aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver/dbe/dbe.c
Commit message (Collapse)AuthorAgeFilesLines
* dbe: Call to DDX SwapBuffers requires address of int, not unsigned int ↵Keith Packard2016-10-201-3/+4
| | | | | | | | | | | | | | | | | | [CVE-2014-8097 pt. 2] When the local types used to walk the DBE request were changed, this changed the type of the parameter passed to the DDX SwapBuffers API, but there wasn't a matching change in the API definition. At this point, with the API frozen, I just stuck a new variable in with the correct type. Because we've already bounds-checked nStuff to be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will fit in a signed int without overflow. Signed-off-by: Keith Packard <keithp@keithp.com Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Backported-to-NX-by: Ulrich Sibiller <uli42@gmx.de>
* VCS info lines: Remove ancient X.org / XFree86 VCS info line from code files.Mike Gabriel2016-07-061-3/+0
| | | | | This has already been started while replacing copyright info in file headers and has now been completed with this commit.
* remove unreferenced NEED_EVENTS/NEED_REPLIESUlrich Sibiller2016-07-051-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove defines of NEED_EVENTS and NEED_REPLIES because they are never used anywhere. Basically these three commits, but as they are newer and to not match the code structure the patches have not been applied but replaced by sed + manual intervention: From cb95642dc8edebb2935dd471f8b339cb98aa8481 Mon Sep 17 00:00:00 2001 From: Peter Hutterer <peter.hutterer@redhat.com> Date: Fri, 28 Nov 2008 22:28:32 +1000 Subject: Remove #define NEED_EVENTS and NEED_REPLIES A grep on xorg/* revealed there's no consumer of this define. Quote Alan Coopersmith: "The consumer was in past versions of the headers now located in proto/x11proto - for instance, in X11R6.0's xc/include/Xproto.h, all the event definitions were only available if NEED_EVENTS were defined, and all the reply definitions required NEED_REPLIES. Looks like Xproto.h dropped them by X11R6.3, which didn't have the #ifdef's anymore, so these are truly ancient now." Signed-off-by: Peter Hutterer <peter.hutterer@redhat.com> Signed-off-by: Adam Jackson <ajax@redhat.com> -- From 6de368c9aa7ccd2fcd62fca5a2b278913db4d03d Mon Sep 17 00:00:00 2001 From: Fernando Carrijo <fcarrijo@yahoo.com.br> Date: Thu, 1 Jul 2010 06:50:47 -0300 Subject: Purge macros NEED_EVENTS and NEED_REPLIES Signed-off-by: Fernando Carrijo <fcarrijo@yahoo.com.br> Acked-by: Tiago Vignatti <tiago.vignatti@nokia.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> -- From 57c03e52e6b4e3ed54df5fdd778865467d08e119 Mon Sep 17 00:00:00 2001 From: Fernando Carrijo <fcarrijo@yahoo.com.br> Date: Thu, 1 Jul 2010 06:59:48 -0300 Subject: Purge macro NEED_EVENTS Signed-off-by: Fernando Carrijo <fcarrijo@yahoo.com.br> Acked-by: Tiago Vignatti <tiago.vignatti@nokia.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Remove unneccesary casts from WriteToClient callsAlan Coopersmith2016-07-051-5/+5
| | | | | | | | | | | | | | Casting return to (void) was used to tell lint that you intended to ignore the return value, so it didn't warn you about it. Casting the third argument to (char *) was used as the most generic pointer type in the days before compilers supported C89 (void *) (except for a couple places it's used for byte-sized pointer math). Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Keith Packard <keithp@keithp.com> Tested-by: Daniel Stone <daniel@fooishbar.org> Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Use internal temp variable for swap macros. Make swaps/swapl type safe ↵Mike Gabriel2016-07-041-38/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (introducing wrong_size check at build time). While working on this changeset, various spots got discovered where swapl or swaps was used on a wrong type, where byte swapping calls had been forgotten or done on the wrong variable. This backport at least includes changes from the following X.org commits, listed in non-chronological order: commit 2c7c520cfe0df30f4bc3adba59d9c62582823bf8 Author: Matt Turner <mattst88@gmail.com> Date: Thu Aug 4 15:35:41 2011 -0400 Use internal temp variable for swap macros Also, fix whitespace, mainly around swaps(&rep.sequenceNumber) Reviewed-by: Peter Harris <pharris@opentext.com> Signed-off-by: Matt Turner <mattst88@gmail.com> commit 9edcae78c46286baff42e74bfe26f6ae4d00fe01 Author: Matt Turner <mattst88@gmail.com> Date: Wed Sep 21 17:14:16 2011 -0400 Use correct