diff options
Diffstat (limited to 'nx-X11/programs')
12 files changed, 132 insertions, 1278 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG b/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG index e3b71e645..7cf04acc0 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG +++ b/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG @@ -1,5 +1,12 @@ ChangeLog: +nxagent-3.2.0-7 + +- Imported patch fixing issues from X.Org security advisory, June + 11th, 2008: Multiple vulnerabilities in X server extensions. CVE + IDs: CVE-2008-1377, CVE-2008-1379, CVE-2008-2360, CVE-2008-2361, + CVE-2008-2362. + nxagent-3.2.0-6 - Fixed TR05F02063. Ignore ReparentNotify events for non-rootless diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c index 06dabddaa..f51a8bce9 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c @@ -69,6 +69,17 @@ #undef DEBUG #undef TEST +#else + +#include "picturestr.h" +#include "glyphstr.h" + +#endif + +#if HAVE_STDINT_H +#include <stdint.h> +#elif !defined(UINT32_MAX) +#define UINT32_MAX 0xffffffffU #endif /* @@ -401,8 +412,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth) { int size; GlyphPtr glyph; - - size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]); + size_t padded_width; + + padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]); + if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height) + return 0; + size = gi->height * padded_width; glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec)); if (!glyph) return 0; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original index 06dabddaa..f51a8bce9 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original @@ -69,6 +69,17 @@ #undef DEBUG #undef TEST +#else + +#include "picturestr.h" +#include "glyphstr.h" + +#endif + +#if HAVE_STDINT_H +#include <stdint.h> +#elif !defined(UINT32_MAX) +#define UINT32_MAX 0xffffffffU #endif /* @@ -401,8 +412,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth) { int size; GlyphPtr glyph; - - size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]); + size_t padded_width; + + padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]); + if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height) + return 0; + size = gi->height * padded_width; glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec)); if (!glyph) return 0; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original index 45c5dd975..9f4d1c87b 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original @@ -43,6 +43,12 @@ #include "picturestr.h" #include "glyphstr.h" +#if HAVE_STDINT_H +#include <stdint.h> +#elif !defined(UINT32_MAX) +#define UINT32_MAX 0xffffffffU +#endif + /* * From Knuth -- a good choice for hash/rehash values is p, p-2 where * p and p-2 are both prime. These tables are sized to have an extra 10% @@ -334,8 +340,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth) { int size; GlyphPtr glyph; - - size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]); + size_t padded_width; + + padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]); + if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height) + return 0; + size = gi->height * padded_width; glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec)); if (!glyph) return 0; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c index 00c55cde7..de2df855f 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c @@ -1893,6 +1893,8 @@ ProcRenderCreateCursor (ClientPtr client) pScreen = pSrc->pDrawable->pScreen; width = pSrc->pDrawable->width; height = pSrc->pDrawable->height; + if (height && width > UINT32_MAX/(height*sizeof(CARD32))) + return BadAlloc; if ( stuff->x > width || stuff->y > height ) return (BadMatch); @@ -2353,6 +2355,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) LEGAL_NEW_RESOURCE(stuff->pid, client); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -2955,18 +2959,18 @@ SProcRenderCreateSolidFill(ClientPtr client) return (*ProcRenderVector[stuff->renderReqType]) (client); } -static void swapStops(void *stuff, int n) +static void swapStops(void *stuff, int num) { - int i; + int i, n; CARD32 *stops; CARD16 *colors; stops = (CARD32 *)(stuff); - for (i = 0; i < n; ++i) { + for (i = 0; i < num; ++i) { swapl(stops, n); ++stops; } colors = (CARD16 *)(stops); - for (i = 0; i < 4*n; ++i) { + for (i = 0; i < 4*num; ++i) { swaps(stops, n); ++stops; } @@ -2989,6 +2993,8 @@ SProcRenderCreateLinearGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -3016,6 +3022,8 @@ SProcRenderCreateRadialGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -3040,6 +3048,8 @@ SProcRenderCreateConicalGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original index 00c55cde7..de2df855f 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original @@ -1893,6 +1893,8 @@ ProcRenderCreateCursor (ClientPtr client) pScreen = pSrc->pDrawable->pScreen; width = pSrc->pDrawable->width; height = pSrc->pDrawable->height; + if (height && width > UINT32_MAX/(height*sizeof(CARD32))) + return BadAlloc; if ( stuff->x > width || stuff->y > height ) return (BadMatch); @@ -2353,6 +2355,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) LEGAL_NEW_RESOURCE(stuff->pid, client); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -2955,18 +2959,18 @@ SProcRenderCreateSolidFill(ClientPtr client) return (*ProcRenderVector[stuff->renderReqType]) (client); } -static void swapStops(void *stuff, int n) +static void swapStops(void *stuff, int num) { - int i; + int i, n; CARD32 *stops; CARD16 *colors; stops = (CARD32 *)(stuff); - for (i = 0; i < n; ++i) { + for (i = 0; i < num; ++i) { swapl(stops, n); ++stops; } colors = (CARD16 *)(stops); - for (i = 0; i < 4*n; ++i) { + for (i = 0; i < 4*num; ++i) { swaps(stops, n); ++stops; } @@ -2989,6 +2993,8 @@ SProcRenderCreateLinearGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -3016,6 +3022,8 @@ SProcRenderCreateRadialGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -3040,6 +3048,8 @@ SProcRenderCreateConicalGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original index d2759ab10..d25d49756 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original @@ -1505,6 +1505,8 @@ ProcRenderCreateCursor (ClientPtr client) pScreen = pSrc->pDrawable->pScreen; width = pSrc->pDrawable->width; height = pSrc->pDrawable->height; + if (height && width > UINT32_MAX/(height*sizeof(CARD32))) + return BadAlloc; if ( stuff->x > width || stuff->y > height ) return (BadMatch); @@ -1918,6 +1920,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) LEGAL_NEW_RESOURCE(stuff->pid, client); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -2489,18 +2493,18 @@ SProcRenderCreateSolidFill(ClientPtr client) return (*ProcRenderVector[stuff->renderReqType]) (client); } -static void swapStops(void *stuff, int n) +static void swapStops(void *stuff, int num) { - int i; + int i, n; CARD32 *stops; CARD16 *colors; stops = (CARD32 *)(stuff); - for (i = 0; i < n; ++i) { + for (i = 0; i < num; ++i) { swapl(stops, n); ++stops; } colors = (CARD16 *)(stops); - for (i = 0; i < 4*n; ++i) { + for (i = 0; i < 4*num; ++i) { swaps(stops, n); ++stops; } @@ -2523,6 +2527,8 @@ SProcRenderCreateLinearGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -2550,6 +2556,8 @@ SProcRenderCreateRadialGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; @@ -2574,6 +2582,8 @@ SProcRenderCreateConicalGradient (ClientPtr client) swapl(&stuff->nStops, n); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); + if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) + return BadLength; if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) return BadLength; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original index 7dd021a6e..91e03cb0e 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original @@ -194,10 +194,6 @@ static DeleteType *DeleteFuncs = (DeleteType *)NULL; Atom * ResourceNames = NULL; -#ifdef NXAGENT_SERVER -static int nxagentResChangedFlag = 0; -#endif - void RegisterResourceName (RESTYPE type, char *name) { ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE); @@ -205,6 +201,10 @@ void RegisterResourceName (RESTYPE type, char *name) #endif +#ifdef NXAGENT_SERVER +static int nxagentResChangedFlag = 0; +#endif + RESTYPE CreateNewResourceType(DeleteType deleteFunc) { diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~ b/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~ deleted file mode 100644 index 7dd021a6e..000000000 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~ +++ /dev/null @@ -1,1250 +0,0 @@ -/**************************************************************************/ -/* */ -/* Copyright (c) 2001, 2007 NoMachine, http://www.nomachine.com/. */ -/* */ -/* NXAGENT, NX protocol compression and NX extensions to this software */ -/* are copyright of NoMachine. Redistribution and use of the present */ -/* software is allowed according to terms specified in the file LICENSE */ -/* which comes in the source distribution. */ -/* */ -/* Check http://www.nomachine.com/licensing.html for applicability. */ -/* */ -/* NX and NoMachine are trademarks of NoMachine S.r.l. */ -/* */ -/* All rights reserved. */ -/* */ -/**************************************************************************/ - -/************************************************************ - -Copyright 1987, 1998 The Open Group - -Permission to use, copy, modify, distribute, and sell this software and its -documentation for any purpose is hereby granted without fee, provided that -the above copyright notice appear in all copies and that both that -copyright notice and this permission notice appear in supporting -documentation. - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN -AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -Except as contained in this notice, the name of The Open Group shall not be -used in advertising or otherwise to promote the sale, use or other dealings -in this Software without prior written authorization from The Open Group. - - -Copyright 1987 by Digital Equipment Corporation, Maynard, Massachusetts. - - All Rights Reserved - -Permission to use, copy, modify, and distribute this software and its -documentation for any purpose and without fee is hereby granted, -provided that the above copyright notice appear in all copies and that -both that copyright notice and this