aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver/dix
Commit message (Collapse)AuthorAgeFilesLines
* VCS info lines: Remove ancient X.org / XFree86 VCS info line from code files.Mike Gabriel2016-07-0626-58/+0
| | | | | This has already been started while replacing copyright info in file headers and has now been completed with this commit.
* Xserver/dix/events.c: Drop unused i variable from TryClientEvents.Ulrich Sibiller2016-07-061-1/+0
|
* remove unreferenced NEED_EVENTS/NEED_REPLIESUlrich Sibiller2016-07-0512-18/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove defines of NEED_EVENTS and NEED_REPLIES because they are never used anywhere. Basically these three commits, but as they are newer and to not match the code structure the patches have not been applied but replaced by sed + manual intervention: From cb95642dc8edebb2935dd471f8b339cb98aa8481 Mon Sep 17 00:00:00 2001 From: Peter Hutterer <peter.hutterer@redhat.com> Date: Fri, 28 Nov 2008 22:28:32 +1000 Subject: Remove #define NEED_EVENTS and NEED_REPLIES A grep on xorg/* revealed there's no consumer of this define. Quote Alan Coopersmith: "The consumer was in past versions of the headers now located in proto/x11proto - for instance, in X11R6.0's xc/include/Xproto.h, all the event definitions were only available if NEED_EVENTS were defined, and all the reply definitions required NEED_REPLIES. Looks like Xproto.h dropped them by X11R6.3, which didn't have the #ifdef's anymore, so these are truly ancient now." Signed-off-by: Peter Hutterer <peter.hutterer@redhat.com> Signed-off-by: Adam Jackson <ajax@redhat.com> -- From 6de368c9aa7ccd2fcd62fca5a2b278913db4d03d Mon Sep 17 00:00:00 2001 From: Fernando Carrijo <fcarrijo@yahoo.com.br> Date: Thu, 1 Jul 2010 06:50:47 -0300 Subject: Purge macros NEED_EVENTS and NEED_REPLIES Signed-off-by: Fernando Carrijo <fcarrijo@yahoo.com.br> Acked-by: Tiago Vignatti <tiago.vignatti@nokia.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> -- From 57c03e52e6b4e3ed54df5fdd778865467d08e119 Mon Sep 17 00:00:00 2001 From: Fernando Carrijo <fcarrijo@yahoo.com.br> Date: Thu, 1 Jul 2010 06:59:48 -0300 Subject: Purge macro NEED_EVENTS Signed-off-by: Fernando Carrijo <fcarrijo@yahoo.com.br> Acked-by: Tiago Vignatti <tiago.vignatti@nokia.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
* Remove unneccesary casts from WriteToClient callsAlan Coopersmith2016-07-055-58/+58
| | | | | | | | | | | | | | Casting return to (void) was used to tell lint that you intended to ignore the return value, so it didn't warn you about it. Casting the third argument to (char *) was used as the most generic pointer type in the days before compilers supported C89 (void *) (except for a couple places it's used for byte-sized pointer math). Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Keith Packard <keithp@keithp.com> Tested-by: Daniel Stone <daniel@fooishbar.org> Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* X.org 6.9 documentation files: Move into doc/_attic_/.Mike Gabriel2016-07-052-346/+0
|
* Set event sequence number in WriteEventsToClient instead of at callers.Jamey Sharp2016-07-052-9/+4
| | | | | | | | | | | | | | TryClientEvents already did this; this commit just moves the assignment one level down so that no event source has to worry about sequence numbers. ...No event source, that is, except XKB, which inexplicably calls WriteToClient directly for several events. Signed-off-by: Jamey Sharp <jamey@minilop.net> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Adam Jackson <ajax@redhat.com> Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Make WriteEventsToClient/WriteToClient no-op on fake or dead clients.Jamey Sharp2016-07-051-0/+3
