aboutsummaryrefslogtreecommitdiff
path: root/xorg-server/hw/dmx
diff options
context:
space:
mode:
Diffstat (limited to 'xorg-server/hw/dmx')
-rw-r--r--xorg-server/hw/dmx/dmx_glxvisuals.c25
-rw-r--r--xorg-server/hw/dmx/glxProxy/glxcmds.c16
-rw-r--r--xorg-server/hw/dmx/glxProxy/glxscreens.c9
-rw-r--r--xorg-server/hw/dmx/glxProxy/glxsingle.c6
-rw-r--r--xorg-server/hw/dmx/glxProxy/glxvendor.c4
5 files changed, 29 insertions, 31 deletions
diff --git a/xorg-server/hw/dmx/dmx_glxvisuals.c b/xorg-server/hw/dmx/dmx_glxvisuals.c
index f903b7491..56bd67b6e 100644
--- a/xorg-server/hw/dmx/dmx_glxvisuals.c
+++ b/xorg-server/hw/dmx/dmx_glxvisuals.c
@@ -37,6 +37,7 @@
#include <GL/glxproto.h>
#include <X11/extensions/Xext.h>
#include <X11/extensions/extutil.h>
+#include <limits.h>
#include "dmx_glxvisuals.h"
@@ -84,7 +85,10 @@ GetGLXVisualConfigs(Display * dpy, int screen, int *nconfigs)
SyncHandle();
return NULL;
}
- props = (INT32 *) Xmalloc(nprops * __GLX_SIZE_CARD32);
+ if (nprops < (INT_MAX / __GLX_SIZE_CARD32))
+ props = Xmalloc(nprops * __GLX_SIZE_CARD32);
+ else
+ props = NULL;
if (!props) {
UnlockDisplay(dpy);
SyncHandle();
@@ -92,15 +96,16 @@ GetGLXVisualConfigs(Display * dpy, int screen, int *nconfigs)
}
/* Allocate memory for our config structure */
- config = (__GLXvisualConfig *)
- Xmalloc(nvisuals * sizeof(__GLXvisualConfig));
+ if (nvisuals < (INT_MAX / sizeof(__GLXvisualConfig)))
+ config = Xcalloc(nvisuals, sizeof(__GLXvisualConfig));
+ else
+ config = NULL;
if (!config) {
free(props);
UnlockDisplay(dpy);
SyncHandle();
return NULL;
}
- memset(config, 0, nvisuals * sizeof(__GLXvisualConfig));
configs = config;
num_good_visuals = 0;
@@ -274,7 +279,10 @@ GetGLXFBConfigs(Display * dpy, int glxMajorOpcode, int *nconfigs)
return NULL;
}
- attrs = (INT32 *) Xmalloc(2 * numAttribs * __GLX_SIZE_CARD32);
+ if (numAttribs < (INT_MAX / (2 * __GLX_SIZE_CARD32)))
+ attrs = Xmalloc(2 * numAttribs * __GLX_SIZE_CARD32);
+ else
+ attrs = NULL;
if (!attrs) {
UnlockDisplay(dpy);
SyncHandle();
@@ -282,15 +290,16 @@ GetGLXFBConfigs(Display * dpy, int glxMajorOpcode, int *nconfigs)
}
/* Allocate memory for our config structure */
- config = (__GLXFBConfig *)
- Xmalloc(numFBConfigs * sizeof(__GLXFBConfig));
+ if (numFBConfigs < (INT_MAX / sizeof(__GLXFBConfig)))
+ config = Xcalloc(numFBConfigs, sizeof(__GLXFBConfig));
+ else
+ config = NULL;
if (!config) {
free(attrs);
UnlockDisplay(dpy);
SyncHandle();
return NULL;
}
- memset(config, 0, numFBConfigs * sizeof(__GLXFBConfig));
fbconfigs = config;
/* Convert attribute list into our format */
diff --git a/xorg-server/hw/dmx/glxProxy/glxcmds.c b/xorg-server/hw/dmx/glxProxy/glxcmds.c
index 45382748f..8cdb25ec6 100644
--- a/xorg-server/hw/dmx/glxProxy/glxcmds.c
+++ b/xorg-server/hw/dmx/glxProxy/glxcmds.c
@@ -2582,7 +2582,6 @@ __glXQueryExtensionsString(__GLXclientState * cl, GLbyte * pc)
xGLXQueryExtensionsStringReply be_reply;
DMXScreenInfo *dmxScreen;
Display *dpy;
- int slop;
#endif
screen = req->screen;
@@ -2608,16 +2607,13 @@ __glXQueryExtensionsString(__GLXclientState * cl, GLbyte * pc)
_XReply(dpy, (xReply *) &be_reply, 0, False);
len = (int) be_reply.length;
numbytes = (int) be_reply.n;
- slop = numbytes * __GLX_SIZE_INT8 & 3;
be_buf = (char *) malloc(numbytes);
if (!be_buf) {
/* Throw data on the floor */
- _XEatData(dpy, len);
