| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
| |
Similar to _XQueryFont, but with more ways to go wrong and overflow.
Only compiled if libX11 is built with XF86BigFont support.
v2: Fix reply_left calculations, check calculated sizes fit in reply_left
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If the CARD32 reply.nCharInfos * sizeof(XCharStruct) overflows an
unsigned long, then too small of a buffer will be allocated for the
data copied in from the reply.
v2: Fix reply_left calculations, check calculated sizes fit in reply_left
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If exactly one of the two reallocs in XListFontsWithInfo() fails, the
subsequent code accesses memory freed by the other realloc.
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit deedeada53676ee529d700bf96fde0b29a3a1def)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the highly unlikely event that TransFileName was passed a path
containing multiple %L entries, for each entry it would call
_XlcFileName, leaking the previous results, and then for each entry it
would copy from that pointer and free it, resulting in invalid pointers
& possible double frees for each use after the first one freed it.
Error: Use after free (CWE 416)
Use after free of pointer 'lcCompose'
at line 358 of nx-X11/lib/X11/imLcPrs.c in function 'TransFileName'.
Previously freed at line 360 with free.
Error: Use after free (CWE 416)
Use after free of pointer 'lcCompose'
at line 359 of nx-X11/lib/X11/imLcPrs.c in function 'TransFileName'.
Previously freed at line 360 with free.
Error: Double free (CWE 415)
Double free of pointer 'lcCompose'
at line 360 of nx-X11/lib/X11/imLcPrs.c in function 'TransFileName'.
Previously freed at line 360 with free.
[ This bug was found by the Parfait 0.3.6 bug checking tool.
For more information see http://labs.oracle.com/projects/parfait/ ]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 6ac417cea1136a3617f5e40f4b106aaa3f48d6c2)
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
|
|
|
|
|
|
|
|
|
|
|
| |
Tracked variable "size" was passed to a negative sink.
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit be3e6c205d94dedc1cdebf5d17b987f0f828377a)
Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
|
|
|
|
|
|
|
|
| |
Imake unsets __APPLE__ and sets __DARWIN__ instead while autoconf seems to use
__APPLE__ and not __DARWIN__ anymore.
This way we should stay safe for now. Can be changed to __APPLE__ when
we switch to modular.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
CVE-2013-7439).
MakeBigReq inserts a length field after the first 4 bytes of the request
(after req->length), pushing everything else back by 4 bytes.
The current memmove moves everything but the first 4 bytes back. If a
request aligns to the end of the buffer pointer when MakeBigReq is
invoked for that request, this runs over the buffer. Instead, we need to
memmove minus the first 4 bytes (which aren't moved), minus the last 4
bytes (so we still align to the previous tail).
The 4 bytes that fell out are already handled with Data32, which will
handle the buffermax correctly.
The case where req->length = 1 was already not functional.
Reported by Abhishek Arya <inferno@chromium.org> (against X.Org BTS).
https://bugzilla.mozilla.org/show_bug.cgi?id=803762
Reviewed-by: Jeff Muizelaar <jmuizelaar@mozilla.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Rebased-for-NX: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Re-applied after upgrade to libX11 1.3.4: Ulrich Sibiller <uli42@gmx.de>
|
|
|
|
|
|
|
|
| |
Try to offset the cost of all the recent checks we've added by giving
the compiler a hint that the branches that involve us eating data
are less likely to be used than the ones that process it.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
|
|
|
|
|
|
|
|
|
| |
The global was only referenced in the main() function, which passes it
as an argument of the same name to the parse_line() function, leading
to gcc -Wshadow warnings:
makekeys.c: In function ‘parse_line’:
makekeys.c:58:24: warning: declaration of ‘buf’ shadows a global declaration
makekeys.c:54:13: warning: shadowed declaration is here
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Since makekeys is built using build environment's gcc and
runs natively, we have to make sure that the size of the
Signature type is the same on both the native environment
and the target, otherwise we get mismatches upon running X,
and some LSB test failures (xts5).
Use an unsigned 32-bit integer on all platforms. Also,
eliminate the redundant multiple typedefs for the
Signature type.
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
|
|
|
|
| |
makekeys expects filenames as arguments instead of stdin
|
|
|
|
|
|
|
|
|
| |
Since we can't really live without vendor keysyms, scan them all in to
generate ks_tables.h, rather than only doing the core ones, and leaving
the vendor syms to be manually synchronised with XKeysymDB.
Signed-off-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
|
| |
Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Makekeys is used to create an optimal hash of the keysyms defined
in x11proto’s keysymdef.h.
The recent addition of new keysyms there has triggered a bug in
makekeys where it tries to use a zero on the rhs of the % (mod)
operator (resulting in a divide by zero error) whenever it fails
to find a solution within its constraints.