| | | | | | | | | | | | | | | | | | This matches the test in TryClientEvents, and is a superset of tests done by the callers of these functions. The consequence of forgetting these tests is a server crash, so they're always desirable. In my opinion, it's better to not require the callers to remember to do these checks. For callers that don't do very much work before calling WriteToClient or WriteEventsToClient, I've removed the redundant checks. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=27497 Signed-off-by: Jamey Sharp <jamey@minilop.net> Cc: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Adam Jackson <ajax@redhat.com> Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Use internal temp variable for swap macros. Make swaps/swapl type safe ↵Mike Gabriel2016-07-043-646/+485
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (introducing wrong_size check at build time). While working on this changeset, various spots got discovered where swapl or swaps was used on a wrong type, where byte swapping calls had been forgotten or done on the wrong variable. This backport at least includes changes from the following X.org commits, listed in non-chronological order: commit 2c7c520cfe0df30f4bc3adba59d9c62582823bf8 Author: Matt Turner <mattst88@gmail.com> Date: Thu Aug 4 15:35:41 2011 -0400 Use internal temp variable for swap macros Also, fix whitespace, mainly around swaps(&rep.sequenceNumber) Reviewed-by: Peter Harris <pharris@opentext.com> Signed-off-by: Matt Turner <mattst88@gmail.com> commit 9edcae78c46286baff42e74bfe26f6ae4d00fe01 Author: Matt Turner <mattst88@gmail.com> Date: Wed Sep 21 17:14:16 2011 -0400 Use correct swap{l,s} (or none at all for CARD8) Swapping the wrong size was never caught because swap{l,s} are macros. It's clear in the case of Xext/xres.c, that the author believed client_major/minor to be CARD16 from looking at the code in the first hunk. v2: dmx.c fixes from Keith. Reviewed-by: Peter Harris <pharris@opentext.com> Signed-off-by: Matt Turner <mattst88@gmail.com> commit dab064fa5e0b1f5c67222562ad5367005832cba1 Author: Andrea Canciani <ranma42@gmail.com> Date: Tue Nov 2 20:10:32 2010 +0100 render: Fix byteswapping of gradient stops The function swapStops repeatedly swaps the color components as CARD16, but incorrectly steps over them as if they were CARD32. This causes half of the stops not to be swapped at all and some unrelated data be swapped instead. Signed-off-by: Andrea Canciani <ranma42@gmail.com> Reviewed-by: Soren Sandmann <sandmann@daimi.au.dk> Reviewed-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Keith Packard <keithp@keithp.com> commit 54770c980cd2b91a8377f975a58ed69def5cfa42 Author: Matt Turner <mattst88@gmail.com> Date: Tue Aug 16 16:59:07 2011 -0400 Cast char* buffers to swap functions Reviewed-by: Peter Harris <pharris@opentext.com> Signed-off-by: Matt Turner <mattst88@gmail.com> commit 6844bd2e63490870bab3c469eec6030354ef2865 Author: Alan Coopersmith <alan.coopersmith@sun.com> Date: Wed Jan 9 19:52:00 2008 -0800 More Xv extension byte swapping fixes commit e46f6ddeccd082b2d507a1e8b57ea30e6b0a2c83 Author: Michel Dänzer <michel@tungstengraphics.com> Date: Wed Jan 16 14:24:22 2008 +0100 Yet another Xv extension byte swapping fix.
