXTexGenfvReqSize( pc, swap ); -+ return __glXTexGenfvReqSize( pc, swap, reqlen); - } - --int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap ) -+int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -148,12 +148,12 @@ int __glXTexParameterfvReqSize(GLbyte *p - return 4 * __glTexParameterfv_size( pname ); /* defined in samplegl lib */ - } - --int __glXTexParameterivReqSize(GLbyte *pc, Bool swap ) -+int __glXTexParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXTexParameterfvReqSize( pc, swap ); -+ return __glXTexParameterfvReqSize( pc, swap, reqlen); - } - --int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap ) -+int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -162,12 +162,12 @@ int __glXTexEnvfvReqSize(GLbyte *pc, Boo - return 4 * __glTexEnvfv_size( pname ); /* defined in samplegl lib */ - } - --int __glXTexEnvivReqSize(GLbyte *pc, Bool swap ) -+int __glXTexEnvivReqSize(GLbyte *pc, Bool swap, int reqlen ) - { -- return __glXTexEnvfvReqSize( pc, swap ); -+ return __glXTexEnvfvReqSize( pc, swap, reqlen); - } - --int __glXMap1dReqSize(GLbyte *pc, Bool swap ) -+int __glXMap1dReqSize(GLbyte *pc, Bool swap, int reqlen ) - { - GLenum target; - GLint order; -@@ -183,7 +183,7 @@ int __glXMap1dReqSize(GLbyte *pc, Bool s - return safe_mul(8, safe_mul(__glMap1d_size(target), order)); - } - --int __glXMap1fReqSize(GLbyte *pc, Bool swap ) -+int __glXMap1fReqSize(GLbyte *pc, Bool swap, int reqlen ) - { - GLenum target; - GLint order; -@@ -205,7 +205,7 @@ static int Map2Size(int k, int majorOrde - return safe_mul(k, safe_mul(majorOrder, minorOrder)); - } - --int __glXMap2dReqSize(GLbyte *pc, Bool swap ) -+int __glXMap2dReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum target; - GLint uorder, vorder; -@@ -221,7 +221,7 @@ int __glXMap2dReqSize(GLbyte *pc, Bool s - return safe_mul(8, Map2Size(__glMap2d_size(target), uorder, vorder)); - } - --int __glXMap2fReqSize(GLbyte *pc, Bool swap ) -+int __glXMap2fReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum target; - GLint uorder, vorder; -@@ -237,7 +237,7 @@ int __glXMap2fReqSize(GLbyte *pc, Bool s - return safe_mul(4, Map2Size(__glMap2f_size(target), uorder, vorder)); - } - --int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap ) -+int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLint mapsize; - mapsize = *(GLint *)(pc + 4); -@@ -247,12 +247,12 @@ int __glXPixelMapfvReqSize(GLbyte *pc, B - return 4 * mapsize; - } - --int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap ) -+int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXPixelMapfvReqSize( pc, swap ); -+ return __glXPixelMapfvReqSize( pc, swap, reqlen); - } - --int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap ) -+int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLint mapsize; - mapsize = *(GLint *)(pc + 4); -@@ -458,7 +458,7 @@ int __glXImageSize( GLenum format, GLenu - } - - --int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap ) -+int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchDrawPixelsHeader *hdr = (__GLXdispatchDrawPixelsHeader *) pc; - GLenum format = hdr->format; -@@ -482,7 +482,7 @@ int __glXDrawPixelsReqSize(GLbyte *pc, B - 0, rowLength, 0, skipRows, alignment ); - } - --int __glXBitmapReqSize(GLbyte *pc, Bool swap ) -+int __glXBitmapReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchBitmapHeader *hdr = (__GLXdispatchBitmapHeader *) pc; - GLint w = hdr->width; -@@ -502,7 +502,7 @@ int __glXBitmapReqSize(GLbyte *pc, Bool - 0, rowLength, 0, skipRows, alignment ); - } - --int __glXTexImage1DReqSize(GLbyte *pc, Bool swap ) -+int __glXTexImage1DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc; - GLenum target = hdr->target; -@@ -531,7 +531,7 @@ int __glXTexImage1DReqSize(GLbyte *pc, B - 0, rowLength, 0, skipRows, alignment ); - } - --int __glXTexImage2DReqSize(GLbyte *pc, Bool swap ) -+int __glXTexImage2DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc; - GLenum target = hdr->target; -@@ -578,13 +578,14 @@ int __glXTypeSize(GLenum enm) - } - } - --int __glXDrawArraysSize( GLbyte *pc, Bool swap ) -+int __glXDrawArraysSize( GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc; - __GLXdispatchDrawArraysComponentHeader *compHeader; - GLint numVertexes = hdr->numVertexes; - GLint numComponents = hdr->numComponents; - GLint arrayElementSize = 0; -+ GLint x, size; - int i; - - if (swap) { -@@ -593,6 +594,13 @@ int __glXDrawArraysSize( GLbyte *pc, Boo - } - - pc += sizeof(__GLXdispatchDrawArraysHeader); -+ reqlen -= sizeof(__GLXdispatchDrawArraysHeader); -+ -+ size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader), -+ numComponents); -+ if (size < 0 || reqlen < 0 || reqlen < size) -+ return -1; -+ - compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc; - - for (i=0; i<numComponents; i++) { -@@ -636,23 +644,24 @@ int __glXDrawArraysSize( GLbyte *pc, Boo - return -1; - } - -- arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype)); -+ x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype))); -+ if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0) -+ return -1; - - pc += sizeof(__GLXdispatchDrawArraysComponentHeader); - } - -- return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) + -- (numVertexes * arrayElementSize)); -+ return safe_add(size, safe_mul(numVertexes, arrayElementSize)); - } - --int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap ) -+int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLint n = *(GLsizei *)(pc + 0); - if (swap) n = SWAPL(n); - return(8*n); /* 4*n for textures, 4*n for priorities */ - } - --int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap ) -+int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc; - GLenum format = hdr->format; -@@ -674,7 +683,7 @@ int __glXTexSubImage1DReqSize(GLbyte *pc - 0, rowLength, 0, skipRows, alignment ); - } - --int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap ) -+int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc; - GLenum format = hdr->format; -@@ -698,7 +707,7 @@ int __glXTexSubImage2DReqSize(GLbyte *pc - 0, rowLength, 0, skipRows, alignment ); - } - --int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ) -+int __glXTexImage3DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchTexImage3DHeader *hdr = (__GLXdispatchTexImage3DHeader *) pc; - GLenum target = hdr->target; -@@ -735,7 +744,7 @@ int __glXTexImage3DReqSize(GLbyte *pc, B - } - } - --int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap ) -+int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchTexSubImage3DHeader *hdr = - (__GLXdispatchTexSubImage3DHeader *) pc; -@@ -772,7 +781,7 @@ int __glXTexSubImage3DReqSize(GLbyte *pc - } - } - --int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap ) -+int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchConvolutionFilterHeader *hdr = - (__GLXdispatchConvolutionFilterHeader *) pc; -@@ -795,7 +804,7 @@ int __glXConvolutionFilter1DReqSize(GLby - 0, rowLength, 0, 0, alignment ); - } - --int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap ) -+int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchConvolutionFilterHeader *hdr = - (__GLXdispatchConvolutionFilterHeader *) pc; -@@ -841,7 +850,7 @@ int __glXConvolutionParameterfvSize(GLen - return __glXConvolutionParameterivSize(pname); - } - --int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap ) -+int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -850,12 +859,12 @@ int __glXConvolutionParameterivReqSize(G - return 4 * __glXConvolutionParameterivSize( pname ); - } - --int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap ) -+int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { -- return __glXConvolutionParameterivReqSize( pc, swap ); -+ return __glXConvolutionParameterivReqSize( pc, swap, reqlen); - } - --int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap ) -+int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchConvolutionFilterHeader *hdr = - (__GLXdispatchConvolutionFilterHeader *) pc; -@@ -904,7 +913,7 @@ int __glXColorTableParameterivSize(GLenu - return __glXColorTableParameterfvSize(pname); - } - --int __glXColorTableReqSize(GLbyte *pc, Bool swap ) -+int __glXColorTableReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchColorTableHeader *hdr = - (__GLXdispatchColorTableHeader *) pc; -@@ -939,7 +948,7 @@ int __glXColorTableReqSize(GLbyte *pc, B - 0, rowLength, 0, 0, alignment ); - } - --int __glXColorSubTableReqSize(GLbyte *pc, Bool swap ) -+int __glXColorSubTableReqSize(GLbyte *pc, Bool swap, int reqlen) - { - __GLXdispatchColorSubTableHeader *hdr = - (__GLXdispatchColorSubTableHeader *) pc; -@@ -962,7 +971,7 @@ int __glXColorSubTableReqSize(GLbyte *pc - 0, rowLength, 0, 0, alignment ); - } - --int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap ) -+int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 4); - if (swap) { -@@ -971,13 +980,13 @@ int __glXColorTableParameterfvReqSize(GL - return 4 * __glXColorTableParameterfvSize(pname); - } - --int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap ) -+int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) - { - /* no difference between fv and iv versions */ -- return __glXColorTableParameterfvReqSize(pc, swap); -+ return __glXColorTableParameterfvReqSize(pc, swap, reqlen); - } - --int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap ) -+int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap, int reqlen) - { - GLenum pname = *(GLenum *)(pc + 0); - if (swap) { -@@ -986,8 +995,8 @@ int __glXPointParameterfvARBReqSize(GLby - return 4 * __glPointParameterfvEXT_size( pname ); - } - --int __glXPointParameterivReqSize(GLbyte *pc, Bool swap ) -+int __glXPointParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) - { - /* no difference between fv and iv versions */ -- return __glXPointParameterfvARBReqSize(pc, swap); -+ return __glXPointParameterfvARBReqSize(pc, swap, reqlen); - } |