swap{l,s} (or none at all for CARD8) Swapping the wrong size was never caught because swap{l,s} are macros. It's clear in the case of Xext/xres.c, that the author believed client_major/minor to be CARD16 from looking at the code in the first hunk. v2: dmx.c fixes from Keith. Reviewed-by: Peter Harris <pharris@opentext.com> Signed-off-by: Matt Turner <mattst88@gmail.com> commit dab064fa5e0b1f5c67222562ad5367005832cba1 Author: Andrea Canciani <ranma42@gmail.com> Date: Tue Nov 2 20:10:32 2010 +0100 render: Fix byteswapping of gradient stops The function swapStops repeatedly swaps the color components as CARD16, but incorrectly steps over them as if they were CARD32. This causes half of the stops not to be swapped at all and some unrelated data be swapped instead. Signed-off-by: Andrea Canciani <ranma42@gmail.com> Reviewed-by: Soren Sandmann <sandmann@daimi.au.dk> Reviewed-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Keith Packard <keithp@keithp.com> commit 54770c980cd2b91a8377f975a58ed69def5cfa42 Author: Matt Turner <mattst88@gmail.com> Date: Tue Aug 16 16:59:07 2011 -0400 Cast char* buffers to swap functions Reviewed-by: Peter Harris <pharris@opentext.com> Signed-off-by: Matt Turner <mattst88@gmail.com> commit 6844bd2e63490870bab3c469eec6030354ef2865 Author: Alan Coopersmith <alan.coopersmith@sun.com> Date: Wed Jan 9 19:52:00 2008 -0800 More Xv extension byte swapping fixes commit e46f6ddeccd082b2d507a1e8b57ea30e6b0a2c83 Author: Michel Dänzer <michel@tungstengraphics.com> Date: Wed Jan 16 14:24:22 2008 +0100 Yet another Xv extension byte swapping fix.
* nx-X11/programs/Xserver: Drop {X,x}calloc() macros, use calloc() instead.Mike Gabriel2016-07-021-1/+1
|
* nx-X11/programs/Xserver: Drop {X,x}realloc() macros, use realloc() instead.Mike Gabriel2016-07-021-2/+2
|
* nx-X11/programs/Xserver: Drop {X,x}alloc() macros, use malloc() instead.Mike Gabriel2016-07-021-4/+4
|
* nx-X11/programs/Xserver: Drop {X,x}free() macros, use free() instead.Mike Gabriel2016-07-021-22/+22
| | | | Fixes ArcticaProject/nx-libs#105
* Clear header file namespace separation (<X11/...> vs. <nx-X11/...>).Mike Gabriel2015-12-281-2/+2
| | | | | | | | | | | | | | | | | | | | In the process of building nxagent against more and more system-wide installed X.org libraries, we come to the limit of including structs from this (bundled nx-X11) and that (system-wide X.Org) library. This commit introduces a clear namespace separation of headers provided by nx-X11 and headers provided by X.Org. This approach is only temporary as we want to drop all nx-X11 bundled libraries from nx-libs. However, for a while we need to make this separation clear and also ship some reduced fake X.Org headers that avoid pulling in libX* and libNX_X* symbols at the same time. This patch has been tested on Debian jessie and unstable and requires no overall testing on various distros and distro versions, as we finally will drop all libNX_X* libraries and build against X.org's client libs. For now, this hack eases our development / cleanup process.
* Replace 'pointer' type with 'void *'Keith Packard2015-12-281-16/+16
| | | | | | | | | | This lets us stop using the 'pointer' typedef in Xdefs.h as 'pointer' is used throughout the X server for other things, and having duplicate names generates compiler warnings. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net> Rebased against NX: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* dbe: unvalidated lengths in DbeSwapBuffers calls [CVE-2014-8097]Alan Coopersmith2015-02-141-3/+8
| | | | | | | | | | | | | | | | | | | | | | ProcDbeSwapBuffers() has a 32bit (n) length value that it uses to read from a buffer. The length is never validated, which can lead to out of bound reads, and possibly returning the data read from out of bounds to the misbehaving client via an X Error packet. SProcDbeSwapBuffers() swaps data (for correct endianness) before handing it off to the real proc. While doing the swapping, the length field is not validated, which can cause memory corruption. v2: reorder checks to avoid compilers optimizing out checks for overflow that happen after we'd already have done the overflowing multiplications. v3: backport to nx-libs 3.6.x (Mike DePaulo) Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Conflicts: dbe/dbe.c
* Imported nx-X11-3.1.0-1.tar.gznx-X11/3.1.0-1Reinhard Tartler2011-10-101-0/+1999
Summary: Imported nx-X11-3.1.0-1.tar.gz Keywords: Imported nx-X11-3.1.0-1.tar.gz into Git repository
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-30 17:34:43 +0000