* nx-X11/programs/Xserver: Drop {X,x}calloc() macros, use calloc() instead.Mike Gabriel2016-07-023-4/+4
|
* nx-X11/programs/Xserver: Drop {X,x}realloc() macros, use realloc() instead.Mike Gabriel2016-07-0212-43/+43
|
* nx-X11/programs/Xserver: Drop {X,x}alloc() macros, use malloc() instead.Mike Gabriel2016-07-0218-104/+104
|
* nx-X11/programs/Xserver: Drop {X,x}free() macros, use free() instead.Mike Gabriel2016-07-0218-205/+205
| | | | Fixes ArcticaProject/nx-libs#105
* nxagent Xserver: Drop Kerberos code. Not used in nxagent.Mike Gabriel2016-07-013-31/+0
|
* hw/nxagent/NX*.c: Amend re-introduced nxagent warnings by fixing the ↵Mike Gabriel2016-06-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | corresponding code section in files included from "somewhere" in nx-X11/programs/Xserver/. (1) In file included from NXrender.c:44:0: ../../mi/../render/render.c: In function ‘swapStops’: ../../mi/../render/render.c:2541:13: warning: variable ‘colors’ set but not used [-Wunused-but-set-variable] CARD16 *colors; ^ (2) In file included from NXevents.c:133:0: ../../dix/events.c: In function ‘ReinitializeRootWindow’: ../../dix/events.c:2046:15: warning: unused variable ‘pScreen’ [-Wunused-variable] ScreenPtr pScreen = win->drawable.pScreen; ^ ../../dix/events.c: In function ‘XineramaPointInWindowIsVisible’: ../../dix/events.c:2177:15: warning: variable ‘pScreen’ set but not used [-Wunused-but-set-variable] ScreenPtr pScreen = pWin->drawable.pScreen; ^ In file included from NXevents.c:133:0: ../../dix/events.c: In function ‘XineramaPointInWindowIsVisible’: ../../dix/events.c:2191:2: error: ‘pScreen’ undeclared (first use in this function) pScreen = pWin->drawable.pScreen; ^ (3) In file included from NXdixfonts.c:77:0: ../../dix/dixfonts.c: In function ‘GetFontPath’: ../../dix/dixfonts.c:1890:2: warning: return makes pointer from integer without a cast return BadAlloc; ^
* hw/nxagent/NXdixfonts.c: Shrink file, drop duplicate code that can ↵Mike Gabriel2016-06-252-68/+24
| | | | identically be found in dix/dixfonts.c. Also remove NX'ish code from dix/dixfonts.c.
* hw/nxagent/NXdispatch.c: Shrink file, drop duplicate code that can ↵Mike Gabriel2016-06-252-3/+33
| | | | identically be found in dix/dispatch.c.
* hw/nxagent/NXproperty.c: Shrink file, drop duplicate code that can ↵Mike Gabriel2016-06-252-2/+7
| | | | identically be found in dix/property.c.
* hw/nxagent/NXevents.c: Shrink file, drop duplicate code that can identically ↵Mike Gabriel2016-06-252-2/+11
| | | | be found in dix/events.c.
* hw/nxagent/NXglyphcurs.c: Shrink file, drop duplicate code that can ↵Mike Gabriel2016-06-252-3/+4
| | | | identically be found in dix/glyphcurs.c.
* hw/nxagent/NXresource.c: Shrink file, drop duplicate code that can ↵Mike Gabriel2016-06-252-2/+8
| | | | identically be found in dix/resource.c.
* Xserver/dix/window.c: Don't reintroduce build warnings with previous commit ↵Mike Gabriel2016-06-251-14/+0
| | | | due to now-unnecessary assignements of pScreen pointers.
* hw/nxagent/NXwindow.c: Shrink file, drop duplicate code that can identically ↵Mike Gabriel2016-06-252-5/+53
| | | | be found in dix/window.c.
* hw/nxagent/NXextension.c: Shrink file, drop duplicate code that is ↵Mike Gabriel2016-06-252-4/+14
| | | | indentically found in dix/extension.c.
* Xserver/dix/Imakefile: Serialize parameters and make Imakefile changes more ↵Mike Gabriel2016-06-251-16/+66
| | | | trackable.
