aboutsummaryrefslogtreecommitdiff
path: root/nx-X11
diff options
context:
space:
mode:
Diffstat (limited to 'nx-X11')
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/CHANGELOG7
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c19
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original19
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original14
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c18
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original18
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original18
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original8
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~1250
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c13
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original13
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original13
12 files changed, 132 insertions, 1278 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG b/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG
index e3b71e645..7cf04acc0 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG
+++ b/nx-X11/programs/Xserver/hw/nxagent/CHANGELOG
@@ -1,5 +1,12 @@
ChangeLog:
+nxagent-3.2.0-7
+
+- Imported patch fixing issues from X.Org security advisory, June
+ 11th, 2008: Multiple vulnerabilities in X server extensions. CVE
+ IDs: CVE-2008-1377, CVE-2008-1379, CVE-2008-2360, CVE-2008-2361,
+ CVE-2008-2362.
+
nxagent-3.2.0-6
- Fixed TR05F02063. Ignore ReparentNotify events for non-rootless
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c
index 06dabddaa..f51a8bce9 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c
@@ -69,6 +69,17 @@
#undef DEBUG
#undef TEST
+#else
+
+#include "picturestr.h"
+#include "glyphstr.h"
+
+#endif
+
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
#endif
/*
@@ -401,8 +412,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{
int size;
GlyphPtr glyph;
-
- size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
+ size_t padded_width;
+
+ padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
+ if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
+ return 0;
+ size = gi->height * padded_width;
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph)
return 0;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original
index 06dabddaa..f51a8bce9 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original
@@ -69,6 +69,17 @@
#undef DEBUG
#undef TEST
+#else
+
+#include "picturestr.h"
+#include "glyphstr.h"
+
+#endif
+
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
#endif
/*
@@ -401,8 +412,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{
int size;
GlyphPtr glyph;
-
- size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
+ size_t padded_width;
+
+ padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
+ if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
+ return 0;
+ size = gi->height * padded_width;
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph)
return 0;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original
index 45c5dd975..9f4d1c87b 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original
@@ -43,6 +43,12 @@
#include "picturestr.h"
#include "glyphstr.h"
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
/*
* From Knuth -- a good choice for hash/rehash values is p, p-2 where
* p and p-2 are both prime. These tables are sized to have an extra 10%
@@ -334,8 +340,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{
int size;
GlyphPtr glyph;
-
- size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
+ size_t padded_width;
+
+ padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
+ if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
+ return 0;
+ size = gi->height * padded_width;
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph)
return 0;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
index 00c55cde7..de2df855f 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
@@ -1893,6 +1893,8 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height;
+ if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+ return BadAlloc;
if ( stuff->x > width
|| stuff->y > height )
return (BadMatch);
@@ -2353,6 +2355,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -2955,18 +2959,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client);
}
-static void swapStops(void *stuff, int n)
+static void swapStops(void *stuff, int num)
{
- int i;
+ int i, n;
CARD32 *stops;
CARD16 *colors;
stops = (CARD32 *)(stuff);
- for (i = 0; i < n; ++i) {
+ for (i = 0; i < num; ++i) {
swapl(stops, n);
++stops;
}
colors = (CARD16 *)(stops);
- for (i = 0; i < 4*n; ++i) {
+ for (i = 0; i < 4*num; ++i) {
swaps(stops, n);
++stops;
}
@@ -2989,6 +2993,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -3016,6 +3022,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -3040,6 +3048,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original
index 00c55cde7..de2df855f 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original
@@ -1893,6 +1893,8 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height;
+ if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+ return BadAlloc;
if ( stuff->x > width
|| stuff->y > height )
return (BadMatch);
@@ -2353,6 +2355,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -2955,18 +2959,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client);
}
-static void swapStops(void *stuff, int n)
+static void swapStops(void *stuff, int num)
{
- int i;
+ int i, n;
CARD32 *stops;
CARD16 *colors;
stops = (CARD32 *)(stuff);
- for (i = 0; i < n; ++i) {
+ for (i = 0; i < num; ++i) {
swapl(stops, n);
++stops;
}
colors = (CARD16 *)(stops);
- for (i = 0; i < 4*n; ++i) {
+ for (i = 0; i < 4*num; ++i) {
swaps(stops, n);
++stops;
}
@@ -2989,6 +2993,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -3016,6 +3022,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -3040,6 +3048,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original
index d2759ab10..d25d49756 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original
@@ -1505,6 +1505,8 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height;
+ if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
+ return BadAlloc;
if ( stuff->x > width
|| stuff->y > height )
