Hello community,
here is the log from the commit of package xgl
checked in at Sat Mar 8 00:09:40 CET 2008.
--------
--- xgl/xgl.changes 2008-02-15 01:01:46.000000000 +0100
+++ xgl/xgl.changes 2008-03-07 21:40:28.633233000 +0100
@@ -1,0 +2,12 @@
+Fri Mar 7 21:43:24 CET 2008 - mauro@suse.de
+
+- Fix bnc-356596. Added:
+ + bug-243978_xcmisc.diff
+ + bug343248-CVE-2007-5958.diff
+ + bug-345127_IDEF2888_le_xserver1.3.patch
+ + bug345128-IDEF2901.diff
+ + bug345130-IDEF2902.diff
+ + bug345131-IDEF2904.diff
+ + bug348296-pcf_font_parser.diff
+
+-------------------------------------------------------------------
New:
----
bug-243978_xcmisc.diff
bug343248-CVE-2007-5958.diff
bug-345127_IDEF2888_le_xserver1.3.patch
bug345128-IDEF2901.diff
bug345130-IDEF2902.diff
bug345131-IDEF2904.diff
bug348296-pcf_font_parser.diff
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ xgl.spec ++++++
--- /var/tmp/diff_new_pack.m22036/_old 2008-03-08 00:08:49.000000000 +0100
+++ /var/tmp/diff_new_pack.m22036/_new 2008-03-08 00:08:49.000000000 +0100
@@ -25,7 +25,7 @@
Requires: xgl-hardware-list
AutoReqProv: on
Version: git_071026
-Release: 31
+Release: 41
Summary: Xserver that uses OpenGL for its drawing operations.
BuildRoot: %{_tmppath}/%{name}-%{version}-build
ExclusiveArch: %ix86 x86_64 ppc ppc64 ia64
@@ -49,6 +49,13 @@
Patch15: 180716.diff
# Pre- Xorg 7.0 patches
Patch20: xorg-security-file-dir.diff
+Patch21: bug-345127_IDEF2888_le_xserver1.3.patch
+Patch22: bug345128-IDEF2901.diff
+Patch24: bug345130-IDEF2902.diff
+Patch25: bug345131-IDEF2904.diff
+Patch26: bug348296-pcf_font_parser.diff
+Patch27: bug-243978_xcmisc.diff
+Patch28: bug343248-CVE-2007-5958.diff
# Non-xgl patches
Patch30: glitz-glx-get-proc-address.diff
%if "%(xft-config --prefix)" == "/usr"
@@ -111,6 +118,13 @@
%patch13 -p1
%patch14 -p0
%patch15 -p1
+%patch21 -p1
+%patch22 -p1
+%patch24 -p1
+%patch25 -p1
+%patch26 -p0
+%patch27 -p0
+%patch28 -p1
%if "%xorg_prefix" == "/usr/X11R6"
# Pre-Xorg7.0 patches
%patch20 -p0
@@ -203,6 +217,15 @@
/var/adm/fillup-templates/sysconfig.displaymanager-%name
%changelog
+* Fri Mar 07 2008 mauro@suse.de
+- Fix bnc-356596. Added:
+ + bug-243978_xcmisc.diff
+ + bug343248-CVE-2007-5958.diff
+ + bug-345127_IDEF2888_le_xserver1.3.patch
+ + bug345128-IDEF2901.diff
+ + bug345130-IDEF2902.diff
+ + bug345131-IDEF2904.diff
+ + bug348296-pcf_font_parser.diff
* Fri Feb 01 2008 dreveman@suse.de
- Always start Xorg server with "-depth 24" (bnc#180716).
