svn merge https://vcxsrv.svn.sourceforge.net/svnroot/vcxsrv/branches/released .

1 files changed, 48 insertions, 36 deletions

diff --git a/xorg-server/dix/property.c b/xorg-server/dix/property.c
index 7149f7c8c..9ec5dc6ae 100644
--- a/xorg-server/dix/property.c
+++ b/xorg-server/dix/property.c
@@ -50,8 +50,6 @@ SOFTWARE.
 #endif
 
 #include <X11/X.h>
-#define NEED_REPLIES
-#define NEED_EVENTS
 #include <X11/Xproto.h>
 #include "windowstr.h"
 #include "propertyst.h"
@@ -90,7 +88,7 @@ PrintPropertys(WindowPtr pWin)
 }
 #endif
 
-_X_EXPORT int
+int
 dixLookupProperty(PropertyPtr *result, WindowPtr pWin, Atom propertyName,
 		  ClientPtr client, Mask access_mode)
 {
@@ -113,6 +111,7 @@ deliverPropertyNotifyEvent(WindowPtr pWin, int state, Atom atom)
 {
     xEvent event;
 
+    memset(&event, 0, sizeof(xEvent));
     event.u.u.type = PropertyNotify;
     event.u.property.window = pWin->drawable.id;
     event.u.property.state = state;
@@ -138,8 +137,8 @@ ProcRotateProperties(ClientPtr client)
         return rc;
 
     atoms = (Atom *) & stuff[1];
-    props = (PropertyPtr *)xalloc(stuff->nAtoms * sizeof(PropertyPtr));
-    saved = (PropertyPtr)xalloc(stuff->nAtoms * sizeof(PropertyRec));
+    props = xalloc(stuff->nAtoms * sizeof(PropertyPtr));
+    saved = xalloc(stuff->nAtoms * sizeof(PropertyRec));
     if (!props || !saved) {
 	rc = BadAlloc;
 	goto out;
@@ -219,7 +218,7 @@ ProcChangeProperty(ClientPtr client)
         return BadValue;
     }
     len = stuff->nUnits;
-    if (len > ((0xffffffff - sizeof(xChangePropertyReq)) >> 2))
+    if (len > bytes_to_int32(0xffffffff - sizeof(xChangePropertyReq)))
 	return BadLength;
     sizeInBytes = format>>3;
     totalSize = len * sizeInBytes;
@@ -248,14 +247,15 @@ ProcChangeProperty(ClientPtr client)
 	return client->noClientException;
 }
 
-_X_EXPORT int
+int
 dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
 			Atom type, int format, int mode, unsigned long len,
 			pointer value, Bool sendevent)
 {
     PropertyPtr pProp;
+    PropertyRec savedProp;
     int sizeInBytes, totalSize, rc;
-    pointer data;
+    unsigned char *data;
     Mask access_mode;
 