return (BadMatch);
@@ -1918,6 +1920,8 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -2489,18 +2493,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client);
}
-static void swapStops(void *stuff, int n)
+static void swapStops(void *stuff, int num)
{
- int i;
+ int i, n;
CARD32 *stops;
CARD16 *colors;
stops = (CARD32 *)(stuff);
- for (i = 0; i < n; ++i) {
+ for (i = 0; i < num; ++i) {
swapl(stops, n);
++stops;
}
colors = (CARD16 *)(stops);
- for (i = 0; i < 4*n; ++i) {
+ for (i = 0; i < 4*num; ++i) {
swaps(stops, n);
++stops;
}
@@ -2523,6 +2527,8 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -2550,6 +2556,8 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
@@ -2574,6 +2582,8 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+ if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
+ return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original
index 7dd021a6e..91e03cb0e 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original
@@ -194,10 +194,6 @@ static DeleteType *DeleteFuncs = (DeleteType *)NULL;
Atom * ResourceNames = NULL;
-#ifdef NXAGENT_SERVER
-static int nxagentResChangedFlag = 0;
-#endif
-
void RegisterResourceName (RESTYPE type, char *name)
{
ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE);
@@ -205,6 +201,10 @@ void RegisterResourceName (RESTYPE type, char *name)
#endif
+#ifdef NXAGENT_SERVER
+static int nxagentResChangedFlag = 0;
+#endif
+
RESTYPE
CreateNewResourceType(DeleteType deleteFunc)
{
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~ b/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~
deleted file mode 100644
index 7dd021a6e..000000000
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~
+++ /dev/null
@@ -1,1250 +0,0 @@
-/**************************************************************************/
-/* */
-/* Copyright (c) 2001, 2007 NoMachine, http://www.nomachine.com/. */
-/* */
-/* NXAGENT, NX protocol compression and NX extensions to this software */
-/* are copyright of NoMachine. Redistribution and use of the present */
-/* software is allowed according to terms specified in the file LICENSE */
-/* which comes in the source distribution. */
-/* */
-/* Check http://www.nomachine.com/licensing.html for applicability. */
-/* */
-/* NX and NoMachine are trademarks of NoMachine S.r.l. */
-/* */
-/* All rights reserved. */
-/* */
-/**************************************************************************/
-
-/************************************************************
-
-Copyright 1987, 1998 The Open Group
-
-Permission to use, copy, modify, distribute, and sell this software and its
-documentation for any purpose is hereby granted without fee, provided that
-the above copyright notice appear in all copies and that both that
-copyright notice and this permission notice appear in supporting
-documentation.
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-Except as contained in this notice, the name of The Open Group shall not be
-used in advertising or otherwise to promote the sale, use or other dealings
-in this Software without prior written authorization from The Open Group.
-
-
-Copyright 1987 by Digital Equipment Corporation, Maynard, Massachusetts.
-
- All Rights Reserved
-
-Permission to use, copy, modify, and distribute this software and its
-documentation for any purpose and without fee is hereby granted,
-provided that the above copyright notice appear in all copies and that
-both that copyright notice and this permission notice appear in
-supporting documentation, and that the name of Digital not be
-used in advertising or publicity pertaining to distribution of the
-software without specific, written prior permission.
-
-DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
-ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
-DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
-ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
-WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
-ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
-SOFTWARE.
-
-********************************************************/
-/* The panoramix components contained the following notice */
-/*****************************************************************
-
-Copyright (c) 1991, 1997 Digital Equipment Corporation, Maynard, Massachusetts.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software.
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM, DAMAGES, INCLUDING,
-BUT NOT LIMITED TO CONSEQUENTIAL OR INCIDENTAL DAMAGES, OR OTHER LIABILITY,
-WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
-IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-Except as contained in this notice, the name of Digital Equipment Corporation
-shall not be used in advertising or otherwise to promote the sale, use or other
-dealings in this Software without prior written authorization from Digital
-Equipment Corporation.
-
-******************************************************************/
-
-/* $Xorg: resource.c,v 1.5 2001/02/09 02:04:40 xorgcvs Exp $ */
-/* $XdotOrg: xc/programs/Xserver/dix/resource.c,v 1.8 2005/07/03 08:53:38 daniels Exp $ */
-/* $TOG: resource.c /main/41 1998/02/09 14:20:31 kaleb $ */
-
-/* Routines to manage various kinds of resources:
- *
- * CreateNewResourceType, CreateNewResourceClass, InitClientResources,
- * FakeClientID, AddResource, FreeResource, FreeClientResources,
- * FreeAllResources, LookupIDByType, LookupIDByClass, GetXIDRange
- */
-
-/*
- * A resource ID is a 32 bit quantity, the upper 2 bits of which are
- * off-limits for client-visible resources. The next 8 bits are
- * used as client ID, and the low 22 bits come from the client.
- * A resource ID is "hashed" by extracting and xoring subfields
- * (varying with the size of the hash table).
- *
- * It is sometimes necessary for the server to create an ID that looks
- * like it belongs to a client. This ID, however, must not be one
- * the client actually can create, or we have the potential for conflict.
- * The 31st bit of the ID is reserved for the server's use for this
- * purpose. By setting CLIENT_ID(id) to the client, the SERVER_BIT to
- * 1, and an otherwise arbitrary ID in the low 22 bits, we can create a
- * resource "owned" by the client.