permission notice appear in -supporting documentation, and that the name of Digital not be -used in advertising or publicity pertaining to distribution of the -software without specific, written prior permission. - -DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING -ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL -DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR -ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, -WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, -ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -SOFTWARE. - -********************************************************/ -/* The panoramix components contained the following notice */ -/***************************************************************** - -Copyright (c) 1991, 1997 Digital Equipment Corporation, Maynard, Massachusetts. - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software. - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL -DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM, DAMAGES, INCLUDING, -BUT NOT LIMITED TO CONSEQUENTIAL OR INCIDENTAL DAMAGES, OR OTHER LIABILITY, -WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR -IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -Except as contained in this notice, the name of Digital Equipment Corporation -shall not be used in advertising or otherwise to promote the sale, use or other -dealings in this Software without prior written authorization from Digital -Equipment Corporation. - -******************************************************************/ - -/* $Xorg: resource.c,v 1.5 2001/02/09 02:04:40 xorgcvs Exp $ */ -/* $XdotOrg: xc/programs/Xserver/dix/resource.c,v 1.8 2005/07/03 08:53:38 daniels Exp $ */ -/* $TOG: resource.c /main/41 1998/02/09 14:20:31 kaleb $ */ - -/* Routines to manage various kinds of resources: - * - * CreateNewResourceType, CreateNewResourceClass, InitClientResources, - * FakeClientID, AddResource, FreeResource, FreeClientResources, - * FreeAllResources, LookupIDByType, LookupIDByClass, GetXIDRange - */ - -/* - * A resource ID is a 32 bit quantity, the upper 2 bits of which are - * off-limits for client-visible resources. The next 8 bits are - * used as client ID, and the low 22 bits come from the client. - * A resource ID is "hashed" by extracting and xoring subfields - * (varying with the size of the hash table). - * - * It is sometimes necessary for the server to create an ID that looks - * like it belongs to a client. This ID, however, must not be one - * the client actually can create, or we have the potential for conflict. - * The 31st bit of the ID is reserved for the server's use for this - * purpose. By setting CLIENT_ID(id) to the client, the SERVER_BIT to - * 1, and an otherwise arbitrary ID in the low 22 bits, we can create a - * resource "owned" by the client. - */ -/* $XFree86: xc/programs/Xserver/dix/resource.c,v 3.13 2003/09/24 02:43:13 dawes Exp $ */ - -#define NEED_EVENTS -#ifdef HAVE_DIX_CONFIG_H -#include <dix-config.h> -#endif - -#include <X11/X.h> -#include "misc.h" -#include "os.h" -#include "resource.h" -#include "dixstruct.h" -#include "opaque.h" -#include "windowstr.h" -#include "dixfont.h" -#include "colormap.h" -#include "inputstr.h" -#include "dixevents.h" -#include "dixgrabs.h" -#include "cursor.h" -#ifdef PANORAMIX -#include "panoramiX.h" -#include "panoramiXsrv.h" -#endif -#include <assert.h> - -#ifdef NXAGENT_SERVER - -#include "Agent.h" -#include "Font.h" -#include "Pixmaps.h" -#include "GCs.h" - -#define PANIC -#define WARNING -#undef TEST -#undef DEBUG - -#endif - -static void RebuildTable( - int /*client*/ -); - -#define SERVER_MINID 32 - -#define INITBUCKETS 64 -#define INITHASHSIZE 6 -#define MAXHASHSIZE 11 - -typedef struct _Resource { - struct _Resource *next; - XID id; - RESTYPE type; - pointer value; -} ResourceRec, *ResourcePtr; -#define NullResource ((ResourcePtr)NULL) - -typedef struct _ClientResource { - ResourcePtr *resources; - int elements; - int buckets; - int hashsize; /* log(2)(buckets) */ - XID fakeID; - XID endFakeID; - XID expectID; -} ClientResourceRec; - -RESTYPE lastResourceType; -static RESTYPE lastResourceClass; -RESTYPE TypeMask; - -static DeleteType *DeleteFuncs = (DeleteType *)NULL; - -#ifdef XResExtension - -Atom * ResourceNames = NULL; - -#ifdef NXAGENT_SERVER -static int nxagentResChangedFlag = 0; -#endif - -void RegisterResourceName (RESTYPE type, char *name) -{ - ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE); -} - -#endif - -RESTYPE -CreateNewResourceType(DeleteType deleteFunc) -{ - RESTYPE next = lastResourceType + 1; - DeleteType *funcs; - - if (next & lastResourceClass) - return 0; - funcs = (DeleteType *)xrealloc(DeleteFuncs, - (next + 1) * sizeof(DeleteType)); - if (!funcs) - return 0; - -#ifdef XResExtension - { - Atom *newnames; - newnames = xrealloc(ResourceNames, (next + 1) * sizeof(Atom)); - if(!newnames) - return 0; - ResourceNames = newnames; - ResourceNames[next] = 0; - } -#endif - - lastResourceType = next; - DeleteFuncs = funcs; - DeleteFuncs[next] = deleteFunc; - return next; -} - -RESTYPE -CreateNewResourceClass() -{ - RESTYPE next = lastResourceClass >> 1; - - if (next & lastResourceType) - return 0; - lastResourceClass = next; - TypeMask = next - 1; - return next; -} - -ClientResourceRec clientTable[MAXCLIENTS]; - -/***************** - * InitClientResources - * When a new client is created, call this to allocate space - * in resource table - *****************/ - -Bool -InitClientResources(ClientPtr client) -{ - register int i, j; - - if (client == serverClient) - { - lastResourceType = RT_LASTPREDEF; - lastResourceClass = RC_LASTPREDEF; - TypeMask = RC_LASTPREDEF - 1; - if (DeleteFuncs) - xfree(DeleteFuncs); - DeleteFuncs = (DeleteType *)xalloc((lastResourceType + 1) * - sizeof(DeleteType)); - if (!DeleteFuncs) - return FALSE; - DeleteFuncs[RT_NONE & TypeMask] = (DeleteType)NoopDDA; - DeleteFuncs[RT_WINDOW & TypeMask] = DeleteWindow; - DeleteFuncs[RT_PIXMAP & TypeMask] = dixDestroyPixmap; - DeleteFuncs[RT_GC & TypeMask] = FreeGC; - DeleteFuncs[RT_FONT & TypeMask] = CloseFont; - DeleteFuncs[RT_CURSOR & TypeMask] = FreeCursor; - DeleteFuncs[RT_COLORMAP & TypeMask] = FreeColormap; - DeleteFuncs[RT_CMAPENTRY & TypeMask] = FreeClientPixels; - DeleteFuncs[RT_OTHERCLIENT & TypeMask] = OtherClientGone; - DeleteFuncs[RT_PASSIVEGRAB & TypeMask] = DeletePassiveGrab; - -#ifdef XResExtension - if(ResourceNames) - xfree(ResourceNames); - ResourceNames = xalloc((lastResourceType + 1) * sizeof(Atom)); - if(!ResourceNames) - return FALSE; -#endif - } - clientTable[i = client->index].resources = - (ResourcePtr *)xalloc(INITBUCKETS*sizeof(ResourcePtr)); - if (!clientTable[i].resources) - return FALSE; - clientTable[i].buckets = INITBUCKETS; - clientTable[i].elements = 0; - clientTable[i].hashsize = INITHASHSIZE; - /* Many IDs allocated from the server client are visible to clients, - * so we don't use the SERVER_BIT for them, but we have to start - * past the magic value constants used in the protocol. For normal - * clients, we can start from zero, with SERVER_BIT set. - */ - clientTable[i].fakeID = client->clientAsMask | - (client->index ? SERVER_BIT : SERVER_MINID); - clientTable[i].endFakeID = (clientTable[i].fakeID | RESOURCE_ID_MASK) + 1; - clientTable[i].expectID = client->clientAsMask; - for (j=0; j<INITBUCKETS; j++) - { - clientTable[i].resources[j] = NullResource; - } - return TRUE; -} - - -static int -Hash(int client, register XID id) -{ - id &= RESOURCE_ID_MASK; - switch (clientTable[client].hashsize) - { - case 6: - return ((int)(0x03F & (id ^ (id>>6) ^ (id>>12)))); - case 7: - return ((int)(0x07F & (id ^ (id>>7) ^ (id>>13)))); - case 8: - return ((int)(0x0FF & (id ^ (id>>8) ^ (id>>16)))); - case 9: - return ((int)(0x1FF & (id ^ (id>>9)))); - case 10: - return ((int)(0x3FF & (id ^ (id>>10)))); - case 11: - return ((int)(0x7FF & (id ^ (id>>11)))); - } - return -1; -} - -static XID -AvailableID( - register int client, - register XID id, - register XID maxid, - register XID goodid) -{ - register ResourcePtr res; - - if ((goodid >= id) && (goodid <= maxid)) - return goodid; - for (; id <= maxid; id++) - { - res = clientTable[client].resources[Hash(client, id)]; - while (res && (res->id != id)) - res = res->next; - if (!res) - return id; - } - return 0; -} - -void -GetXIDRange(int client, Bool server, XID *minp, XID *maxp) -{ - register XID id, maxid; - register ResourcePtr *resp; - register ResourcePtr res; - register int i; - XID goodid; - - id = (Mask)client << CLIENTOFFSET; - if (server) - id |= client ? SERVER_BIT : SERVER_MINID; - maxid = id | RESOURCE_ID_MASK; - goodid = 0; - for (resp = clientTable[client].resources, i = clientTable[client].buckets; - --i >= 0;) - { - for (res = *resp++; res; res = res->next) - { - if ((res->id < id) || (res->id > maxid)) - continue; - if (((res->id - id) >= (maxid - res->id)) ? - (goodid = AvailableID(client, id, res->id - 1, goodid)) : - !(goodid = AvailableID(client, res->id + 1, maxid, goodid))) - maxid = res->id - 1; - else - id = res->id + 1; - } - } - if (id > maxid) - id = maxid = 0; - *minp = id; - *maxp = maxid; -} - -/** - * GetXIDList is called by the XC-MISC extension's MiscGetXIDList function. - * This function tries to find count unused XIDs for the given client. It - * puts the IDs in the array pids and returns the number found, which should - * almost always be the number requested. - * - * The circumstances that lead to a call to this function are very rare. - * Xlib must run out of IDs while trying to generate a request that wants - * multiple ID's, like the Multi-buffering CreateImageBuffers request. - * - * No rocket science in the implementation; just iterate over all - * possible IDs for the given client and pick the first count IDs - * that aren't in use. A more efficient algorithm could probably be - * invented, but this will be used so rarely that this should suffice. - */ - -unsigned int -GetXIDList(ClientPtr pClient, unsigned count, XID *pids) -{ - unsigned int found = 0; - XID id = pClient->clientAsMask; - XID maxid; - - maxid = id | RESOURCE_ID_MASK; - while ( (found < count) && (id <= maxid) ) - { - if (!LookupIDByClass(id, RC_ANY)) - { - pids[found++] = id; - } - id++; - } - return found; -} - -/* - * Return the next