* Wed Jan 30 2008 dreveman@suse.de
++++++ bug-243978_xcmisc.diff ++++++
Index: Xext/xcmisc.c
===================================================================
RCS file: /cvs/xenocara/xserver/Xext/xcmisc.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 xcmisc.c
--- Xext/xcmisc.c 26 Nov 2006 18:14:51 -0000 1.1.1.1
+++ Xext/xcmisc.c 16 Feb 2007 21:59:51 -0000
@@ -42,6 +42,12 @@
#include
#include "modinit.h"
+#if HAVE_STDINT_H
+#include
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
#if 0
static unsigned char XCMiscCode;
#endif
@@ -143,7 +149,10 @@
REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
- pids = (XID *)ALLOCATE_LOCAL(stuff->count * sizeof(XID));
+ if (stuff->count > UINT32_MAX / sizeof(XID))
+ return BadAlloc;
+
+ pids = (XID *)Xalloc(stuff->count * sizeof(XID));
if (!pids)
{
return BadAlloc;
@@ -164,7 +173,7 @@
client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
WriteSwappedDataToClient(client, count * sizeof(XID), pids);
}
- DEALLOCATE_LOCAL(pids);
+ Xfree(pids);
return(client->noClientException);
}
++++++ bug343248-CVE-2007-5958.diff ++++++
--- xorg-server-1.3.0.0/Xext/security.c 2007-12-19 23:00:48.062636000 -0800
+++ xorg-server-1.3.0.0/Xext/security.c 2007-12-21 14:04:40.604373000 -0800
@@ -1572,7 +1572,7 @@
return;
#ifndef __UNIXOS2__
- f = fopen(SecurityPolicyFile, "r");
+ f = Fopen(SecurityPolicyFile, "r");
#else
f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
#endif
@@ -1658,7 +1658,7 @@
}
#endif /* PROPDEBUG */
- fclose(f);
+ Fclose(f);
} /* SecurityLoadPropertyAccessList */
++++++ bug-345127_IDEF2888_le_xserver1.3.patch ++++++
#
# Updated but not checked in:
# (will commit)
#
# modified: Xi/chgfctl.c
# modified: Xi/chgkmap.c
# modified: Xi/chgprop.c
# modified: Xi/grabdev.c
# modified: Xi/grabdevb.c
# modified: Xi/grabdevk.c
# modified: Xi/selectev.c
# modified: Xi/sendexev.c
#
diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c
index 46bb8e7..1a02eee 100644
--- a/Xi/chgfctl.c
+++ b/Xi/chgfctl.c
@@ -303,18 +303,13 @@ ChangeStringFeedback(ClientPtr client, D
xStringFeedbackCtl * f)
{
register char n;
- register long *p;
int i, j;
KeySym *syms, *sup_syms;
syms = (KeySym *) (f + 1);
if (client->swapped) {
swaps(&f->length, n); /* swapped num_keysyms in calling proc */
- p = (long *)(syms);
- for (i = 0; i < f->num_keysyms; i++) {
- swapl(p, n);
- p++;
- }
+ SwapLongs((CARD32 *) syms, f->num_keysyms);
}
if (f->num_keysyms > s->ctrl.max_symbols)
diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c
index bfdc1ce..d0b29b8 100644
--- a/Xi/chgkmap.c
+++ b/Xi/chgkmap.c
@@ -76,18 +76,14 @@ int
SProcXChangeDeviceKeyMapping(ClientPtr client)
{
register char n;
- register long *p;
- register int i, count;
+ register unsigned int count;
REQUEST(xChangeDeviceKeyMappingReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
- p = (long *)&stuff[1];
count = stuff->keyCodes * stuff->keySymsPerKeyCode;
- for (i = 0; i < count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), count);
return (ProcXChangeDeviceKeyMapping(client));
}
@@ -103,10 +99,14 @@ ProcXChangeDeviceKeyMapping(ClientPtr cl
int ret;
unsigned len;
DeviceIntPtr dev;
+ unsigned int count;
REQUEST(xChangeDeviceKeyMappingReq);
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
+ count = stuff->keyCodes * stuff->keySymsPerKeyCode;
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
+
dev = LookupDeviceIntRec(stuff->deviceid);
if (dev == NULL)
return BadDevice;
diff --git a/Xi/chgprop.c b/Xi/chgprop.c
index 13463dd..c6e6993 100644
--- a/Xi/chgprop.c
+++ b/Xi/chgprop.c
@@ -78,19 +78,15 @@ int
SProcXChangeDeviceDontPropagateList(ClientPtr client)
{
register char n;
- register long *p;
- register int i;
REQUEST(xChangeDeviceDontPropagateListReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
swapl(&stuff->window, n);
swaps(&stuff->count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
+ stuff->count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
return (ProcXChangeDeviceDontPropagateList(client));
}
diff --git a/Xi/grabdev.c b/Xi/grabdev.c
index b303695..8cca85f 100644
--- a/Xi/grabdev.c
+++ b/Xi/grabdev.c
@@ -79,8 +79,6 @@ int
SProcXGrabDevice(ClientPtr client)
{
register char n;
- register long *p;
- register int i;
REQUEST(xGrabDeviceReq);
swaps(&stuff->length, n);
@@ -88,11 +86,11 @@ SProcXGrabDevice(ClientPtr client)
swapl(&stuff->grabWindow, n);
swapl(&stuff->time, n);
swaps(&stuff->event_count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->event_count; i++) {
- swapl(p, n);
- p++;
- }
+
+ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
+ return BadLength;
+
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDevice(client));
}
diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c
index 21e46fc..3674441 100644
--- a/Xi/grabdevb.c
+++ b/Xi/grabdevb.c
@@ -77,8 +77,6 @@ int
SProcXGrabDeviceButton(ClientPtr client)
{
register char n;
- register long *p;
- register int i;
REQUEST(xGrabDeviceButtonReq);
swaps(&stuff->length, n);
@@ -86,11 +84,9 @@ SProcXGrabDeviceButton(ClientPtr client)
swapl(&stuff->grabWindow, n);
swaps(&stuff->modifiers, n);
swaps(&stuff->event_count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->event_count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
+ stuff->event_count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDeviceButton(client));
}
diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c
index 8da36ba..b6374c1 100644
--- a/Xi/grabdevk.c
+++ b/Xi/grabdevk.c
@@ -77,8 +77,6 @@ int
SProcXGrabDeviceKey(ClientPtr client)
{
register char n;
- register long *p;
- register int i;
REQUEST(xGrabDeviceKeyReq);
swaps(&stuff->length, n);
@@ -86,11 +84,8 @@ SProcXGrabDeviceKey(ClientPtr client)
swapl(&stuff->grabWindow, n);
swaps(&stuff->modifiers, n);
swaps(&stuff->event_count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->event_count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
return (ProcXGrabDeviceKey(client));
}
diff --git a/Xi/selectev.c b/Xi/selectev.c
index a5cf567..2fb8aa7 100644
--- a/Xi/selectev.c
+++ b/Xi/selectev.c
@@ -128,19 +128,16 @@ int
SProcXSelectExtensionEvent(ClientPtr client)
{
register char n;
- register long *p;
- register int i;
REQUEST(xSelectExtensionEventReq);
swaps(&stuff->length, n);
REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
swapl(&stuff->window, n);
swaps(&stuff->count, n);
- p = (long *)&stuff[1];
- for (i = 0; i < stuff->count; i++) {
- swapl(p, n);
- p++;
- }
+ REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
+ stuff->count * sizeof(CARD32));
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
+
return (ProcXSelectExtensionEvent(client));
}
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index 20b415a..5292ad2 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -80,7 +80,7 @@ int
SProcXSendExtensionEvent(ClientPtr client)
{
register char n;
- register long *p;
+ register CARD32 *p;
register int i;
xEvent eventT;
xEvent *eventP;
@@ -91,6 +91,11 @@ SProcXSendExtensionEvent(ClientPtr clien
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
swapl(&stuff->destination, n);
swaps(&stuff->count, n);
+
+ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
+ (stuff->num_events * (sizeof(xEvent) >> 2)))
+ return BadLength;
+
eventP = (xEvent *) & stuff[1];
for (i = 0; i < stuff->num_events; i++, eventP++) {
proc = EventSwapVector[eventP->u.u.type & 0177];
@@ -100,11 +105,8 @@ SProcXSendExtensionEvent(ClientPtr clien
*eventP = eventT;
}
- p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events);
- for (i = 0; i < stuff->count; i++) {
- swapl(p, n);
- p++;
- }
+ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);
+ SwapLongs(p, stuff->count);
return (ProcXSendExtensionEvent(client));
}
++++++ bug345128-IDEF2901.diff ++++++
diff -up xorg-server-1.1.1/Xext/cup.c.jx xorg-server-1.1.1/Xext/cup.c
--- xorg-server-1.1.1/Xext/cup.c.jx 2006-07-05 14:31:36.000000000 -0400
+++ xorg-server-1.1.1/Xext/cup.c 2007-12-11 14:28:37.000000000 -0500
@@ -198,6 +198,9 @@ int ProcGetReservedColormapEntries(
REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
+ if (stuff->screen >= screenInfo.numScreens)
+ return BadValue;
+
#ifndef HAVE_SPECIAL_DESKTOP_COLORS
citems[CUP_BLACK_PIXEL].pixel =
screenInfo.screens[stuff->screen]->blackPixel;
++++++ bug345130-IDEF2902.diff ++++++
diff --git a/Xext/EVI.c b/Xext/EVI.c
index 8fe3481..13bd32a 100644
--- a/Xext/EVI.c
+++ b/Xext/EVI.c
@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
#include
#include "EVIstruct.h"
#include "modinit.h"
+#include "scrnintstr.h"
#if 0
static unsigned char XEVIReqCode = 0;
@@ -87,10 +88,22 @@ ProcEVIGetVisualInfo(ClientPtr client)
{
REQUEST(xEVIGetVisualInfoReq);
xEVIGetVisualInfoReply rep;
- int n, n_conflict, n_info, sz_info, sz_conflict;
+ int i, n, n_conflict, n_info, sz_info, sz_conflict;
VisualID32 *conflict;
+ unsigned int total_visuals = 0;
xExtendedVisualInfo *eviInfo;
int status;
+
+ /*
+ * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume
+ * here that you don't have more than 2^32 visuals over all your screens;
+ * this seems like a safe assumption.