- */
-/* $XFree86: xc/programs/Xserver/dix/resource.c,v 3.13 2003/09/24 02:43:13 dawes Exp $ */
-
-#define NEED_EVENTS
-#ifdef HAVE_DIX_CONFIG_H
-#include <dix-config.h>
-#endif
-
-#include <X11/X.h>
-#include "misc.h"
-#include "os.h"
-#include "resource.h"
-#include "dixstruct.h"
-#include "opaque.h"
-#include "windowstr.h"
-#include "dixfont.h"
-#include "colormap.h"
-#include "inputstr.h"
-#include "dixevents.h"
-#include "dixgrabs.h"
-#include "cursor.h"
-#ifdef PANORAMIX
-#include "panoramiX.h"
-#include "panoramiXsrv.h"
-#endif
-#include <assert.h>
-
-#ifdef NXAGENT_SERVER
-
-#include "Agent.h"
-#include "Font.h"
-#include "Pixmaps.h"
-#include "GCs.h"
-
-#define PANIC
-#define WARNING
-#undef TEST
-#undef DEBUG
-
-#endif
-
-static void RebuildTable(
- int /*client*/
-);
-
-#define SERVER_MINID 32
-
-#define INITBUCKETS 64
-#define INITHASHSIZE 6
-#define MAXHASHSIZE 11
-
-typedef struct _Resource {
- struct _Resource *next;
- XID id;
- RESTYPE type;
- pointer value;
-} ResourceRec, *ResourcePtr;
-#define NullResource ((ResourcePtr)NULL)
-
-typedef struct _ClientResource {
- ResourcePtr *resources;
- int elements;
- int buckets;
- int hashsize; /* log(2)(buckets) */
- XID fakeID;
- XID endFakeID;
- XID expectID;
-} ClientResourceRec;
-
-RESTYPE lastResourceType;
-static RESTYPE lastResourceClass;
-RESTYPE TypeMask;
-
-static DeleteType *DeleteFuncs = (DeleteType *)NULL;
-
-#ifdef XResExtension
-
-Atom * ResourceNames = NULL;
-
-#ifdef NXAGENT_SERVER
-static int nxagentResChangedFlag = 0;
-#endif
-
-void RegisterResourceName (RESTYPE type, char *name)
-{
- ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE);
-}
-
-#endif
-
-RESTYPE
-CreateNewResourceType(DeleteType deleteFunc)
-{
- RESTYPE next = lastResourceType + 1;
- DeleteType *funcs;
-
- if (next & lastResourceClass)
- return 0;
- funcs = (DeleteType *)xrealloc(DeleteFuncs,
- (next + 1) * sizeof(DeleteType));
- if (!funcs)
- return 0;
-
-#ifdef XResExtension
- {
- Atom *newnames;
- newnames = xrealloc(ResourceNames, (next + 1) * sizeof(Atom));
- if(!newnames)
- return 0;
- ResourceNames = newnames;
- ResourceNames[next] = 0;
- }
-#endif
-
- lastResourceType = next;
- DeleteFuncs = funcs;
- DeleteFuncs[next] = deleteFunc;
- return next;
-}
-
-RESTYPE
-CreateNewResourceClass()
-{
- RESTYPE next = lastResourceClass >> 1;
-
- if (next & lastResourceType)
- return 0;
- lastResourceClass = next;
- TypeMask = next - 1;
- return next;
-}
-
-ClientResourceRec clientTable[MAXCLIENTS];
-
-/*****************
- * InitClientResources
- * When a new client is created, call this to allocate space
- * in resource table
- *****************/
-
-Bool
-InitClientResources(ClientPtr client)
-{
- register int i, j;
-
- if (client == serverClient)
- {
- lastResourceType = RT_LASTPREDEF;
- lastResourceClass = RC_LASTPREDEF;
- TypeMask = RC_LASTPREDEF - 1;
- if (DeleteFuncs)
- xfree(DeleteFuncs);
- DeleteFuncs = (DeleteType *)xalloc((lastResourceType + 1) *
- sizeof(DeleteType));
- if (!DeleteFuncs)
- return FALSE;
- DeleteFuncs[RT_NONE & TypeMask] = (DeleteType)NoopDDA;
- DeleteFuncs[RT_WINDOW & TypeMask] = DeleteWindow;
- DeleteFuncs[RT_PIXMAP & TypeMask] = dixDestroyPixmap;
- DeleteFuncs[RT_GC & TypeMask] = FreeGC;
- DeleteFuncs[RT_FONT & TypeMask] = CloseFont;
- DeleteFuncs[RT_CURSOR & TypeMask] = FreeCursor;
- DeleteFuncs[RT_COLORMAP & TypeMask] = FreeColormap;
- DeleteFuncs[RT_CMAPENTRY & TypeMask] = FreeClientPixels;
- DeleteFuncs[RT_OTHERCLIENT & TypeMask] = OtherClientGone;
- DeleteFuncs[RT_PASSIVEGRAB & TypeMask] = DeletePassiveGrab;
-
-#ifdef XResExtension
- if(ResourceNames)
- xfree(ResourceNames);
- ResourceNames = xalloc((lastResourceType + 1) * sizeof(Atom));
- if(!ResourceNames)
- return FALSE;
-#endif
- }
- clientTable[i = client->index].resources =
- (ResourcePtr *)xalloc(INITBUCKETS*sizeof(ResourcePtr));
- if (!clientTable[i].resources)
- return FALSE;
- clientTable[i].buckets = INITBUCKETS;
- clientTable[i].elements = 0;
- clientTable[i].hashsize = INITHASHSIZE;
- /* Many IDs allocated from the server client are visible to clients,
- * so we don't use the SERVER_BIT for them, but we have to start
- * past the magic value constants used in the protocol. For normal
- * clients, we can start from zero, with SERVER_BIT set.