     sizeInBytes = format>>3;
@@ -269,21 +269,20 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
     {
 	if (!pWin->optional && !MakeWindowOptional (pWin))
 	    return(BadAlloc);
-        pProp = (PropertyPtr)xalloc(sizeof(PropertyRec));
+        pProp = xalloc(sizeof(PropertyRec));
 	if (!pProp)
 	    return(BadAlloc);
-        data = (pointer)xalloc(totalSize);
+        data = xalloc(totalSize);
 	if (!data && len)
 	{
 	    xfree(pProp);
 	    return(BadAlloc);
 	}
+        memcpy(data, value, totalSize);
         pProp->propertyName = property;
         pProp->type = type;
         pProp->format = format;
         pProp->data = data;
-	if (len)
-	    memmove((char *)data, (char *)value, totalSize);
 	pProp->size = len;
 	pProp->devPrivates = NULL;
 	rc = XaceHookPropertyAccess(pClient, pWin, &pProp,
@@ -308,17 +307,17 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
 	    return(BadMatch);
         if ((pProp->type != type) && (mode != PropModeReplace))
             return(BadMatch);
+
+	/* save the old values for later */
+	savedProp = *pProp;
+
         if (mode == PropModeReplace)
         {
-	    if (totalSize != pProp->size * (pProp->format >> 3))
-	    {
-	    	data = (pointer)xrealloc(pProp->data, totalSize);
-	    	if (!data && len)
-		    return(BadAlloc);
-            	pProp->data = data;
-	    }
-	    if (len)
-		memmove((char *)pProp->data, (char *)value, totalSize);
+	    data = xalloc(totalSize);
+	    if (!data && len)
+		return(BadAlloc);
+	    memcpy(data, value, totalSize);
+	    pProp->data = data;
 	    pProp->size = len;
     	    pProp->type = type;
 	    pProp->format = format;
@@ -329,28 +328,40 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
 	}
         else if (mode == PropModeAppend)
         {
-	    data = (pointer)xrealloc(pProp->data,
-				     sizeInBytes * (len + pProp->size));
+	    data = xalloc((pProp->size + len) * sizeInBytes);
 	    if (!data)
 		return(BadAlloc);
+	    memcpy(data, pProp->data, pProp->size * sizeInBytes);
+	    memcpy(data + pProp->size * sizeInBytes, value, totalSize);
             pProp->data = data;
-	    memmove(&((char *)data)[pProp->size * sizeInBytes], 
-		    (char *)value,
-		  totalSize);
             pProp->size += len;
 	}
         else if (mode == PropModePrepend)
         {
-            data = (pointer)xalloc(sizeInBytes * (len + pProp->size));
+            data = xalloc(sizeInBytes * (len + pProp->size));
 	    if (!data)
 		return(BadAlloc);
-	    memmove(&((char *)data)[totalSize], (char *)pProp->data, 
-		  (int)(pProp->size * sizeInBytes));
-            memmove((char *)data, (char *)value, totalSize);
-	    xfree(pProp->data);
+            memcpy(data + totalSize, pProp->data, pProp->size * sizeInBytes);
+            memcpy(data, value, totalSize);
             pProp->data = data;
             pProp->size += len;
 	}
+
+	/* Allow security modules to check the new content */
+	access_mode |= DixPostAccess;
+	rc = XaceHookPropertyAccess(pClient, pWin, &pProp, access_mode);
+	if (rc == Success)
+	{
+	    if (savedProp.data != pProp->data)
+		xfree(savedProp.data);
+	}
+	else
+	{
+	    if (savedProp.data != pProp->data)
+		xfree(pProp->data);
+	    *pProp = savedProp;
+	    return rc;
+	}
     }
     else
 	return rc;
@@ -361,7 +372,7 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
     return(Success);
 }
 
-_X_EXPORT int
+int
 ChangeWindowProperty(WindowPtr pWin, Atom property, Atom type, int format, 
 		     int mode, unsigned long len, pointer value, 
 		     Bool sendevent)
@@ -463,7 +474,7 @@ ProcGetProperty(ClientPtr client)
     }
     rc = dixLookupWindow(&pWin, stuff->window, client, win_mode);
     if (rc != Success)
-	return rc;
+	return (rc == BadMatch) ? BadWindow : rc;
 
     if (!ValidAtom(stuff->property))
     {
@@ -481,6 +492,7 @@ ProcGetProperty(ClientPtr client)
 	return(BadAtom);
     }
 
+    memset(&reply, 0, sizeof(xGetPropertyReply));
     reply.type = X_Reply;
     reply.sequenceNumber = client->sequence;
 
@@ -525,7 +537,7 @@ ProcGetProperty(ClientPtr client)
 
     reply.bytesAfter = n - (ind + len);
     reply.format = pProp->format;
-    reply.length = (len + 3) >> 2;
+    reply.length = bytes_to_int32(len);
     reply.nItems = len / (pProp->format / 8 );
     reply.propertyType = pProp->type;
 
@@ -583,7 +595,7 @@ ProcListProperties(ClientPtr client)
     for (pProp = wUserProps(pWin); pProp; pProp = pProp->next)
 	numProps++;
 
-    if (numProps && !(pAtoms = (Atom *)xalloc(numProps * sizeof(Atom))))
+    if (numProps && !(pAtoms = xalloc(numProps * sizeof(Atom))))
 	return BadAlloc;
 
     numProps = 0;
@@ -599,7 +611,7 @@ ProcListProperties(ClientPtr client)
 
     xlpr.type = X_Reply;
     xlpr.nProperties = numProps;
-    xlpr.length = (numProps * sizeof(Atom)) >> 2;
+    xlpr.length = bytes_to_int32(numProps * sizeof(Atom));
     xlpr.sequenceNumber = client->sequence;
     WriteReplyToClient(client, sizeof(xGenericReply), &xlpr);
     if (numProps)