Increasing the size of the arrays allows it to find a solution for
the current set of keysyms.
Makekeys is only run durring the build process, so this has no impact
on users of libX11, only on the amount of VM needed to build it.
It still needs a more complete fix, but this allows compiles to
progress until that is completed.
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
This basically repeats commit bad67799229b94ea2ba0174319949766ad1c2fc6
after the upgrade to libX11 1.3.4.
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
Upstream has changed the header guards. We adapt them to prevent double inclusion.
|
| |
|
| |
|
|
|
|
|
|
|
| |
This patch isn't necessary in Xlib 1.4 and later since the keysymdb has been
made redunant. While we're on 1.3.x, we need it.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
|
|
| |
1.3.6).
|
|
|
|
|
| |
This has already been started while replacing copyright info in file
headers and has now been completed with this commit.
|
|
|
|
| |
that NoMachine placed there own copyright statement in.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Remove defines of NEED_EVENTS and NEED_REPLIES because they are never
used anywhere.
Basically these three commits, but as they are newer and to not match
the code structure the patches have not been applied but replaced by
sed + manual intervention:
From cb95642dc8edebb2935dd471f8b339cb98aa8481 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@redhat.com>
Date: Fri, 28 Nov 2008 22:28:32 +1000
Subject: Remove #define NEED_EVENTS and NEED_REPLIES
A grep on xorg/* revealed there's no consumer of this define.
Quote Alan Coopersmith:
"The consumer was in past versions of the headers now located
in proto/x11proto - for instance, in X11R6.0's xc/include/Xproto.h,
all the event definitions were only available if NEED_EVENTS were
defined, and all the reply definitions required NEED_REPLIES.
Looks like Xproto.h dropped them by X11R6.3, which didn't have
the #ifdef's anymore, so these are truly ancient now."
Signed-off-by: Peter Hutterer <peter.hutterer@redhat.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
--
From 6de368c9aa7ccd2fcd62fca5a2b278913db4d03d Mon Sep 17 00:00:00 2001
From: Fernando Carrijo <fcarrijo@yahoo.com.br>
Date: Thu, 1 Jul 2010 06:50:47 -0300
Subject: Purge macros NEED_EVENTS and NEED_REPLIES
Signed-off-by: Fernando Carrijo <fcarrijo@yahoo.com.br>
Acked-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
--
From 57c03e52e6b4e3ed54df5fdd778865467d08e119 Mon Sep 17 00:00:00 2001
From: Fernando Carrijo <fcarrijo@yahoo.com.br>
Date: Thu, 1 Jul 2010 06:59:48 -0300
Subject: Purge macro NEED_EVENTS
Signed-off-by: Fernando Carrijo <fcarrijo@yahoo.com.br>
Acked-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
| |
|
|
|
|
| |
(mask, newMask).
|
|
|
|
| |
this function (_XimRead).
|
|
|
|
| |
expression has no effect' in _XimFilterPropertyNotify.
|
|
|
|
|
|
|
|
| |
Backported from X.org, patch found in janitor cleanup commit...
commit 8ba0ca32a63c532f128bdca7f1bf982cab8e12be
Author: Paulo Cesar Pereira de Andrade <pcpa@mandriva.com.br>
Date: Wed Jan 28 20:31:42 2009 -0200
|
|
|
|
|
|
|
|
| |
Backported from X.org, patch found in janitor cleanup commit...
commit 8ba0ca32a63c532f128bdca7f1bf982cab8e12be
Author: Paulo Cesar Pereira de Andrade <pcpa@mandriva.com.br>
Date: Wed Jan 28 20:31:42 2009 -0200
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Backported from X.org (libX11). Host.c has mainly been copied over from
libX11, contaning 7db7451 as the top commit (which also contains the
greatest change and silences the resp. compiler warning.
commit 7db74514e454d3fc4ff70aa08ddac66bfffda4dd
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Tue Jul 23 22:18:46 2013 -0700
Refactor common code from XAddHost & XRemoveHost into single function
On the Xlib side, the only real difference is the mode flag we send
to the server with the address, so just make that an argument to the
function with the common code for packing the address into the request.
(Aside from labels, gcc 4.7.2 generates identical code before & after
this change due to inlining, verified via diff of gcc -S output.)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
|
|
|
|
|
|
|
|
| |
- Update XErrorDB to latest X.org version.
- Install XErrorDB, XKeysymDB and Xcms.txt to /usr/{local/}share/nx/.
- Assure that libNX_X11 finds those files at the
named location.
- Update debian/ packaging files.
- Update nx-libs.spec packaging file.
Fixes ArcticaProject/nx-libs#153
|
|
|
|
|
| |
We might better change all guard defines with the ones upstream is
using but for now this should also work.
|