- */
- clientTable[i].fakeID = client->clientAsMask |
- (client->index ? SERVER_BIT : SERVER_MINID);
- clientTable[i].endFakeID = (clientTable[i].fakeID | RESOURCE_ID_MASK) + 1;
- clientTable[i].expectID = client->clientAsMask;
- for (j=0; j<INITBUCKETS; j++)
- {
- clientTable[i].resources[j] = NullResource;
- }
- return TRUE;
-}
-
-
-static int
-Hash(int client, register XID id)
-{
- id &= RESOURCE_ID_MASK;
- switch (clientTable[client].hashsize)
- {
- case 6:
- return ((int)(0x03F & (id ^ (id>>6) ^ (id>>12))));
- case 7:
- return ((int)(0x07F & (id ^ (id>>7) ^ (id>>13))));
- case 8:
- return ((int)(0x0FF & (id ^ (id>>8) ^ (id>>16))));
- case 9:
- return ((int)(0x1FF & (id ^ (id>>9))));
- case 10:
- return ((int)(0x3FF & (id ^ (id>>10))));
- case 11:
- return ((int)(0x7FF & (id ^ (id>>11))));
- }
- return -1;
-}
-
-static XID
-AvailableID(
- register int client,
- register XID id,
- register XID maxid,
- register XID goodid)
-{
- register ResourcePtr res;
-
- if ((goodid >= id) && (goodid <= maxid))
- return goodid;
- for (; id <= maxid; id++)
- {
- res = clientTable[client].resources[Hash(client, id)];
- while (res && (res->id != id))
- res = res->next;
- if (!res)
- return id;
- }
- return 0;
-}
-
-void
-GetXIDRange(int client, Bool server, XID *minp, XID *maxp)
-{
- register XID id, maxid;
- register ResourcePtr *resp;
- register ResourcePtr res;
- register int i;
- XID goodid;
-
- id = (Mask)client << CLIENTOFFSET;
- if (server)
- id |= client ? SERVER_BIT : SERVER_MINID;
- maxid = id | RESOURCE_ID_MASK;
- goodid = 0;
- for (resp = clientTable[client].resources, i = clientTable[client].buckets;
- --i >= 0;)
- {
- for (res = *resp++; res; res = res->next)
- {
- if ((res->id < id) || (res->id > maxid))
- continue;
- if (((res->id - id) >= (maxid - res->id)) ?
- (goodid = AvailableID(client, id, res->id - 1, goodid)) :
- !(goodid = AvailableID(client, res->id + 1, maxid, goodid)))
- maxid = res->id - 1;
- else
- id = res->id + 1;
- }
- }
- if (id > maxid)
- id = maxid = 0;
- *minp = id;
- *maxp = maxid;
-}
-
-/**
- * GetXIDList is called by the XC-MISC extension's MiscGetXIDList function.
- * This function tries to find count unused XIDs for the given client. It
- * puts the IDs in the array pids and returns the number found, which should
- * almost always be the number requested.
- *
- * The circumstances that lead to a call to this function are very rare.
- * Xlib must run out of IDs while trying to generate a request that wants
- * multiple ID's, like the Multi-buffering CreateImageBuffers request.
- *
- * No rocket science in the implementation; just iterate over all
- * possible IDs for the given client and pick the first count IDs
- * that aren't in use. A more efficient algorithm could probably be
- * invented, but this will be used so rarely that this should suffice.
- */
-
-unsigned int
-GetXIDList(ClientPtr pClient, unsigned count, XID *pids)
-{
- unsigned int found = 0;
- XID id = pClient->clientAsMask;
- XID maxid;
-
- maxid = id | RESOURCE_ID_MASK;
- while ( (found < count) && (id <= maxid) )
- {
- if (!LookupIDByClass(id, RC_ANY))
- {
- pids[found++] = id;
- }
- id++;
- }
- return found;
-}
-
-/*
- * Return the next usable fake client ID.
- *
- * Normally this is just the next one in line, but if we've used the last
- * in the range, we need to find a new range of safe IDs to avoid
- * over-running another client.
- */
-
-XID
-FakeClientID(register int client)
-{
- XID id, maxid;
-
- id = clientTable[client].fakeID++;
- if (id != clientTable[client].endFakeID)
- return id;
- GetXIDRange(client, TRUE, &id, &maxid);
- if (!id) {
- if (!client)
- FatalError("FakeClientID: server internal ids exhausted\n");
- MarkClientException(clients[client]);
- id = ((Mask)client << CLIENTOFFSET) | (SERVER_BIT * 3);
- maxid = id | RESOURCE_ID_MASK;
- }
- clientTable[client].fakeID = id + 1;
- clientTable[client].endFakeID = maxid + 1;
- return id;
-}
-
-#ifdef NXAGENT_SERVER
-
-int nxagentFindClientResource(int client, RESTYPE type, pointer value)
-{
- ResourcePtr pResource;
- ResourcePtr *resources;
-
- int i;
-
- for (i = 0; i < clientTable[client].buckets; i++)
- {
- resources = clientTable[client].resources;
-
- for (pResource = resources[i]; pResource; pResource = pResource -> next)
- {
- if (pResource -> type == type && pResource -> value == value)
- {
- #ifdef TEST
- fprintf(stderr, "nxagentFindClientResource: Found resource [%p] type [%lu] "
- "for client [%d].\n", (void *) value,
- pResource -> type, client);
- #endif
-
- return 1;
- }
- }
- }
-
- return 0;
-}
-
-int nxagentSwitchResourceType(int client, RESTYPE type, pointer value)
