aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c
Commit message (Collapse)AuthorAgeFilesLines
* dix: Allow zero-height PutImage requests (fix for X.Org's CVE-2015-3418).pr/dix-cve-fixesKeith Packard2015-05-301-1/+1
| | | | | | | | | | | | | | The length checking code validates PutImage height and byte width by making sure that byte-width >= INT32_MAX / height. If height is zero, this generates a divide by zero exception. Allow zero height requests explicitly, bypassing the INT32_MAX check. Fix for regression introduced by fix for CVE-2014-8092. v2: backports to nx-libs 3.6.x (Mike Gabriel) v3: port to NXdispatch.c rather than dispatch.c (Mike DePaulo) Signed-off-by: Keith Packard <keithp@keithp.com>
* dix: integer overflow in ProcPutImage() [CVE-2014-8092 1/4]Alan Coopersmith2015-05-301-1/+3
| | | | | | | | | | | | | | | | | | | ProcPutImage() calculates a length field from a width, left pad and depth specified by the client (if the specified format is XYPixmap). The calculations for the total amount of memory the server needs for the pixmap can overflow a 32-bit number, causing out-of-bounds memory writes on 32-bit systems (since the length is stored in a long int variable). v2: backport to nx-libs 3.6.x (Mike DePaulo) v3: port to NXdispatch.c rather than dispatch.c (Mike DePaulo) Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Conflicts: dix/dispatch.c
* NXAGENT_UPGRADE code cleanup:Mike Gabriel2015-04-161-296/+245
| | | | | | | | | | | NX agent contains/ed two build trees. An old one (probably pre-3.x.y) and a "newer" one. The "newer" code tree used to become enabled by setting NXUpgradeAgentServer in nx-X11/config/cf/host.def to YES. As building the NXUpgradeAgentServer has been the default for years now, we drop all code that does not get used at build time for NXUpgradeAgentServer == YES (i.e., the code that belongs to the pre-3.x.y phase of NX agent).
* Avoid large pixmaps (110_nxagent_createpixmap-bounds-check.full.patch).Mike Gabriel2015-02-101-0/+17
| | | | | | | | | | | | | | | | | It is allowed to try and allocate a pixmap which is larger than 32767 in either dimension. However, all of the framebuffer code is buggy and does not reliably draw to such big pixmaps, basically because the Region data structure operates with signed shorts for the rectangles in it. Furthermore, several places in the X server computes the size in bytes of the pixmap and tries to store it in an integer. This integer can overflow and cause the allocated size to be much smaller. So, such big pixmaps are rejected here with a BadAlloc Originally contributed by FreeNX Team
* Revert "release 3.5.0.19"Mike Gabriel2013-03-281-17/+0
| | | | This reverts commit e77bf36d9afbc7e56522574b06217d57c11dd095.
* release 3.5.0.19Mike Gabriel2013-03-281-0/+17
|
* Imported nxagent-3.5.0-2.tar.gznxagent/3.5.0-2Reinhard Tartler2011-10-101-1/+1
| | | | | | | | Summary: Imported nxagent-3.5.0-2.tar.gz Keywords: Imported nxagent-3.5.0-2.tar.gz into Git repository
* Imported nxagent-3.4.0-5.tar.gznxagent/3.4.0-5Reinhard Tartler2011-10-101-1/+1
| | | | | | | | Summary: Imported nxagent-3.4.0-5.tar.gz Keywords: Imported nxagent-3.4.0-5.tar.gz into Git repository
* Imported nxagent-3.4.0-3.tar.gznxagent/3.4.0-3Reinhard Tartler2011-10-101-1/+1
| | | | | | | | Summary: Imported nxagent-3.4.0-3.tar.gz Keywords: Imported nxagent-3.4.0-3.tar.gz into Git repository
* Imported nxagent-3.4.0-16.tar.gznxagent/3.4.0-16Reinhard Tartler2011-10-101-1/+1
| | | | | | | | Summary: Imported nxagent-3.4.0-16.tar.gz Keywords: Imported nxagent-3.4.0-16.tar.gz into Git repository
* Imported nxagent-3.4.0-11.tar.gznxagent/3.4.0-11Reinhard Tartler2011-10-101-2/+2
| | | | | | | | Summary: Imported nxagent-3.4.0-11.tar.gz Keywords: Imported nxagent-3.4.0-11.tar.gz into Git repository
* Imported nxagent-3.1.0-2.tar.gznxagent/3.1.0-2Reinhard Tartler2011-10-101-0/+4716
Summary: Imported nxagent-3.1.0-2.tar.gz Keywords: Imported nxagent-3.1.0-2.tar.gz into Git repository