diff options
author | Mike DePaulo <mikedep333@gmail.com> | 2015-01-10 12:03:47 -0500 |
---|---|---|
committer | Mike DePaulo <mikedep333@gmail.com> | 2015-01-10 12:06:49 -0500 |
commit | 7e1c3b94f42dfc5e52f0f724b6bf7d03e3b743e3 (patch) | |
tree | f2a4bfed7809a8e0bf4d06ec56a80191badba48b /xorg-server/glx/indirect_dispatch_swap.c | |
parent | 212ca5c6023b6b7455ad64b2c29aeff82f301a03 (diff) | |
download | vcxsrv-7e1c3b94f42dfc5e52f0f724b6bf7d03e3b743e3.tar.gz vcxsrv-7e1c3b94f42dfc5e52f0f724b6bf7d03e3b743e3.tar.bz2 vcxsrv-7e1c3b94f42dfc5e52f0f724b6bf7d03e3b743e3.zip |
Fix CVE-2014-8091..8103. Patches were ported from Ubuntu 14.04 (xorg-server 1.15.1)
Diffstat (limited to 'xorg-server/glx/indirect_dispatch_swap.c')
-rw-r--r-- | xorg-server/glx/indirect_dispatch_swap.c | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/xorg-server/glx/indirect_dispatch_swap.c b/xorg-server/glx/indirect_dispatch_swap.c index 4096023a7..d1118d666 100644 --- a/xorg-server/glx/indirect_dispatch_swap.c +++ b/xorg-server/glx/indirect_dispatch_swap.c @@ -2875,6 +2875,9 @@ int __glXDispSwap_AreTexturesResident(__GLXclientState *cl, GLbyte *pc) GLboolean retval; GLboolean answerBuffer[200]; GLboolean * residences = __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1); + + if (residences == NULL) + return BadAlloc; retval = CALL_AreTexturesResident( GET_DISPATCH(), ( n, (const GLuint *)bswap_32_array( (uint32_t *) (pc + 4), 0 ), @@ -2900,6 +2903,9 @@ int __glXDispSwap_AreTexturesResidentEXT(__GLXclientState *cl, GLbyte *pc) GLboolean retval; GLboolean answerBuffer[200]; GLboolean * residences = __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1); + + if (residences == NULL) + return BadAlloc; retval = CALL_AreTexturesResident( GET_DISPATCH(), ( n, (const GLuint *)bswap_32_array( (uint32_t *) (pc + 4), 0 ), @@ -3017,6 +3023,9 @@ int __glXDispSwap_GenTextures(__GLXclientState *cl, GLbyte *pc) GLuint answerBuffer[200]; GLuint * textures = __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer), 4); + + if (textures == NULL) + return BadAlloc; CALL_GenTextures( GET_DISPATCH(), ( n, textures @@ -3041,6 +3050,9 @@ int __glXDispSwap_GenTexturesEXT(__GLXclientState *cl, GLbyte *pc) GLuint answerBuffer[200]; GLuint * textures = __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer), 4); + + if (textures == NULL) + return BadAlloc; CALL_GenTextures( GET_DISPATCH(), ( n, textures @@ -4407,6 +4419,9 @@ int __glXDispSwap_GenQueries(__GLXclientState *cl, GLbyte *pc) GLuint answerBuffer[200]; GLuint * ids = __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer), 4); + if (ids == NULL) + return BadAlloc; + CALL_GenQueries( GET_DISPATCH(), ( n, ids @@ -4864,6 +4879,9 @@ int __glXDispSwap_GenProgramsARB(__GLXclientState *cl, GLbyte *pc) GLuint answerBuffer[200]; GLuint * programs = __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer), 4); + if (programs == NULL) + return BadAlloc; + CALL_GenProgramsARB( GET_DISPATCH(), ( n, programs @@ -5245,6 +5263,10 @@ int __glXDispSwap_GenFramebuffers(__GLXclientState *cl, GLbyte *pc) GLuint answerBuffer[200]; GLuint * framebuffers = __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer), 4); + + if (framebuffers == NULL) + return BadAlloc; + CALL_GenFramebuffers( GET_DISPATCH(), ( n, framebuffers @@ -5269,6 +5291,10 @@ int __glXDispSwap_GenRenderbuffers(__GLXclientState *cl, GLbyte *pc) GLuint answerBuffer[200]; GLuint * renderbuffers = __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer), 4); + + if (renderbuffers == NULL) + return BadAlloc; + CALL_GenRenderbuffers( GET_DISPATCH(), ( n, renderbuffers |