-{
- ResourcePtr pResource;
- ResourcePtr *resources;
-
- RESTYPE internalType = 0;
-
- int i;
-
- if (type == RT_PIXMAP)
- {
- internalType = RT_NX_PIXMAP;
- }
- else if (type == RT_GC)
- {
- internalType = RT_NX_GC;
- }
- else if (type == RT_FONT)
- {
- internalType = RT_NX_FONT;
- }
- else
- {
- return 0;
- }
-
- if (client == serverClient -> index)
- {
- #ifdef TEST
- fprintf(stderr, "nxagentSwitchResourceType: Requesting client is [%d]. Skipping the resource switch.\n",
- client);
- #endif
-
- return 0;
- }
-
- for (i = 0; i < clientTable[serverClient -> index].buckets; i++)
- {
- resources = clientTable[serverClient -> index].resources;
-
- for (pResource = resources[i]; pResource; pResource = pResource -> next)
- {
- if (pResource -> type == internalType &&
- pResource -> value == value)
- {
- #ifdef TEST
- fprintf(stderr, "nxagentSwitchResourceType: Changing resource [%p] type from [%lu] to "
- "[%lu] for server client [%d].\n", (void *) value,
- (unsigned long) pResource -> type, (unsigned long) type, serverClient -> index);
- #endif
-
- FreeResource(pResource -> id, RT_NONE);
-
- return 1;
- }
- }
- }
-
- return 0;
-}
-
-#endif
-
-Bool
-AddResource(XID id, RESTYPE type, pointer value)
-{
- int client;
- register ClientResourceRec *rrec;
- register ResourcePtr res, *head;
-
- client = CLIENT_ID(id);
- rrec = &clientTable[client];
- if (!rrec->buckets)
- {
- ErrorF("AddResource(%lx, %lx, %lx), client=%d \n",
- (unsigned long)id, type, (unsigned long)value, client);
- FatalError("client not in use\n");
- }
-
-#ifdef NXAGENT_SERVER
-
- nxagentSwitchResourceType(client, type, value);
-
- #ifdef TEST
- fprintf(stderr, "AddResource: Adding resource for client [%d] type [%lu] value [%p] id [%lu].\n",
- client, (unsigned long) type, (void *) value, (unsigned long) id);
- #endif
-
-#endif
-
- if ((rrec->elements >= 4*rrec->buckets) &&
- (rrec->hashsize < MAXHASHSIZE))
- RebuildTable(client);
- head = &rrec->resources[Hash(client, id)];
- res = (ResourcePtr)xalloc(sizeof(ResourceRec));
- if (!res)
- {
- (*DeleteFuncs[type & TypeMask])(value, id);
- return FALSE;
- }
- res->next = *head;
- res->id = id;
- res->type = type;
- res->value = value;
- *head = res;
- rrec->elements++;
- #ifdef NXAGENT_SERVER
- nxagentResChangedFlag = 1;
- #endif
- if (!(id & SERVER_BIT) && (id >= rrec->expectID))
- rrec->expectID = id + 1;
- return TRUE;
-}
-
-static void
-RebuildTable(int client)
-{
- register int j;
- register ResourcePtr res, next;
- ResourcePtr **tails, *resources;
- register ResourcePtr **tptr, *rptr;
-
- /*
- * For now, preserve insertion order, since some ddx layers depend
- * on resources being free in the opposite order they are added.
- */
-
- j = 2 * clientTable[client].buckets;
- tails = (ResourcePtr **)ALLOCATE_LOCAL(j * sizeof(ResourcePtr *));
- if (!tails)
- return;
- resources = (ResourcePtr *)xalloc(j * sizeof(ResourcePtr));
- if (!resources)
- {
- DEALLOCATE_LOCAL(tails);
- return;
- }
- for (rptr = resources, tptr = tails; --j >= 0; rptr++, tptr++)
- {
- *rptr = NullResource;
- *tptr = rptr;
- }
- clientTable[client].hashsize++;
- for (j = clientTable[client].buckets,
- rptr = clientTable[client].resources;
- --j >= 0;
- rptr++)
- {
- for (res = *rptr; res; res = next)
- {
- next = res->next;
- res->next = NullResource;
- tptr = &tails[Hash(client, res->id)];
- **tptr = res;
- *tptr = &res->next;
- }
- }
- DEALLOCATE_LOCAL(tails);
- clientTable[client].buckets *= 2;
- xfree(clientTable[client].resources);
- clientTable[client].resources = resources;
-}
-
-void
-FreeResource(XID id, RESTYPE skipDeleteFuncType)
-{
- int cid;
- register ResourcePtr res;
- register ResourcePtr *prev, *head;
- register int *eltptr;
- int elements;
- Bool gotOne = FALSE;
-
-#ifdef NXAGENT_SERVER
-
- #ifdef TEST
- fprintf(stderr, "FreeResource: Freeing resource id [%lu].\n", (unsigned long) id);
- #endif
-
-#endif
-
- if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets)
- {
- head = &clientTable[cid].resources[Hash(cid, id)];
- eltptr = &clientTable[cid].elements;
-
- prev = head;
- while ( (res = *prev) )
- {
- if (res->id == id)
- {
- RESTYPE rtype = res->type;
- *prev = res->next;
- elements = --*eltptr;
- #ifdef NXAGENT_SERVER
- nxagentResChangedFlag = 1;
- #endif
- if (rtype & RC_CACHED)
- FlushClientCaches(res->id);
- if (rtype != skipDeleteFuncType)
- (*DeleteFuncs[rtype & TypeMask])(res->value, res->id);
- xfree(res);
- if (*eltptr != elements)
- prev = head; /* prev may no longer be valid */
- gotOne = TRUE;
- }
- else
- prev = &res->next;
- }
- if(clients[cid] && (id == clients[cid]->lastDrawableID))
- {