+ _XEatDataWords(dpy, len);
}
else {
- _XRead(dpy, (char *) be_buf, numbytes);
- if (slop)
- _XEatData(dpy, 4 - slop);
+ _XReadPad(dpy, (char *) be_buf, numbytes);
}
UnlockDisplay(dpy);
SyncHandle();
@@ -2666,7 +2662,6 @@ __glXQueryServerString(__GLXclientState * cl, GLbyte * pc)
xGLXQueryServerStringReply be_reply;
DMXScreenInfo *dmxScreen;
Display *dpy;
- int slop;
#endif
name = req->name;
@@ -2693,16 +2688,13 @@ __glXQueryServerString(__GLXclientState * cl, GLbyte * pc)
_XReply(dpy, (xReply *) &be_reply, 0, False);
len = (int) be_reply.length;
numbytes = (int) be_reply.n;
- slop = numbytes * __GLX_SIZE_INT8 & 3;
be_buf = (char *) malloc(numbytes);
if (!be_buf) {
/* Throw data on the floor */
- _XEatData(dpy, len);
+ _XEatDataWords(dpy, len);
}
else {
- _XRead(dpy, (char *) be_buf, numbytes);
- if (slop)
- _XEatData(dpy, 4 - slop);
+ _XReadPad(dpy, (char *) be_buf, numbytes);
}
UnlockDisplay(dpy);
SyncHandle();
diff --git a/xorg-server/hw/dmx/glxProxy/glxscreens.c b/xorg-server/hw/dmx/glxProxy/glxscreens.c
index 2a1909244..138afedf2 100644
--- a/xorg-server/hw/dmx/glxProxy/glxscreens.c
+++ b/xorg-server/hw/dmx/glxProxy/glxscreens.c
@@ -138,7 +138,7 @@ CalcServerVersionAndExtensions(void)
Display *dpy = dmxScreen->beDisplay;
xGLXQueryServerStringReq *req;
xGLXQueryServerStringReply reply;
- int length, numbytes, slop;
+ int length, numbytes;
/* Send the glXQueryServerString request */
LockDisplay(dpy);
@@ -151,16 +151,13 @@ CalcServerVersionAndExtensions(void)
length = (int) reply.length;
numbytes = (int) reply.n;
- slop = numbytes * __GLX_SIZE_INT8 & 3;
be_extensions[s] = (char *) malloc(numbytes);
if (!be_extensions[s]) {
/* Throw data on the floor */
- _XEatData(dpy, length);
+ _XEatDataWords(dpy, length);
}
else {
- _XRead(dpy, (char *) be_extensions[s], numbytes);
- if (slop)
- _XEatData(dpy, 4 - slop);
+ _XReadPad(dpy, (char *) be_extensions[s], numbytes);
}
UnlockDisplay(dpy);
SyncHandle();
diff --git a/xorg-server/hw/dmx/glxProxy/glxsingle.c b/xorg-server/hw/dmx/glxProxy/glxsingle.c
index e60cfeb70..abfb880a3 100644
--- a/xorg-server/hw/dmx/glxProxy/glxsingle.c
+++ b/xorg-server/hw/dmx/glxProxy/glxsingle.c
@@ -258,7 +258,7 @@ __glXForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
- _XEatData(dpy, be_buf_size);
+ _XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}
@@ -357,7 +357,7 @@ __glXForwardAllWithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
- _XEatData(dpy, be_buf_size);
+ _XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}
@@ -993,7 +993,7 @@ __glXDisp_ReadPixels(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
- _XEatData(dpy, be_buf_size);
+ _XEatDataWords(dpy, be_reply.length);
free(buf);
return BadAlloc;
}
diff --git a/xorg-server/hw/dmx/glxProxy/glxvendor.c b/xorg-server/hw/dmx/glxProxy/glxvendor.c
index 5777c6acc..50d505c4b 100644
--- a/xorg-server/hw/dmx/glxProxy/glxvendor.c
+++ b/xorg-server/hw/dmx/glxProxy/glxvendor.c
@@ -246,7 +246,7 @@ __glXVForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
- _XEatData(dpy, be_buf_size);
+ _XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}
@@ -340,7 +340,7 @@ __glXVForwardAllWithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
- _XEatData(dpy, be_buf_size);
+ _XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-01 11:18:34 +0000