usable fake client ID. - * - * Normally this is just the next one in line, but if we've used the last - * in the range, we need to find a new range of safe IDs to avoid - * over-running another client. - */ - -XID -FakeClientID(register int client) -{ - XID id, maxid; - - id = clientTable[client].fakeID++; - if (id != clientTable[client].endFakeID) - return id; - GetXIDRange(client, TRUE, &id, &maxid); - if (!id) { - if (!client) - FatalError("FakeClientID: server internal ids exhausted\n"); - MarkClientException(clients[client]); - id = ((Mask)client << CLIENTOFFSET) | (SERVER_BIT * 3); - maxid = id | RESOURCE_ID_MASK; - } - clientTable[client].fakeID = id + 1; - clientTable[client].endFakeID = maxid + 1; - return id; -} - -#ifdef NXAGENT_SERVER - -int nxagentFindClientResource(int client, RESTYPE type, pointer value) -{ - ResourcePtr pResource; - ResourcePtr *resources; - - int i; - - for (i = 0; i < clientTable[client].buckets; i++) - { - resources = clientTable[client].resources; - - for (pResource = resources[i]; pResource; pResource = pResource -> next) - { - if (pResource -> type == type && pResource -> value == value) - { - #ifdef TEST - fprintf(stderr, "nxagentFindClientResource: Found resource [%p] type [%lu] " - "for client [%d].\n", (void *) value, - pResource -> type, client); - #endif - - return 1; - } - } - } - - return 0; -} - -int nxagentSwitchResourceType(int client, RESTYPE type, pointer value) -{ - ResourcePtr pResource; - ResourcePtr *resources; - - RESTYPE internalType = 0; - - int i; - - if (type == RT_PIXMAP) - { - internalType = RT_NX_PIXMAP; - } - else if (type == RT_GC) - { - internalType = RT_NX_GC; - } - else if (type == RT_FONT) - { - internalType = RT_NX_FONT; - } - else - { - return 0; - } - - if (client == serverClient -> index) - { - #ifdef TEST - fprintf(stderr, "nxagentSwitchResourceType: Requesting client is [%d]. Skipping the resource switch.\n", - client); - #endif - - return 0; - } - - for (i = 0; i < clientTable[serverClient -> index].buckets; i++) - { - resources = clientTable[serverClient -> index].resources; - - for (pResource = resources[i]; pResource; pResource = pResource -> next) - { - if (pResource -> type == internalType && - pResource -> value == value) - { - #ifdef TEST - fprintf(stderr, "nxagentSwitchResourceType: Changing resource [%p] type from [%lu] to " - "[%lu] for server client [%d].\n", (void *) value, - (unsigned long) pResource -> type, (unsigned long) type, serverClient -> index); - #endif - - FreeResource(pResource -> id, RT_NONE); - - return 1; - } - } - } - - return 0; -} - -#endif - -Bool -AddResource(XID id, RESTYPE type, pointer value) -{ - int client; - register ClientResourceRec *rrec; - register ResourcePtr res, *head; - - client = CLIENT_ID(id); - rrec = &clientTable[client]; - if (!rrec->buckets) - { - ErrorF("AddResource(%lx, %lx, %lx), client=%d \n", - (unsigned long)id, type, (unsigned long)value, client); - FatalError("client not in use\n"); - } - -#ifdef NXAGENT_SERVER - - nxagentSwitchResourceType(client, type, value); - - #ifdef TEST - fprintf(stderr, "AddResource: Adding resource for client [%d] type [%lu] value [%p] id [%lu].\n", - client, (unsigned long) type, (void *) value, (unsigned long) id); - #endif - -#endif - - if ((rrec->elements >= 4*rrec->buckets) && - (rrec->hashsize < MAXHASHSIZE)) - RebuildTable(client); - head = &rrec->resources[Hash(client, id)]; - res = (ResourcePtr)xalloc(sizeof(ResourceRec)); - if (!res) - { - (*DeleteFuncs[type & TypeMask])(value, id); - return FALSE; - } - res->next = *head; - res->id = id; - res->type = type; - res->value = value; - *head = res; - rrec->elements++; - #ifdef NXAGENT_SERVER - nxagentResChangedFlag = 1; - #endif - if (!(id & SERVER_BIT) && (id >= rrec->expectID)) - rrec->expectID = id + 1; - return TRUE; -} - -static void -RebuildTable(int client) -{ - register int j; - register ResourcePtr res, next; - ResourcePtr **tails, *resources; - register ResourcePtr **tptr, *rptr; - - /* - * For now, preserve insertion order, since some ddx layers depend - * on resources being free in the opposite order they are added. - */ - - j = 2 * clientTable[client].buckets; - tails = (ResourcePtr **)ALLOCATE_LOCAL(j * sizeof(ResourcePtr *)); - if (!tails) - return; - resources = (ResourcePtr *)xalloc(j * sizeof(ResourcePtr)); - if (!resources) - { - DEALLOCATE_LOCAL(tails); - return; - } - for (rptr = resources, tptr = tails; --j >= 0; rptr++, tptr++) - { - *rptr = NullResource; - *tptr = rptr; - } - clientTable[client].hashsize++; - for (j = clientTable[client].buckets, - rptr = clientTable[client].resources; - --j >= 0; - rptr++) - { - for (res = *rptr; res; res = next) - { - next = res->next; - res->next = NullResource; - tptr = &tails[Hash(client, res->id)]; - **tptr = res; - *tptr = &res->next; - } - } - DEALLOCATE_LOCAL(tails); - clientTable[client].buckets *= 2; - xfree(clientTable[client].resources); - clientTable[client].resources = resources; -} - -void -FreeResource(XID id, RESTYPE skipDeleteFuncType) -{ - int cid; - register ResourcePtr res; - register ResourcePtr *prev, *head; - register int *eltptr; - int elements; - Bool gotOne = FALSE; - -#ifdef NXAGENT_SERVER - - #ifdef TEST - fprintf(stderr, "FreeResource: Freeing resource id [%lu].