From d088698324d5e71cb93ccd429f084729ba07872c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20=C3=85strand?= Date: Fri, 13 Feb 2009 10:23:28 +0100 Subject: Backport: xserver: Avoid sending uninitialized padding data over the network Signed-off-by: Peter Hutterer --- nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) (limited to 'nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c') diff --git a/nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c b/nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c index 0ed7277a1..ea4f59d19 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c +++ b/nx-X11/programs/Xserver/hw/nxagent/NXdispatch.c @@ -931,6 +931,7 @@ ProcGetWindowAttributes(register ClientPtr client) SecurityReadAccess); if (!pWin) return(BadWindow); + memset(&wa, 0, sizeof(xGetWindowAttributesReply)); GetWindowAttributes(pWin, client, &wa); WriteReplyToClient(client, sizeof(xGetWindowAttributesReply), &wa); return(client->noClientException); @@ -1155,6 +1156,7 @@ GetGeometry(register ClientPtr client, xGetGeometryReply *rep) REQUEST_SIZE_MATCH(xResourceReq); SECURITY_VERIFY_GEOMETRABLE (pDraw, stuff->id, client, SecurityReadAccess); + memset(rep, 0, sizeof(xGetGeometryReply)); rep->type = X_Reply; rep->length = 0; rep->sequenceNumber = client->sequence; @@ -1216,6 +1218,7 @@ ProcQueryTree(register ClientPtr client) SecurityReadAccess); if (!pWin) return(BadWindow); + memset(&reply, 0, sizeof(xQueryTreeReply)); reply.type = X_Reply; reply.root = WindowTable[pWin->drawable.pScreen->myNum]->drawable.id; reply.sequenceNumber = client->sequence; @@ -1279,6 +1282,7 @@ ProcInternAtom(register ClientPtr client) if (atom != BAD_RESOURCE) { xInternAtomReply reply; + memset(&reply, 0, sizeof(xInternAtomReply)); reply.type = X_Reply; reply.length = 0; reply.sequenceNumber = client->sequence; @@ -1302,6 +1306,7 @@ ProcGetAtomName(register ClientPtr client) if ( (str = NameForAtom(stuff->id)) ) { len = strlen(str); + memset(&reply, 0, sizeof(xGetAtomNameReply)); reply.type = X_Reply; reply.length = (len + 3) >> 2; reply.sequenceNumber = client->sequence; @@ -1441,6 +1446,7 @@ ProcGetSelectionOwner(register ClientPtr client) i = 0; while ((i < NumCurrentSelections) && CurrentSelections[i].selection != stuff->id) i++; + memset(&reply, 0, sizeof(xGetSelectionOwnerReply)); reply.type = X_Reply; reply.length = 0; reply.sequenceNumber = client->sequence; @@ -1512,7 +1518,9 @@ ProcConvertSelection(register ClientPtr client) CurrentSelections[i].pWin)) #endif ) + { + memset(&event, 0, sizeof(xEvent)); event.u.u.type = SelectionRequest; event.u.selectionRequest.time = stuff->time; event.u.selectionRequest.owner = @@ -1526,6 +1534,7 @@ ProcConvertSelection(register ClientPtr client) NoEventMask /* CantBeFiltered */, NullGrab)) return (client->noClientException); } + memset(&event, 0, sizeof(xEvent)); event.u.u.type = SelectionNotify; event.u.selectionNotify.time = stuff->time; event.u.selectionNotify.requestor = stuff->requestor; @@ -1622,6 +1631,7 @@ ProcTranslateCoords(register ClientPtr client) SecurityReadAccess); if (!pDst) return(BadWindow); + memset(&rep, 0, sizeof(xTranslateCoordsReply)); rep.type = X_Reply; rep.length = 0; rep.sequenceNumber = client->sequence; @@ -1850,6 +1860,7 @@ ProcQueryFont(register ClientPtr client) { return(BadAlloc); } + memset(reply, 0, rlength); reply->type = X_Reply; reply->length = (rlength - sizeof(xGenericReply)) >> 2; @@ -2659,6 +2670,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable, return(BadValue); } SECURITY_VERIFY_DRAWABLE(pDraw, drawable, client, SecurityReadAccess); + memset(&xgi, 0, sizeof(xGetImageReply)); if(pDraw->type == DRAWABLE_WINDOW) { if( /* check for being viewable */ @@ -2712,9 +2724,10 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable, xgi.length = length; if (im_return) { - pBuf = (char *)xalloc(sz_xGetImageReply + length); + pBuf = (char *)xcalloc(1, sz_xGetImageReply + length); if (!pBuf) return (BadAlloc); + if (widthBytesLine == 0) linesPerBuf = 0; else @@ -2752,6 +2765,7 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable, } if(!(pBuf = (char *) ALLOCATE_LOCAL(length))) return (BadAlloc); + memset(pBuf, 0, length); WriteReplyToClient(client, sizeof (xGetImageReply), &xgi); } @@ -3520,6 +3534,7 @@ ProcQueryColors(register ClientPtr client) prgbs = (xrgb *)ALLOCATE_LOCAL(count * sizeof(xrgb)); if(!prgbs && count) return(BadAlloc); + memset(prgbs, 0, count * sizeof(xrgb)); if( (retval = QueryColors(pcmp, count, (Pixel *)&stuff[1], prgbs)) ) { if (prgbs) DEALLOCATE_LOCAL(prgbs); @@ -3531,6 +3546,7 @@ ProcQueryColors(register ClientPtr client) return (retval); } } + memset(&qcr, 0, sizeof(xQueryColorsReply)); qcr.type = X_Reply; qcr.length = (count * sizeof(xrgb)) >> 2; qcr.sequenceNumber = client->sequence; @@ -3755,6 +3771,7 @@ ProcQueryBestSize (register ClientPtr client) pScreen = pDraw->pScreen; (* pScreen->QueryBestSize)(stuff->class, &stuff->width, &stuff->height, pScreen); + memset(&reply, 0, sizeof(xQueryBestSizeReply)); reply.type = X_Reply; reply.length = 0; reply.sequenceNumber = client->sequence; @@ -4623,6 +4640,7 @@ SendErrorToClient(ClientPtr client, unsigned majorCode, unsigned minorCode, { xError rep; + memset(&rep, 0, sizeof(xError)); rep.type = X_Error; rep.sequenceNumber = client->sequence; rep.errorCode = errorCode; -- cgit v1.2.3