- clients[cid]->lastDrawable = (DrawablePtr)WindowTable[0];
- clients[cid]->lastDrawableID = WindowTable[0]->drawable.id;
- }
- }
- if (!gotOne)
- ErrorF("Freeing resource id=%lX which isn't there.\n",
- (unsigned long)id);
-}
-
-
-void
-FreeResourceByType(XID id, RESTYPE type, Bool skipFree)
-{
- int cid;
- register ResourcePtr res;
- register ResourcePtr *prev, *head;
- if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets)
- {
- head = &clientTable[cid].resources[Hash(cid, id)];
-
- prev = head;
- while ( (res = *prev) )
- {
- if (res->id == id && res->type == type)
- {
- *prev = res->next;
- #ifdef NXAGENT_SERVER
- nxagentResChangedFlag = 1;
- #endif
- if (type & RC_CACHED)
- FlushClientCaches(res->id);
- if (!skipFree)
- (*DeleteFuncs[type & TypeMask])(res->value, res->id);
- xfree(res);
- break;
- }
- else
- prev = &res->next;
- }
- if(clients[cid] && (id == clients[cid]->lastDrawableID))
- {
- clients[cid]->lastDrawable = (DrawablePtr)WindowTable[0];
- clients[cid]->lastDrawableID = WindowTable[0]->drawable.id;
- }
- }
-}
-
-/*
- * Change the value associated with a resource id. Caller
- * is responsible for "doing the right thing" with the old
- * data
- */
-
-Bool
-ChangeResourceValue (XID id, RESTYPE rtype, pointer value)
-{
- int cid;
- register ResourcePtr res;
-
- if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets)
- {
- res = clientTable[cid].resources[Hash(cid, id)];
-
- for (; res; res = res->next)
- if ((res->id == id) && (res->type == rtype))
- {
- if (rtype & RC_CACHED)
- FlushClientCaches(res->id);
- res->value = value;
- return TRUE;
- }
- }
- return FALSE;
-}
-
-/* Note: if func adds or deletes resources, then func can get called
- * more than once for some resources. If func adds new resources,
- * func might or might not get called for them. func cannot both
- * add and delete an equal number of resources!
- */
-
-void
-FindClientResourcesByType(
- ClientPtr client,
- RESTYPE type,
- FindResType func,
- pointer cdata
-){
- register ResourcePtr *resources;
- register ResourcePtr this, next;
- int i, elements;
- register int *eltptr;
-
- #ifdef NXAGENT_SERVER
- register ResourcePtr **resptr;
- #endif
-
- if (!client)
- client = serverClient;
-
-/*
- * If func triggers a resource table
- * rebuild then restart the loop.
- */
-
-#ifdef NXAGENT_SERVER
-RestartLoop:
-#endif
-
- resources = clientTable[client->index].resources;
-
- #ifdef NXAGENT_SERVER
- resptr = &clientTable[client->index].resources;
- #endif
-
- eltptr = &clientTable[client->index].elements;
- for (i = 0; i < clientTable[client->index].buckets; i++)
- {
- for (this = resources[i]; this; this = next)
- {
- next = this->next;
- if (!type || this->type == type) {
- elements = *eltptr;
-
- /*
- * FIXME:
- * It is not safe to let a function change the resource
- * table we are reading!
- */
-
- #ifdef NXAGENT_SERVER
- nxagentResChangedFlag = 0;
- #endif
- (*func)(this->value, this->id, cdata);
-
- /*
- * Avoid that a call to RebuildTable() could invalidate the
- * pointer. This is safe enough, because in RebuildTable()
- * the new pointer is allocated just before the old one is
- * freed, so it can't point to the same address.
- */
-
- #ifdef NXAGENT_SERVER
- if (*resptr != resources)
- goto RestartLoop;
- #endif
-
- /*
- * It's not enough to check if the number of elements has
- * changed, beacause it could happen that the number of
- * resources that have been added matches the number of
- * the freed ones.
- * 'nxagentResChangedFlag' is set if a resource has been
- * added or freed.
- */
-
- #ifdef NXAGENT_SERVER
- if (*eltptr != elements || nxagentResChangedFlag)
- #else
- if (*eltptr != elements)
- #endif
- next = resources[i]; /* start over */
- }
- }
- }
-}
-
-void
-FindAllClientResources(
- ClientPtr client,
- FindAllRes func,
- pointer cdata
-){
- register ResourcePtr *resources;
- register ResourcePtr this, next;
- int i, elements;
- register int *eltptr;
-
- #ifdef NXAGENT_SERVER
- register ResourcePtr **resptr;
- #endif
-
- if (!client)
- client = serverClient;
-
-/*
- * If func triggers a resource table
- * rebuild then restart the loop.
- */
-
-#ifdef NXAGENT_SERVER
-RestartLoop:
-#endif
-
- resources = clientTable[client->index].resources;
-
- #ifdef NXAGENT_SERVER
- resptr = &clientTable[client->index].resources;
- #endif
-
- eltptr = &clientTable[client->index].elements;
- for (i = 0; i < clientTable[client->index].buckets; i++)
- {
- for (this = resources[i]; this; this = next)
- {
- next = this->next;
- elements = *eltptr;
-
- /*
- * FIXME:
- * It is not safe to let a function change the resource
- * table we are reading!