\n", (unsigned long) id); - #endif - -#endif - - if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets) - { - head = &clientTable[cid].resources[Hash(cid, id)]; - eltptr = &clientTable[cid].elements; - - prev = head; - while ( (res = *prev) ) - { - if (res->id == id) - { - RESTYPE rtype = res->type; - *prev = res->next; - elements = --*eltptr; - #ifdef NXAGENT_SERVER - nxagentResChangedFlag = 1; - #endif - if (rtype & RC_CACHED) - FlushClientCaches(res->id); - if (rtype != skipDeleteFuncType) - (*DeleteFuncs[rtype & TypeMask])(res->value, res->id); - xfree(res); - if (*eltptr != elements) - prev = head; /* prev may no longer be valid */ - gotOne = TRUE; - } - else - prev = &res->next; - } - if(clients[cid] && (id == clients[cid]->lastDrawableID)) - { - clients[cid]->lastDrawable = (DrawablePtr)WindowTable[0]; - clients[cid]->lastDrawableID = WindowTable[0]->drawable.id; - } - } - if (!gotOne) - ErrorF("Freeing resource id=%lX which isn't there.\n", - (unsigned long)id); -} - - -void -FreeResourceByType(XID id, RESTYPE type, Bool skipFree) -{ - int cid; - register ResourcePtr res; - register ResourcePtr *prev, *head; - if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets) - { - head = &clientTable[cid].resources[Hash(cid, id)]; - - prev = head; - while ( (res = *prev) ) - { - if (res->id == id && res->type == type) - { - *prev = res->next; - #ifdef NXAGENT_SERVER - nxagentResChangedFlag = 1; - #endif - if (type & RC_CACHED) - FlushClientCaches(res->id); - if (!skipFree) - (*DeleteFuncs[type & TypeMask])(res->value, res->id); - xfree(res); - break; - } - else - prev = &res->next; - } - if(clients[cid] && (id == clients[cid]->lastDrawableID)) - { - clients[cid]->lastDrawable = (DrawablePtr)WindowTable[0]; - clients[cid]->lastDrawableID = WindowTable[0]->drawable.id; - } - } -} - -/* - * Change the value associated with a resource id. Caller - * is responsible for "doing the right thing" with the old - * data - */ - -Bool -ChangeResourceValue (XID id, RESTYPE rtype, pointer value) -{ - int cid; - register ResourcePtr res; - - if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets) - { - res = clientTable[cid].resources[Hash(cid, id)]; - - for (; res; res = res->next) - if ((res->id == id) && (res->type == rtype)) - { - if (rtype & RC_CACHED) - FlushClientCaches(res->id); - res->value = value; - return TRUE; - } - } - return FALSE; -} - -/* Note: if func adds or deletes resources, then func can get called - * more than once for some resources. If func adds new resources, - * func might or might not get called for them. func cannot both - * add and delete an equal number of resources! - */ - -void -FindClientResourcesByType( - ClientPtr client, - RESTYPE type, - FindResType func, - pointer cdata -){ - register ResourcePtr *resources; - register ResourcePtr this, next; - int i, elements; - register int *eltptr; - - #ifdef NXAGENT_SERVER - register ResourcePtr **resptr; - #endif - - if (!client) - client = serverClient; - -/* - * If func triggers a resource table - * rebuild then restart the loop. - */ - -#ifdef NXAGENT_SERVER -RestartLoop: -#endif - - resources = clientTable[client->index].resources; - - #ifdef NXAGENT_SERVER - resptr = &clientTable[client->index].resources; - #endif - - eltptr = &clientTable[client->index].elements; - for (i = 0; i < clientTable[client->index].buckets; i++) - { - for (this = resources[i]; this; this = next) - { - next = this->next; - if (!type || this->type == type) { - elements = *eltptr; - - /* - * FIXME: - * It is not safe to let a function change the resource - * table we are reading! - */ - - #ifdef NXAGENT_SERVER - nxagentResChangedFlag = 0; - #endif - (*func)(this->value, this->id, cdata); - - /* - * Avoid that a call to RebuildTable() could invalidate the - * pointer. This is safe enough, because in RebuildTable() - * the new pointer is allocated just before the old one is - * freed, so it can't point to the same address. - */ - - #ifdef NXAGENT_SERVER - if (*resptr != resources) - goto RestartLoop; - #endif - - /* - * It's not enough to check if the number of elements has - * changed, beacause it could happen that the number of - * resources that have been added matches the number of - * the freed ones. - * 'nxagentResChangedFlag' is set if a resource has been - * added or freed. - */ - - #ifdef NXAGENT_SERVER - if (*eltptr != elements || nxagentResChangedFlag) - #else - if (*eltptr != elements) - #endif - next = resources[i]; /* start over */ - } - } - } -} - -void -FindAllClientResources( - ClientPtr client, - FindAllRes func, - pointer cdata -){ - register ResourcePtr *resources; - register ResourcePtr this, next; - int i, elements; - register int *eltptr; - - #ifdef NXAGENT_SERVER - register ResourcePtr **resptr; - #endif - - if (!client) - client = serverClient; - -/* - * If func triggers a resource table - * rebuild then restart the loop. - */ - -#ifdef NXAGENT_SERVER -RestartLoop: -#endif - - resources = clientTable[client->index].resources; - - #ifdef NXAGENT_SERVER - resptr = &clientTable[client->index].resources; - #endif - - eltptr = &clientTable[client->index].elements; - for (i = 0; i < clientTable[client->index].buckets; i++) - { - for (this = resources[i]; this; this = next) - { - next = this->next; - elements = *eltptr; - - /* - * FIXME: - * It is not safe to let a function change the resource - * table we are reading! - */ - - #ifdef NXAGENT_SERVER - nxagentResChangedFlag = 0; - #endif - (*func)(this->value, this->id, this->type, cdata); - - /* - * Avoid that a call to RebuildTable() could invalidate the - * pointer. This is safe enough, because in RebuildTable() - * the new pointer is allocated just before the old one is - * freed, so it can't point to the same address. - */ - - #ifdef NXAGENT_SERVER - if (*resptr != resources) - goto RestartLoop; - #endif - - /* - * It's not enough to check if the number of elements has - * changed, beacause it could happen that the number of - * resources that have been added matches the number of - * the freed ones. - * 'nxagentResChangedFlag' is set if a resource has been - * added or freed. - */ - - #ifdef NXAGENT_SERVER - if (*eltptr != elements || nxagentResChangedFlag) - #else - if (*eltptr != elements) - #endif - next = resources[i]; /* start over */ - } - } -} - - -pointer -LookupClientResourceComplex( - ClientPtr client, - RESTYPE type, - FindComplexResType func, - pointer cdata -){ - ResourcePtr *resources; - ResourcePtr this; - int i; - - #ifdef NXAGENT_SERVER - ResourcePtr **resptr; - Bool res; - #endif - - if (!client) - client = serverClient; - -/* - * If func triggers a resource table - * rebuild then restart the loop. - */ - -#ifdef NXAGENT_SERVER -RestartLoop: -#endif - - resources = clientTable[client->index].resources; - - #ifdef NXAGENT_SERVER - resptr = &clientTable[client->index].resources; - #endif - - for (i = 0; i < clientTable[client->index].buckets; i++) { - for (this = resources[i]; this; this = this->next) { - if (!type || this->type == type) { - #ifdef NXAGENT_SERVER - res = (*func)(this->value, this->id, cdata); - - if (*resptr != resources) - goto RestartLoop; - - if (res) - return this->value; - #else - if((*func)(this->value, this->id, cdata)) - return this->value; - #endif - } - } - } - return NULL; -} - - -void -FreeClientNeverRetainResources(ClientPtr client) -{ - ResourcePtr *resources; - ResourcePtr this; - ResourcePtr *prev; - int j; - - if (!client) - return; - - resources = clientTable[client->index].resources; - for (j=0; j < clientTable[client->index].buckets; j++) - { - prev = &resources[j]; - while ( (this = *prev) ) - { - RESTYPE rtype = this->type; - if (rtype & RC_NEVERRETAIN) - { - *prev = this->next; - if (rtype & RC_CACHED) - FlushClientCaches(this->id); - (*DeleteFuncs[rtype & TypeMask])(this->value, this->id); - xfree(this); - } - else - prev = &this->next; - } - } -} - -void -FreeClientResources(ClientPtr client) -{ - register ResourcePtr *resources; - register ResourcePtr this; - int j; - - /* This routine shouldn't be called with a null client, but just in - case ... */ - - if (!client) - return; - - HandleSaveSet(client); - - resources = clientTable[client->index].resources; - for (j=0; j < clientTable[client->index].buckets; j++) - { - /* It may seem silly to update the head of this resource list as - we delete the members, since the entire list will be deleted any way, - but there are some resource deletion functions "FreeClientPixels" for - one which do a LookupID on another resource id (a Colormap id in this - case), so the resource list must be kept valid up to the point that - it is deleted, so every time we delete a resource, we must update the - head, just like in FreeResource. I hope that this doesn't slow down - mass deletion appreciably. PRH */ - - ResourcePtr *head; - - head = &resources[j]; - - for (this = *head; this; this = *head) - { - RESTYPE rtype = this->type; - *head = this->next; - if (rtype & RC_CACHED) - FlushClientCaches(this->id); - (*DeleteFuncs[rtype & TypeMask])(this->value, this->id); - xfree(this); - } - } - xfree(clientTable[client->index].resources); - clientTable[client->index].resources = NULL; - clientTable[client->index].buckets = 0; -} - -void -FreeAllResources() -{ - int i; - - for (i = currentMaxClients; --i >= 0; ) - { - if (clientTable[i].buckets) - FreeClientResources(clients[i]); - } -} - -Bool -LegalNewID(XID id, register ClientPtr client) -{ - -#ifdef PANORAMIX - XID minid, maxid; - - if (!noPanoramiXExtension) { - minid = client->clientAsMask | (client->index ? - SERVER_BIT : SERVER_MINID); - maxid = (clientTable[client->index].fakeID | RESOURCE_ID_MASK) + 1; - if ((id >= minid) && (id <= maxid)) - return TRUE; - } -#endif /* PANORAMIX */ - return ((client->clientAsMask == (id & ~RESOURCE_ID_MASK)) && - ((clientTable[client->index].expectID <= id) || - !LookupIDByClass(id, RC_ANY))); -} - -#ifdef XCSECURITY - -/* SecurityLookupIDByType and SecurityLookupIDByClass: - * These are the heart of the resource ID security system. They take - * two additional arguments compared to the old LookupID functions: - * the client doing the lookup, and the access mode (see