diff options
| -rw-r--r-- | xorg-server/fb/fbbits.h | 2 | ||||
| -rw-r--r-- | xorg-server/glx/glxcmds.c | 7 | ||||
| -rw-r--r-- | xorg-server/hw/xfree86/ddc/interpret_edid.c | 2 | ||||
| -rw-r--r-- | xorg-server/render/render.c | 8 |
4 files changed, 17 insertions, 2 deletions
diff --git a/xorg-server/fb/fbbits.h b/xorg-server/fb/fbbits.h index 77e792fd7..80a61ddeb 100644 --- a/xorg-server/fb/fbbits.h +++ b/xorg-server/fb/fbbits.h @@ -25,7 +25,7 @@ * underlying datatypes instead of masks
*/
-#define isClipped(c,ul,lr) ((((c) - (ul)) | ((lr) - (c))) & 0x80008000)
+#define isClipped(c,ul,lr) (((c) | ((c) - (ul)) | ((lr) - (c))) & 0x80008000)
#ifdef HAVE_DIX_CONFIG_H
#include <dix-config.h>
diff --git a/xorg-server/glx/glxcmds.c b/xorg-server/glx/glxcmds.c index be1f2c659..fb477fa98 100644 --- a/xorg-server/glx/glxcmds.c +++ b/xorg-server/glx/glxcmds.c @@ -491,6 +491,13 @@ __glXGetDrawable(__GLXcontext *glxc, GLXDrawable drawId, ClientPtr client, return pGlxDraw;
}
+ /* No active context and an unknown drawable, bail. */
+ if (glxc == NULL) {
+ client->errorValue = drawId;
+ *error = BadMatch;
+ return NULL;
+ }
+
/* The drawId wasn't a GLX drawable. Make sure it's a window and
* create a GLXWindow for it. Check that the drawable screen
* matches the context screen and that the context fbconfig is
diff --git a/xorg-server/hw/xfree86/ddc/interpret_edid.c b/xorg-server/hw/xfree86/ddc/interpret_edid.c index 7558206cc..d1001a21f 100644 --- a/xorg-server/hw/xfree86/ddc/interpret_edid.c +++ b/xorg-server/hw/xfree86/ddc/interpret_edid.c @@ -552,7 +552,7 @@ get_monitor_ranges(Uchar *c, struct monitor_ranges *r) r->max_h = MAX_H;
r->max_clock = 0;
if(MAX_CLOCK != 0xff) /* is specified? */
- r->max_clock = MAX_CLOCK * 10;
+ r->max_clock = MAX_CLOCK * 10 + 5;
if (HAVE_2ND_GTF) {
r->gtf_2nd_f = F_2ND_GTF;
r->gtf_2nd_c = C_2ND_GTF;
diff --git a/xorg-server/render/render.c b/xorg-server/render/render.c index cbd70cc7e..623d5db33 100644 --- a/xorg-server/render/render.c +++ b/xorg-server/render/render.c @@ -1077,6 +1077,14 @@ ProcRenderAddGlyphs (ClientPtr client) gi = (xGlyphInfo *) (gids + nglyphs);
bits = (CARD8 *) (gi + nglyphs);
remain -= (sizeof (CARD32) + sizeof (xGlyphInfo)) * nglyphs;
+
+ /* protect against bad nglyphs */
+ if (gi < stuff || gi > ((CARD32 *)stuff + client->req_len) ||
+ bits < stuff || bits > ((CARD32 *)stuff + client->req_len)) {
+ err = BadLength;
+ goto bail;
+ }
+
for (i = 0; i < nglyphs; i++)
{
size_t padded_width;
|