From 1ea1cd8c4f93b0c03e5b34fe174b3fc9f27c7dfa Mon Sep 17 00:00:00 2001 From: Adam Jackson Date: Mon, 10 Nov 2014 12:13:48 -0500 Subject: glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098 8/8] (V3) v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) v3: RHEL5 backport v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Julien Cristau Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie --- nx-X11/programs/Xserver/GL/glx/glxserver.h | 90 +++++++++++++++--------------- 1 file changed, 45 insertions(+), 45 deletions(-) (limited to 'nx-X11/programs/Xserver/GL/glx/glxserver.h') diff --git a/nx-X11/programs/Xserver/GL/glx/glxserver.h b/nx-X11/programs/Xserver/GL/glx/glxserver.h index 404757405..193ebcb6f 100644 --- a/nx-X11/programs/Xserver/GL/glx/glxserver.h +++ b/nx-X11/programs/Xserver/GL/glx/glxserver.h @@ -179,7 +179,7 @@ extern __GLXprocPtr __glXProcTable[]; */ typedef struct { int bytes; - int (*varsize)(GLbyte *pc, Bool swap); + int (*varsize)(GLbyte *pc, Bool swap, int left); } __GLXrenderSizeData; extern __GLXrenderSizeData __glXRenderSizeTable[]; extern __GLXrenderSizeData __glXRenderSizeTable_EXT[]; @@ -271,48 +271,48 @@ extern int __glXImageSize(GLenum format, GLenum type, GLint imageHeight, GLint rowLength, GLint skipImages, GLint skipRows, GLint alignment); -extern int __glXCallListsReqSize(GLbyte *pc, Bool swap); -extern int __glXBitmapReqSize(GLbyte *pc, Bool swap); -extern int __glXFogfvReqSize(GLbyte *pc, Bool swap); -extern int __glXFogivReqSize(GLbyte *pc, Bool swap); -extern int __glXLightfvReqSize(GLbyte *pc, Bool swap); -extern int __glXLightivReqSize(GLbyte *pc, Bool swap); -extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap); -extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap); -extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap); -extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap); -extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap); -extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap); -extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap); -extern int __glXMap1dReqSize(GLbyte *pc, Bool swap); -extern int __glXMap1fReqSize(GLbyte *pc, Bool swap); -extern int __glXMap2dReqSize(GLbyte *pc, Bool swap); -extern int __glXMap2fReqSize(GLbyte *pc, Bool swap); -extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap); -extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap); -extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap); -extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap); -extern int __glXDrawArraysSize(GLbyte *pc, Bool swap); -extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap); -extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ); -extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap); -extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap); -extern int __glXColorTableReqSize(GLbyte *pc, Bool swap); -extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap); -extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap); -extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap); +extern int __glXCallListsReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXBitmapReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXFogfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXFogivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap1dReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap1fReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap2dReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap2fReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXDrawArraysSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap, int reqlen ); +extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorTableReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); /* * Routines for computing the size of returned data. @@ -322,7 +322,7 @@ extern int __glXConvolutionParameterfvSize(GLenum pname); extern int __glXColorTableParameterfvSize(GLenum pname); extern int __glXColorTableParameterivSize(GLenum pname); -extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap); -extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap); +extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); #endif /* !__GLX_server_h__ */ -- cgit v1.2.3