* dix: remove caching of drawables and graphics contexts. The security checks ↵Mike Gabriel2016-06-211-20/+0
| | | | | | | | | | | | | | | simply bypass the cached values so they are unused. Backported from X.org: commit 9a183d7ba50e31afa133cc03aee7991517a283ea Author: Eamon Walsh <ewalsh@tycho.nsa.gov> Date: Tue Aug 14 11:39:26 2007 -0400 dix: remove caching of drawables and graphics contexts. The security checks simply bypass the cached values so they are unused. Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Xserver/dix/events.c: Don't declare and assign unused pScreen.Mike Gabriel2016-06-211-3/+0
|
* Move each screen's root-window pointer into ScreenRec.Mike Gabriel2016-06-216-56/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | Backported from X.org: commit e7fae9ecc42ab5e73b89117722dbf4117d928f9a Author: Jamey Sharp <jamey@minilop.net> Date: Sat May 22 00:26:28 2010 -0700 Move each screen's root-window pointer into ScreenRec. Many references to the WindowTable array already had the corresponding screen pointer handy, which meant they usually looked like "WindowTable[pScreen->myNum]". Adding a field to ScreenRec instead of keeping this information in a parallel array simplifies those expressions, and eliminates a MAXSCREENS-sized array. Since dix uses this data, a screen private entry isn't appropriate. xf86-video-dummy currently uses WindowTable, so it needs to be updated to reflect this change. Signed-off-by: Jamey Sharp <jamey@minilop.net> Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com> Tested-by: Tiago Vignatti <tiago.vignatti@nokia.com> (i686 GNU/Linux) Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Centralize declaration of ConnectionInfo.Mike Gabriel2016-06-212-1/+2
| | | | | | | | | | | | | Backported from X.org: commit 64ef7ed072007b1d0b4de5ff1e5eababa418c794 Author: Adam Jackson <ajax@redhat.com> Date: Wed Aug 20 13:14:03 2008 -0400 Centralize declaration of ConnectionInfo. Author: Adam Jackson <ajax@redhat.com> Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Allow CloseDownProc to be NULL.Mike Gabriel2016-06-211-2/+3
| | | | | | | | | | | | | | | | | | | | Backported from X.org: commit ae67508392261ae47858692668a0c192ef4a9d7b Author: Mathieu Bérard <mathieu.berard@crans.org> Date: Fri Jul 25 10:05:30 2008 -0400 Fix AddExtension now that CloseDownProc can be NULL. commit 6bcde69585fcc8f8dbfe81c115649f19274922fa Author: Adam Jackson <ajax@redhat.com> Date: Thu Jul 24 09:13:26 2008 -0400 Allow extension closedown hook to be null. Authors: Adam Jackson <ajax@redhat.com> Mathieu Bérard <mathieu.berard@crans.org> Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* LBX: Drop all Xserver code blocks that relate to removed LBX extension.Mike Gabriel2016-06-017-234/+0
|
* XEVIE: Drop all Xserver code blocks that relate to removed XEVIE extension.Mike Gabriel2016-06-011-176/+0
|
* XAPPGROUP: Drop all Xserver code blocks that relate to removed XAPPGROUP ↵Mike Gabriel2016-06-012-74/+0
| | | | extension.
* Drop X11 extensions not shipped with recent X.Org server versions anymore:Mike Gabriel2016-06-011-8/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | include/extensions: Xag.h, Xagsrv.h, Xagstr.h Xserver/Xext: appgroup.c, appgroup.h lib/Xext: XAppgroup.c include/extensions: Xcup.h, Xcupstr.h, Xserver/Xext: cup.c lib/Xext: cup.c include/extensions: Xdbe.h Xserver/Xext: Xdbe.c Xserver/Xext: dgaproc.h, xf86dga.c, xf86dga2.c, xf86dgaext.h include/extensions: Xevie.h, Xeviestr.h include/extensions: XEVI.h, XEVIstr.h Xserver/Xext: EVI.c, EVIstruct.h, sampleEVI.c lib/Xext: XEVI.c include/extensions: fontcache.h, fontcacheP.h, fontcachstr.h Xserver/Xext: fontcache.c include/extensions: lbxbuf.h, lbxbufstr.h, lbxdeltastr.h, lbximage.h, lbxopts.h, lbxstr.h, lbxzlib.h lib/Xext: XLbx.c include/extensions: multibuf.h, multibufst.h lib/Xext: XMultibuf.c Xserver/Xext: mbuf.c, mbufbf.c, mbufpx.c include/extensions: xf86vmode.h, xf86vmstr.h Xserver/Xext: vidmodeproc.h, xf86vmode.c lib/Xext: MITMisc.c Xserver/Xext: mitmisc.c Xserver/Xext: xf86misc.c, xf86miscproc.h Xserver/XTrap: xf86XTrapModule.c, xtrapddmi.c, xtrapdi.c, xtrapdiswp.c, xtrapditbl.c include/extensions: xtrapbits.h xtrapddmi.h xtrapdi.h xtrapemacros.h xtraplib.h xtraplibp.h xtrapproto.h Fixes: ArcticaProject/nx-libs#116 X.org: https://cgit.freedesktop.org/xorg/xserver/commit/?id=cbc20d92de92aad5ca240310a9156ccf97c24a01 Plus: Drop various Imake'ish defines where not needed anymore.