- */
-
- #ifdef NXAGENT_SERVER
- nxagentResChangedFlag = 0;
- #endif
- (*func)(this->value, this->id, this->type, cdata);
-
- /*
- * Avoid that a call to RebuildTable() could invalidate the
- * pointer. This is safe enough, because in RebuildTable()
- * the new pointer is allocated just before the old one is
- * freed, so it can't point to the same address.
- */
-
- #ifdef NXAGENT_SERVER
- if (*resptr != resources)
- goto RestartLoop;
- #endif
-
- /*
- * It's not enough to check if the number of elements has
- * changed, beacause it could happen that the number of
- * resources that have been added matches the number of
- * the freed ones.
- * 'nxagentResChangedFlag' is set if a resource has been
- * added or freed.
- */
-
- #ifdef NXAGENT_SERVER
- if (*eltptr != elements || nxagentResChangedFlag)
- #else
- if (*eltptr != elements)
- #endif
- next = resources[i]; /* start over */
- }
- }
-}
-
-
-pointer
-LookupClientResourceComplex(
- ClientPtr client,
- RESTYPE type,
- FindComplexResType func,
- pointer cdata
-){
- ResourcePtr *resources;
- ResourcePtr this;
- int i;
-
- #ifdef NXAGENT_SERVER
- ResourcePtr **resptr;
- Bool res;
- #endif
-
- if (!client)
- client = serverClient;
-
-/*
- * If func triggers a resource table
- * rebuild then restart the loop.
- */
-
-#ifdef NXAGENT_SERVER
-RestartLoop:
-#endif
-
- resources = clientTable[client->index].resources;
-
- #ifdef NXAGENT_SERVER
- resptr = &clientTable[client->index].resources;
- #endif
-
- for (i = 0; i < clientTable[client->index].buckets; i++) {
- for (this = resources[i]; this; this = this->next) {
- if (!type || this->type == type) {
- #ifdef NXAGENT_SERVER
- res = (*func)(this->value, this->id, cdata);
-
- if (*resptr != resources)
- goto RestartLoop;
-
- if (res)
- return this->value;
- #else
- if((*func)(this->value, this->id, cdata))
- return this->value;
- #endif
- }
- }
- }
- return NULL;
-}
-
-
-void
-FreeClientNeverRetainResources(ClientPtr client)
-{
- ResourcePtr *resources;
- ResourcePtr this;
- ResourcePtr *prev;
- int j;
-
- if (!client)
- return;
-
- resources = clientTable[client->index].resources;
- for (j=0; j < clientTable[client->index].buckets; j++)
- {
- prev = &resources[j];
- while ( (this = *prev) )
- {
- RESTYPE rtype = this->type;
- if (rtype & RC_NEVERRETAIN)
- {
- *prev = this->next;
- if (rtype & RC_CACHED)
- FlushClientCaches(this->id);
- (*DeleteFuncs[rtype & TypeMask])(this->value, this->id);
- xfree(this);
- }
- else
- prev = &this->next;
- }
- }
-}
-
-void
-FreeClientResources(ClientPtr client)
-{
- register ResourcePtr *resources;
- register ResourcePtr this;
- int j;
-
- /* This routine shouldn't be called with a null client, but just in
- case ... */
-
- if (!client)
- return;
-
- HandleSaveSet(client);
-
- resources = clientTable[client->index].resources;
- for (j=0; j < clientTable[client->index].buckets; j++)
- {
- /* It may seem silly to update the head of this resource list as
- we delete the members, since the entire list will be deleted any way,
- but there are some resource deletion functions "FreeClientPixels" for
- one which do a LookupID on another resource id (a Colormap id in this
- case), so the resource list must be kept valid up to the point that
- it is deleted, so every time we delete a resource, we must update the
- head, just like in FreeResource. I hope that this doesn't slow down
- mass deletion appreciably. PRH */
-
- ResourcePtr *head;
-
- head = &resources[j];
-
- for (this = *head; this; this = *head)
- {
- RESTYPE rtype = this->type;
- *head = this->next;
- if (rtype & RC_CACHED)
- FlushClientCaches(this->id);
- (*DeleteFuncs[rtype & TypeMask])(this->value, this->id);
- xfree(this);
- }
- }
- xfree(clientTable[client->index].resources);
- clientTable[client->index].resources = NULL;
- clientTable[client->index].buckets = 0;
-}
-
-void
-FreeAllResources()
-{
- int i;
-
- for (i = currentMaxClients; --i >= 0; )
- {
- if (clientTable[i].buckets)
- FreeClientResources(clients[i]);
- }
-}
-
-Bool
-LegalNewID(XID id, register ClientPtr client)
-{
-
-#ifdef PANORAMIX
- XID minid, maxid;
-
- if (!noPanoramiXExtension) {
- minid = client->clientAsMask | (client->index ?