resource.h). - * The resource is returned if it exists and the client is allowed access, - * else NULL is returned. - */ - -pointer -SecurityLookupIDByType(ClientPtr client, XID id, RESTYPE rtype, Mask mode) -{ - int cid; - register ResourcePtr res; - pointer retval = NULL; - - assert(client == NullClient || - (client->index <= currentMaxClients && clients[client->index] == client)); - assert( (rtype & TypeMask) <= lastResourceType); - - if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && - clientTable[cid].buckets) - { - res = clientTable[cid].resources[Hash(cid, id)]; - - for (; res; res = res->next) - if ((res->id == id) && (res->type == rtype)) - { - retval = res->value; - break; - } - } - if (retval && client && client->CheckAccess) - retval = (* client->CheckAccess)(client, id, rtype, mode, retval); - return retval; -} - - -pointer -SecurityLookupIDByClass(ClientPtr client, XID id, RESTYPE classes, Mask mode) -{ - int cid; - register ResourcePtr res = NULL; - pointer retval = NULL; - - assert(client == NullClient || - (client->index <= currentMaxClients && clients[client->index] == client)); - assert (classes >= lastResourceClass); - - if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && - clientTable[cid].buckets) - { - res = clientTable[cid].resources[Hash(cid, id)]; - - for (; res; res = res->next) - if ((res->id == id) && (res->type & classes)) - { - retval = res->value; - break; - } - } - if (retval && client && client->CheckAccess) - retval = (* client->CheckAccess)(client, id, res->type, mode, retval); - return retval; -} - -/* We can't replace the LookupIDByType and LookupIDByClass functions with - * macros because of compatibility with loadable servers. - */ - -pointer -LookupIDByType(XID id, RESTYPE rtype) -{ - return SecurityLookupIDByType(NullClient, id, rtype, - SecurityUnknownAccess); -} - -pointer -LookupIDByClass(XID id, RESTYPE classes) -{ - return SecurityLookupIDByClass(NullClient, id, classes, - SecurityUnknownAccess); -} - -#else /* not XCSECURITY */ - -/* - * LookupIDByType returns the object with the given id and type, else NULL. - */ -pointer -LookupIDByType(XID id, RESTYPE rtype) -{ - int cid; - register ResourcePtr res; - - if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && - clientTable[cid].buckets) - { - res = clientTable[cid].resources[Hash(cid, id)]; - - for (; res; res = res->next) - if ((res->id == id) && (res->type == rtype)) - return res->value; - } - return (pointer)NULL; -} - -/* - * LookupIDByClass returns the object with the given id and any one of the - * given classes, else NULL. - */ -pointer -LookupIDByClass(XID id, RESTYPE classes) -{ - int cid; - register ResourcePtr res; - - if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && - clientTable[cid].buckets) - { - res = clientTable[cid].resources[Hash(cid, id)]; - - for (; res; res = res->next) - if ((res->id == id) && (res->type & classes)) - return res->value; - } - return (pointer)NULL; -} - -#endif /* XCSECURITY */ - diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c index e3e4f4b83..a6d638ea7 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c @@ -967,8 +967,17 @@ ProcShmPutImage(client) return BadValue; } - VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, - client); + /* + * There's a potential integer overflow in this check: + * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, + * client); + * the version below ought to avoid it + */ + if (stuff->totalHeight != 0 && + length > (shmdesc->size - stuff->offset)/stuff->totalHeight) { + client->errorValue = stuff->totalWidth; + return BadValue; + } if (stuff->srcX > stuff->totalWidth) { client->errorValue = stuff->srcX; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original index e3e4f4b83..a6d638ea7 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original @@ -967,8 +967,17 @@ ProcShmPutImage(client) return BadValue; } - VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, - client); + /* + * There's a potential integer overflow in this check: + * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, + * client); + * the version below ought to avoid it + */ + if (stuff->totalHeight != 0 && + length > (shmdesc->size - stuff->offset)/stuff->totalHeight) { + client->errorValue = stuff->totalWidth; + return BadValue; + } if (stuff->srcX > stuff->totalWidth) { client->errorValue = stuff->srcX; diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original index e2cf8cd24..f25bb9b5d 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original +++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original @@ -863,8 +863,17 @@ ProcShmPutImage(client) return BadValue; } - VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, - client); + /* + * There's a potential integer overflow in this check: + * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, + * client); + * the version below ought to avoid it + */ + if (stuff->totalHeight != 0 && + length > (shmdesc->size - stuff->offset)/stuff->totalHeight) { + client->errorValue = stuff->totalWidth; + return BadValue; + } if (stuff->srcX > stuff->totalWidth) { client->errorValue = stuff->srcX; |