diff options
Diffstat (limited to 'nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c')
| -rw-r--r-- | nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c | 18 |
1 files changed, 4 insertions, 14 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c index de2df855f..00c55cde7 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c @@ -1893,8 +1893,6 @@ ProcRenderCreateCursor (ClientPtr client) pScreen = pSrc->pDrawable->pScreen; width = pSrc->pDrawable->width; height = pSrc->pDrawable->height; - if (height && width > UINT32_MAX/(height*sizeof(CARD32))) - return BadAlloc; if ( stuff->x > width || stuff->y > height ) return (BadMatch); @@ -2355,8 +2353,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) LEGAL_NEW_RESOURCE(stuff->pid, client); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); - if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) - return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -2959,18 +2955,18 @@ SProcRenderCreateSolidFill(ClientPtr client) return (*ProcRenderVector[stuff->renderReqType]) (client); } -static void swapStops(void *stuff, int num) +static void swapStops(void *stuff, int n) { - int i, n; + int i; CARD32 *stops; CARD16 *colors; stops = (CARD32 *)(stuff); - for (i = 0; i < num; ++i) { + for (i = 0; i < n; ++i) { swapl(stops, n); ++stops; } colors = (CARD16 *)(stops); - for (i = 0; i < 4*num; ++i) { + for (i = 0; i < 4*n; ++i) { swaps(stops, n); ++stops; } @@ -2993,8 +2989,6 @@ SProcRenderCreateLinearGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); - if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) - return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -3022,8 +3016,6 @@ SProcRenderCreateRadialGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); - if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) - return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -3048,8 +3040,6 @@ SProcRenderCreateConicalGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); - if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) - return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; |