* nx-X11/programs/Xserver/{dix/{colormap.c,window.c},hw/nxagent/NXwindow.c,inc ↵Mihai Moldovan2016-05-252-0/+89
| | | | lude/{colormap,window{,str}}.h}: backport features needed for Composite 0.4.
* hw/nxagent/NXdixfonts.c: Fix implicit declaration for register_fpe_functions().Mike Gabriel2016-05-021-0/+2
|
* Adapt API for MakeAtom() and CopyISOLatin1Lowered to latest changes in X.org.Mike Gabriel2016-05-022-2/+2
| | | | | | | | | This requires adaptations of arguments' types for the external references to MakeAtom() and CopyISOLatin1Lowered(). These adaptations have been required in Xserver/include/dix.h, Xserver/include/dixfonts.c Xserver/dix/atom.c, Xserver/dix/dixutils.c, Xserver/os/oscolor.c.
* Change region implementation names to eliminate the 'mi' prefixMike Gabriel2016-05-022-909/+73
| | | | | | | | | | This prepares the file to be moved from mi to dix. This patch was done mechanically with the included scripts 'fix-miregion' run over the entire X server and 'fix-miregion-private' run over include/regionstr.h and mi/miregion.c. v1: Keith Packard <keithp@keithp.com> v2: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> (backported to nx-libs)
* Move mi/miregion.c to dix/region.cKeith Packard2016-05-022-2/+2582
| | | | | v1: Keith Packard <keithp@keithp.com> v2: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> (backported to nx-libs)
* pixman-devel: Build against shared library pkg-config(pixman-1).Mike Gabriel2016-05-021-1/+2
|
* Rename region macros to eliminate screen argumentMike Gabriel2016-05-023-93/+93
| | | | | | | | | | | | | | | | | | | | | This is a huge mechanical patch and a few small fixups required to finish the job. They were reviewed separately, but because the server does not build without both pieces, I've merged them together at this time. The mechanical changes were performed by running the included 'fix-region' script over the whole nx-X11/programs/Xserver tree: $ cd nx-X11/programs/Xserver && ( git ls-files | grep -v '^fix-' | xargs ./fix-region; ) And then, the white space errors in the resulting patch were fixed using the provided fix-patch-whitespace script. $ sh ./fix-patch-whitespace Thanks to Jamey Sharp for the mighty fine sed-generating sed script. v1: Keith Packard <keithp@keithp.com> (X.Org xserver commit: 2dc138922b7588515d5f2447e4b9dcdc0bef15e0) v2: Mike Gabriel <mike.gabriel@das-netzwerkteam.de> (apply fix-region script to nx-libs)
* Clear header file namespace separation (<X11/...> vs. <nx-X11/...>).Mike Gabriel2015-12-2822-57/+57
| | | | | | | | | | | | | | | | | | | | In the process of building nxagent against more and more system-wide installed X.org libraries, we come to the limit of including structs from this (bundled nx-X11) and that (system-wide X.Org) library. This commit introduces a clear namespace separation of headers provided by nx-X11 and headers provided by X.Org. This approach is only temporary as we want to drop all nx-X11 bundled libraries from nx-libs. However, for a while we need to make this separation clear and also ship some reduced fake X.Org headers that avoid pulling in libX* and libNX_X* symbols at the same time. This patch has been tested on Debian jessie and unstable and requires no overall testing on various distros and distro versions, as we finally will drop all libNX_X* libraries and build against X.org's client libs. For now, this hack eases our development / cleanup process.