- SERVER_BIT : SERVER_MINID);
- maxid = (clientTable[client->index].fakeID | RESOURCE_ID_MASK) + 1;
- if ((id >= minid) && (id <= maxid))
- return TRUE;
- }
-#endif /* PANORAMIX */
- return ((client->clientAsMask == (id & ~RESOURCE_ID_MASK)) &&
- ((clientTable[client->index].expectID <= id) ||
- !LookupIDByClass(id, RC_ANY)));
-}
-
-#ifdef XCSECURITY
-
-/* SecurityLookupIDByType and SecurityLookupIDByClass:
- * These are the heart of the resource ID security system. They take
- * two additional arguments compared to the old LookupID functions:
- * the client doing the lookup, and the access mode (see resource.h).
- * The resource is returned if it exists and the client is allowed access,
- * else NULL is returned.
- */
-
-pointer
-SecurityLookupIDByType(ClientPtr client, XID id, RESTYPE rtype, Mask mode)
-{
- int cid;
- register ResourcePtr res;
- pointer retval = NULL;
-
- assert(client == NullClient ||
- (client->index <= currentMaxClients && clients[client->index] == client));
- assert( (rtype & TypeMask) <= lastResourceType);
-
- if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
- clientTable[cid].buckets)
- {
- res = clientTable[cid].resources[Hash(cid, id)];
-
- for (; res; res = res->next)
- if ((res->id == id) && (res->type == rtype))
- {
- retval = res->value;
- break;
- }
- }
- if (retval && client && client->CheckAccess)
- retval = (* client->CheckAccess)(client, id, rtype, mode, retval);
- return retval;
-}
-
-
-pointer
-SecurityLookupIDByClass(ClientPtr client, XID id, RESTYPE classes, Mask mode)
-{
- int cid;
- register ResourcePtr res = NULL;
- pointer retval = NULL;
-
- assert(client == NullClient ||
- (client->index <= currentMaxClients && clients[client->index] == client));
- assert (classes >= lastResourceClass);
-
- if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
- clientTable[cid].buckets)
- {
- res = clientTable[cid].resources[Hash(cid, id)];
-
- for (; res; res = res->next)
- if ((res->id == id) && (res->type & classes))
- {
- retval = res->value;
- break;
- }
- }
- if (retval && client && client->CheckAccess)
- retval = (* client->CheckAccess)(client, id, res->type, mode, retval);
- return retval;
-}
-
-/* We can't replace the LookupIDByType and LookupIDByClass functions with
- * macros because of compatibility with loadable servers.
- */
-
-pointer
-LookupIDByType(XID id, RESTYPE rtype)
-{
- return SecurityLookupIDByType(NullClient, id, rtype,
- SecurityUnknownAccess);
-}
-
-pointer
-LookupIDByClass(XID id, RESTYPE classes)
-{
- return SecurityLookupIDByClass(NullClient, id, classes,
- SecurityUnknownAccess);
-}
-
-#else /* not XCSECURITY */
-
-/*
- * LookupIDByType returns the object with the given id and type, else NULL.
- */
-pointer
-LookupIDByType(XID id, RESTYPE rtype)
-{
- int cid;
- register ResourcePtr res;
-
- if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
- clientTable[cid].buckets)
- {
- res = clientTable[cid].resources[Hash(cid, id)];
-
- for (; res; res = res->next)
- if ((res->id == id) && (res->type == rtype))
- return res->value;
- }
- return (pointer)NULL;
-}
-
-/*
- * LookupIDByClass returns the object with the given id and any one of the
- * given classes, else NULL.
- */
-pointer
-LookupIDByClass(XID id, RESTYPE classes)
-{
- int cid;
- register ResourcePtr res;
-
- if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
- clientTable[cid].buckets)
- {
- res = clientTable[cid].resources[Hash(cid, id)];
-
- for (; res; res = res->next)
- if ((res->id == id) && (res->type & classes))
- return res->value;
- }
- return (pointer)NULL;
-}
-
-#endif /* XCSECURITY */
-
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c
index e3e4f4b83..a6d638ea7 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c
@@ -967,8 +967,17 @@ ProcShmPutImage(client)
return BadValue;
}
- VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
- client);
+ /*
+ * There's a potential integer overflow in this check:
+ * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
+ * client);
+ * the version below ought to avoid it
+ */
+ if (stuff->totalHeight != 0 &&
+ length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
+ client->errorValue = stuff->totalWidth;
+ return BadValue;
+ }
if (stuff->srcX > stuff->totalWidth)
{
client->errorValue = stuff->srcX;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original
index e3e4f4b83..a6d638ea7 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original
@@ -967,8 +967,17 @@ ProcShmPutImage(client)
return BadValue;
}
- VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
- client);
+ /*
+ * There's a potential integer overflow in this check:
+ * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
+ * client);
+ * the version below ought to avoid it
+ */
+ if (stuff->totalHeight != 0 &&
+ length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
+ client->errorValue = stuff->totalWidth;
+ return BadValue;
+ }
if (stuff->srcX > stuff->totalWidth)
{
client->errorValue = stuff->srcX;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
index e2cf8cd24..f25bb9b5d 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
+++ b/nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
@@ -863,8 +863,17 @@ ProcShmPutImage(client)
return BadValue;
}
- VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
- client);
+ /*
+ * There's a potential integer overflow in this check:
+ * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
+ * client);
+ * the version below ought to avoid it
+ */
+ if (stuff->totalHeight != 0 &&
+ length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
+ client->errorValue = stuff->totalWidth;
+ return BadValue;
+ }
if (stuff->srcX > stuff->totalWidth)
{
client->errorValue = stuff->srcX;