1 files changed, 59 insertions, 22 deletions

diff --git a/nx-X11/programs/Xserver/os/io.c b/nx-X11/programs/Xserver/os/io.c
index 92a3f0476..07399438e 100644
--- a/nx-X11/programs/Xserver/os/io.c
+++ b/nx-X11/programs/Xserver/os/io.c
@@ -252,7 +252,14 @@ ReadRequestFromClient(ClientPtr client)
     move_header = FALSE;
 #endif
     gotnow = oci->bufcnt + oci->buffer - oci->bufptr;
-    if (gotnow < sizeof(xReq))
+
+    if (oci->ignoreBytes > 0) {
+	if (oci->ignoreBytes > oci->size)
+	    needed = oci->size;
+	else
+	    needed = oci->ignoreBytes;
+    }
+    else if (gotnow < sizeof(xReq))
     {
 	/* We don't have an entire xReq yet.  Can't tell how big
 	 * the request will be until we get the whole xReq.
@@ -297,8 +304,13 @@ ReadRequestFromClient(ClientPtr client)
 	if (needed > MAXBUFSIZE)
 	{
 	    /* request is too big for us to handle */
-	    YieldControlDeath();
-	    return -1;
+	    /*
+	     * Mark the rest of it as needing to be ignored, and then return
+	     * the full size.  Dispatch() will turn it into a BadLength error.
+	     */
+	    oci->ignoreBytes = needed - gotnow;
+	    oci->lenLastReq = gotnow;
+	    return needed;
 	}
 	if ((gotnow == 0) ||
 	    ((oci->bufptr - oci->buffer + needed) > oci->size))
@@ -405,6 +417,29 @@ ReadRequestFromClient(ClientPtr client)
 #endif
 	    needed = sizeof(xReq);
     }
+
+    /* If there are bytes to ignore, ignore them now. */
+
+    if (oci->ignoreBytes > 0) {
+	assert(needed == oci->ignoreBytes || needed == oci->size);
+	oci->ignoreBytes -= gotnow;
+	needed = gotnow = 0;
+	/*
+	 * The _XSERVTransRead call above may return more or fewer bytes than we
+	 * want to ignore.  Ignore the smaller of the two sizes.
+	 */
+	if (gotnow < needed) {
+	    oci->ignoreBytes -= gotnow;
+	    oci->bufptr += gotnow;
+	    gotnow = 0;
+	} else {
+	    oci->ignoreBytes -= needed;
+	    oci->bufptr += needed;
+	    gotnow -= needed;
+	}
+	needed = 0;
+    }
+
     oci->lenLastReq = needed;
 
     /*
@@ -430,24 +465,15 @@ ReadRequestFromClient(ClientPtr client)
 	    FD_SET(fd, &ClientsWithInput);
 	else
 	{
-	    if (!SmartScheduleDisable)
-		FD_CLR(fd, &ClientsWithInput);
-	    else
-		YieldControlNoInput();
+	    FD_CLR(fd, &ClientsWithInput);
 	}
     }
     else
     {
 	if (!gotnow)
 	    AvailableInput = oc;
-	if (!SmartScheduleDisable)
-	    FD_CLR(fd, &ClientsWithInput);
-	else
-	    YieldControlNoInput();
+	FD_CLR(fd, &ClientsWithInput);
     }
-    if (SmartScheduleDisable)
-    if (++timesThisConnection >= MAX_TIMES_PER)
-	YieldControl();
 #ifdef BIGREQS
     if (move_header)
     {
@@ -755,9 +781,6 @@ FlushAllOutput(void)
     fd_set newOutputPending;
 #endif
 
-    if (FlushCallback)
-	CallCallbacks(&FlushCallback, NULL);
-
     if (!newoutput)
 	return;
 
@@ -958,7 +981,7 @@ WriteToClient (ClientPtr who, int count, const void *__buf)
 	}
     }
 #endif
-    if (oco->count + count + padBytes > oco->size)
+    if (oco->count == 0 || oco->count + count + padBytes > oco->size)
     {
 	FD_CLR(oc->fd, &OutputPending);
 	if(!XFD_ANYSET(&OutputPending)) {
@@ -971,7 +994,11 @@ WriteToClient (ClientPtr who, int count, const void *__buf)
     NewOutputPending = TRUE;
     FD_SET(oc->fd, &OutputPending);
     memmove((char *)oco->buf + oco->count, buf, count);
-    oco->count += count + padBytes;
+    oco->count += count;
+    if (padBytes) {
+	memset(oco->buf + oco->count, '\0', padBytes);
+	oco->count += padBytes;
+    }
     return(count);
 }
 
@@ -1004,6 +1031,13 @@ FlushClient(ClientPtr who, OsCommPtr oc, const void *__extraBuf, int extraCount)
     written = 0;
     padsize = padlength[extraCount & 3];
     notWritten = oco->count + extraCount + padsize;
+
+    if (!notWritten)
+	return 0;
+
+    if (FlushCallback)
+	CallCallbacks(&FlushCallback, who);
+
     todo = notWritten;
     while (notWritten) {
 	long before = written;	/* amount of whole thing written */
@@ -1083,10 +1117,11 @@ FlushClient(ClientPtr who, OsCommPtr oc, const void *__extraBuf, int extraCount)
 
 	    if (notWritten > oco->size)
 	    {
-		unsigned char *obuf;
+		unsigned char *obuf = NULL;
 
-		obuf = (unsigned char *)realloc(oco->buf,
-						 notWritten + BUFSIZE);
+		if (notWritten + BUFSIZE <= INT_MAX) {
+		    obuf = realloc(oco->buf, notWritten + BUFSIZE);
+		}
 		if (!obuf)
 		{
 		    _XSERVTransDisconnect(oc->trans_conn);
@@ -1173,6 +1208,7 @@ AllocateInputBuffer(void)
     oci->bufptr = oci->buffer;
     oci->bufcnt = 0;
     oci->lenLastReq = 0;
+    oci->ignoreBytes = 0;
     return oci;
 }
 
@@ -1217,6 +1253,7 @@ FreeOsBuffers(OsCommPtr oc)
 	    oci->bufptr = oci->buffer;
 	    oci->bufcnt = 0;
 	    oci->lenLastReq = 0;
+	    oci->ignoreBytes = 0;
 	}
     }
     if ((oco = oc->output))