From 3d1c57d5ef429e51ab7a626540c30b81e74a8f17 Mon Sep 17 00:00:00 2001 From: Reinhard Tartler Date: Mon, 10 Oct 2011 17:46:43 +0200 Subject: Imported nx-X11-3.1.0-4.tar.gz Summary: Imported nx-X11-3.1.0-4.tar.gz Keywords: Imported nx-X11-3.1.0-4.tar.gz into Git repository --- nx-X11/programs/Xserver/Xext/EVI.c | 15 ++++++- nx-X11/programs/Xserver/Xext/cup.c | 3 ++ nx-X11/programs/Xserver/Xext/sampleEVI.c | 29 ++++++++++--- nx-X11/programs/Xserver/Xext/security.c | 10 ++--- .../programs/Xserver/Xext/security.c.NX.original | 10 ++--- nx-X11/programs/Xserver/Xext/security.c.X.original | 6 +-- nx-X11/programs/Xserver/Xext/shm.c | 50 ++++++++++++++++++---- 7 files changed, 96 insertions(+), 27 deletions(-) (limited to 'nx-X11/programs/Xserver/Xext') diff --git a/nx-X11/programs/Xserver/Xext/EVI.c b/nx-X11/programs/Xserver/Xext/EVI.c index b59180685..93ed19fa6 100644 --- a/nx-X11/programs/Xserver/Xext/EVI.c +++ b/nx-X11/programs/Xserver/Xext/EVI.c @@ -36,6 +36,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. #include #include "EVIstruct.h" #include "modinit.h" +#include "scrnintstr.h" #if 0 static unsigned char XEVIReqCode = 0; @@ -89,10 +90,22 @@ ProcEVIGetVisualInfo(ClientPtr client) { REQUEST(xEVIGetVisualInfoReq); xEVIGetVisualInfoReply rep; - int n, n_conflict, n_info, sz_info, sz_conflict; + int i, n, n_conflict, n_info, sz_info, sz_conflict; VisualID32 *conflict; + unsigned int total_visuals = 0; xExtendedVisualInfo *eviInfo; int status; + + /* + * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume + * here that you don't have more than 2^32 visuals over all your screens; + * this seems like a safe assumption. + */ + for (i = 0; i < screenInfo.numScreens; i++) + total_visuals += screenInfo.screens[i]->numVisuals; + if (stuff->n_visual > total_visuals) + return BadValue; + REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32); status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual, &eviInfo, &n_info, &conflict, &n_conflict); diff --git a/nx-X11/programs/Xserver/Xext/cup.c b/nx-X11/programs/Xserver/Xext/cup.c index 4db62cf15..198aa801f 100644 --- a/nx-X11/programs/Xserver/Xext/cup.c +++ b/nx-X11/programs/Xserver/Xext/cup.c @@ -202,6 +202,9 @@ int ProcGetReservedColormapEntries( REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq); + if (stuff->screen >= screenInfo.numScreens) + return BadValue; + #ifndef HAVE_SPECIAL_DESKTOP_COLORS citems[CUP_BLACK_PIXEL].pixel = screenInfo.screens[stuff->screen]->blackPixel; diff --git a/nx-X11/programs/Xserver/Xext/sampleEVI.c b/nx-X11/programs/Xserver/Xext/sampleEVI.c index 67caa5613..500a585c9 100644 --- a/nx-X11/programs/Xserver/Xext/sampleEVI.c +++ b/nx-X11/programs/Xserver/Xext/sampleEVI.c @@ -36,6 +36,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. #include #include "EVIstruct.h" #include "scrnintstr.h" + +#if HAVE_STDINT_H +#include +#elif !defined(UINT32_MAX) +#define UINT32_MAX 0xffffffffU +#endif + static int sampleGetVisualInfo( VisualID32 *visual, int n_visual, @@ -44,24 +51,36 @@ static int sampleGetVisualInfo( VisualID32 **conflict_rn, int *n_conflict_rn) { - int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; + unsigned int max_sz_evi; VisualID32 *temp_conflict; xExtendedVisualInfo *evi; - int max_visuals = 0, max_sz_conflict, sz_conflict = 0; + unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0; register int visualI, scrI, sz_evi = 0, conflictI, n_conflict; - *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); - if (!*evi_rn) - return BadAlloc; + + if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens)) + return BadAlloc; + max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; + for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { if (screenInfo.screens[scrI]->numVisuals > max_visuals) max_visuals = screenInfo.screens[scrI]->numVisuals; } + + if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens + * max_visuals)) + return BadAlloc; max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals; + + *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); + if (!*evi_rn) + return BadAlloc; + temp_conflict = (VisualID32 *)xalloc(max_sz_conflict); if (!temp_conflict) { xfree(*evi_rn); return BadAlloc; } + for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { for (visualI = 0; visualI < n_visual; visualI++) { evi[sz_evi].core_visual_id = visual[visualI]; diff --git a/nx-X11/programs/Xserver/Xext/security.c b/nx-X11/programs/Xserver/Xext/security.c index f37be696b..cee89354a 100644 --- a/nx-X11/programs/Xserver/Xext/security.c +++ b/nx-X11/programs/Xserver/Xext/security.c @@ -1822,11 +1822,11 @@ SecurityLoadPropertyAccessList(void) #ifdef NXAGENT_SERVER - f = fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r"); + f = Fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r"); #else - f = fopen(SecurityPolicyFile, "r"); + f = Fopen(SecurityPolicyFile, "r"); #endif @@ -1834,11 +1834,11 @@ SecurityLoadPropertyAccessList(void) #ifdef NXAGENT_SERVER - f = fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r"); + f = Fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r"); #else - f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); + f = Fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); #endif @@ -1960,7 +1960,7 @@ SecurityLoadPropertyAccessList(void) } #endif /* PROPDEBUG */ - fclose(f); + Fclose(f); } /* SecurityLoadPropertyAccessList */ diff --git a/nx-X11/programs/Xserver/Xext/security.c.NX.original b/nx-X11/programs/Xserver/Xext/security.c.NX.original index f37be696b..cee89354a 100644 --- a/nx-X11/programs/Xserver/Xext/security.c.NX.original +++ b/nx-X11/programs/Xserver/Xext/security.c.NX.original @@ -1822,11 +1822,11 @@ SecurityLoadPropertyAccessList(void) #ifdef NXAGENT_SERVER - f = fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r"); + f = Fopen(_NXGetPolicyFilePath(SecurityPolicyFile), "r"); #else - f = fopen(SecurityPolicyFile, "r"); + f = Fopen(SecurityPolicyFile, "r"); #endif @@ -1834,11 +1834,11 @@ SecurityLoadPropertyAccessList(void) #ifdef NXAGENT_SERVER - f = fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r"); + f = Fopen((char*)__XOS2RedirRoot( _NXGetPolicyFilePath(SecurityPolicyFile)), "r"); #else - f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); + f = Fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); #endif @@ -1960,7 +1960,7 @@ SecurityLoadPropertyAccessList(void) } #endif /* PROPDEBUG */ - fclose(f); + Fclose(f); } /* SecurityLoadPropertyAccessList */ diff --git a/nx-X11/programs/Xserver/Xext/security.c.X.original b/nx-X11/programs/Xserver/Xext/security.c.X.original index 26c842855..765769a7c 100644 --- a/nx-X11/programs/Xserver/Xext/security.c.X.original +++ b/nx-X11/programs/Xserver/Xext/security.c.X.original @@ -1647,9 +1647,9 @@ SecurityLoadPropertyAccessList(void) return; #ifndef __UNIXOS2__ - f = fopen(SecurityPolicyFile, "r"); + f = Fopen(SecurityPolicyFile, "r"); #else - f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); + f = Fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); #endif if (!f) { @@ -1733,7 +1733,7 @@ SecurityLoadPropertyAccessList(void) } #endif /* PROPDEBUG */ - fclose(f); + Fclose(f); } /* SecurityLoadPropertyAccessList */ diff --git a/nx-X11/programs/Xserver/Xext/shm.c b/nx-X11/programs/Xserver/Xext/shm.c index 806008c60..e2cf8cd24 100644 --- a/nx-X11/programs/Xserver/Xext/shm.c +++ b/nx-X11/programs/Xserver/Xext/shm.c @@ -728,6 +728,8 @@ ProcPanoramiXShmCreatePixmap( int i, j, result; ShmDescPtr shmdesc; REQUEST(xShmCreatePixmapReq); + unsigned int width, height, depth; + unsigned long size; PanoramiXRes *newPix; REQUEST_SIZE_MATCH(xShmCreatePixmapReq); @@ -737,11 +739,18 @@ ProcPanoramiXShmCreatePixmap( LEGAL_NEW_RESOURCE(stuff->pid, client); VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client); VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); - if (!stuff->width || !stuff->height) + + width = stuff->width; + height = stuff->height; + depth = stuff->depth; + if (!width || !height || !depth) { client->errorValue = 0; return BadValue; } + if (width > 32767 || height > 32767) + return BadAlloc; + if (stuff->depth != 1) { pDepth = pDraw->pScreen->allowedDepths; @@ -751,10 +760,18 @@ ProcPanoramiXShmCreatePixmap( client->errorValue = stuff->depth; return BadValue; } + CreatePmap: - VERIFY_SHMSIZE(shmdesc, stuff->offset, - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, - client); + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + } + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) return BadAlloc; @@ -1052,6 +1069,8 @@ ProcShmCreatePixmap(client) register int i; ShmDescPtr shmdesc; REQUEST(xShmCreatePixmapReq); + unsigned int width, height, depth; + unsigned long size; REQUEST_SIZE_MATCH(xShmCreatePixmapReq); client->errorValue = stuff->pid; @@ -1060,11 +1079,18 @@ ProcShmCreatePixmap(client) LEGAL_NEW_RESOURCE(stuff->pid, client); VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client); VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); - if (!stuff->width || !stuff->height) + + width = stuff->width; + height = stuff->height; + depth = stuff->depth; + if (!width || !height || !depth) { client->errorValue = 0; return BadValue; } + if (width > 32767 || height > 32767) + return BadAlloc; + if (stuff->depth != 1) { pDepth = pDraw->pScreen->allowedDepths; @@ -1074,10 +1100,18 @@ ProcShmCreatePixmap(client) client->errorValue = stuff->depth; return BadValue; } + CreatePmap: - VERIFY_SHMSIZE(shmdesc, stuff->offset, - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, - client); + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + } + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( pDraw->pScreen, stuff->width, stuff->height, stuff->depth, -- cgit v1.2.3