* On realloc failure, free font_path_string instead of leaking itMike Gabriel2015-12-281-4/+7
| | | | | | | | | | | Flagged by cppcheck 1.62: [dix/dixfonts.c:1792]: (error) Common realloc mistake: 'font_path_string' nulled but not freed upon failure Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Keith Packard <keithp@keithp.com> Rebased against NX: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Replace 'pointer' type with 'void *'Keith Packard2015-12-2815-149/+149
| | | | | | | | | | This lets us stop using the 'pointer' typedef in Xdefs.h as 'pointer' is used throughout the X server for other things, and having duplicate names generates compiler warnings. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net> Rebased against NX: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
* Backport: xserver: Avoid sending uninitialized padding data over the networkPeter Åstrand2015-07-028-1/+47
| | | | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
* dix: Allow zero-height PutImage requests (fix for X.Org's CVE-2015-3418).Keith Packard2015-05-011-1/+1
| | | | | | | | | | | | The length checking code validates PutImage height and byte width by making sure that byte-width >= INT32_MAX / height. If height is zero, this generates a divide by zero exception. Allow zero height requests explicitly, bypassing the INT32_MAX check. Fix for regression introduced by fix for CVE-2014-8092. v2: backports to nx-libs 3.6.x (Mike Gabriel) Signed-off-by: Keith Packard <keithp@keithp.com>
* library clean-up: Don't build and link libXfont.a anymore. Use system's ↵pr/libxfont-cleanupMike Gabriel2015-04-222-17/+2
| | | | libXfont shared library and link dynamically.
* imake cleanup: Drop all references to XprtServer and BuildXprint*.Mike Gabriel2015-04-043-41/+1
|
* dix: integer overflow in ProcPutImage() [CVE-2014-8092 1/4]Alan Coopersmith2015-02-141-1/+3
| | | | | | | | | | | | | | | | | ProcPutImage() calculates a length field from a width, left pad and depth specified by the client (if the specified format is XYPixmap). The calculations for the total amount of memory the server needs for the pixmap can overflow a 32-bit number, causing out-of-bounds memory writes on 32-bit systems (since the length is stored in a long int variable). v2: backport to nx-libs 3.6.x (Mike DePaulo) Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Conflicts: dix/dispatch.c
* Avoid use-after-free in dix/dixfonts.c: doImageText() [CVE-2013-4396] from ↵Mike DePaulo2015-02-141-0/+5
| | | | | | | | | | | | | | | | | | | | | xorg/Xserver http://lists.x.org/archives/xorg-announce/2013-October/002332.html Save a pointer to the passed in closure structure before copying it and overwriting the *c pointer to point to our copy instead of the original. If we hit an error, once we free(c), reset c to point to the original structure before jumping to the cleanup code that references *c. Since one of the errors being checked for is whether the server was able to malloc(c->nChars * itemSize), the client can potentially pass a number of characters chosen to cause the malloc to fail and the error path to be taken, resulting in the read from freed memory. Since the memory is accessed almost immediately afterwards, and the X server is mostly single threaded, the odds of the free memory having invalid contents are low with most malloc implementations when not using memory debugging features, but some allocators will definitely overwrite the memory there, leading to a likely crash.
* Several fixes for building debug versions of NX ↵Mihai Moldovan2015-02-131-1/+1
| | | | | | | | | | | | | | | | | | (990_fix-DEBUG-and-TEST-builds.full.patch). (1) In nx-X11/programs/Xserver/dix: Fix several compile errors when specifying -DDEBUG globally. Previous GCC versions were more liberal and the code thus compiled. Also initialize/reset a count variable correctly. (2) In nx-X11/programs/Xserver/hw/nxagent/Render.c: Check for pSrc->pDrawable to exist instead of having nxagent segfault when it does not. This enables the possibility of compiling all nxagent modules in TEST mode.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 02:07:16 +0000