+ */
+ for (i = 0; i < screenInfo.numScreens; i++)
+ total_visuals += screenInfo.screens[i]->numVisuals;
+ if (stuff->n_visual > total_visuals)
+ return BadValue;
+
REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
&eviInfo, &n_info, &conflict, &n_conflict);
diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c
index 7508aa7..b8f39c7 100644
--- a/Xext/sampleEVI.c
+++ b/Xext/sampleEVI.c
@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
#include
#include "EVIstruct.h"
#include "scrnintstr.h"
+
+#if HAVE_STDINT_H
+#include
+#elif !defined(INT_MAX)
+#define INT_MAX 0x7fffffff
+#endif
+
static int sampleGetVisualInfo(
VisualID32 *visual,
int n_visual,
@@ -42,24 +49,36 @@ static int sampleGetVisualInfo(
VisualID32 **conflict_rn,
int *n_conflict_rn)
{
- int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+ unsigned int max_sz_evi;
VisualID32 *temp_conflict;
xExtendedVisualInfo *evi;
- int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
+ unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
- *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
- if (!*evi_rn)
- return BadAlloc;
+
+ if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
+ return BadAlloc;
+ max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
+
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
if (screenInfo.screens[scrI]->numVisuals > max_visuals)
max_visuals = screenInfo.screens[scrI]->numVisuals;
}
+
+ if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens
+ * max_visuals))
+ return BadAlloc;
max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
+
+ *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
+ if (!*evi_rn)
+ return BadAlloc;
+
temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
if (!temp_conflict) {
xfree(*evi_rn);
return BadAlloc;
}
+
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
for (visualI = 0; visualI < n_visual; visualI++) {
evi[sz_evi].core_visual_id = visual[visualI];
--- Xserver/Xext/sampleEVI.c.orig 2008-01-06 11:52:29.000000000 +0000
+++ Xserver/Xext/sampleEVI.c 2008-01-06 11:53:24.000000000 +0000
@@ -37,11 +37,7 @@
#include "EVIstruct.h"
#include "scrnintstr.h"
-#if HAVE_STDINT_H
#include
-#elif !defined(INT_MAX)
-#define INT_MAX 0x7fffffff
-#endif
static int sampleGetVisualInfo(
VisualID32 *visual,
++++++ bug345131-IDEF2904.diff ++++++
diff --git a/Xext/shm.c b/Xext/shm.c
index e3d7a23..c545e49 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -757,6 +757,8 @@ ProcPanoramiXShmCreatePixmap(
int i, j, result, rc;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
+ unsigned int width, height, depth;
+ unsigned long size;
PanoramiXRes *newPix;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
@@ -770,11 +772,26 @@ ProcPanoramiXShmCreatePixmap(
return rc;
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
- if (!stuff->width || !stuff->height)
+
+ width = stuff->width;
+ height = stuff->height;
+ depth = stuff->depth;
+ if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
+ if (width > 32767 || height > 32767)
+ return BadAlloc;
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(size) == 4) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
@@ -785,9 +802,7 @@ ProcPanoramiXShmCreatePixmap(
return BadValue;
}
CreatePmap:
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
- client);
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
return BadAlloc;
@@ -1086,6 +1101,8 @@ ProcShmCreatePixmap(client)
register int i, rc;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
+ unsigned int width, height, depth;
+ unsigned long size;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
client->errorValue = stuff->pid;
@@ -1098,11 +1115,26 @@ ProcShmCreatePixmap(client)
return rc;
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
- if (!stuff->width || !stuff->height)
+
+ width = stuff->width;
+ height = stuff->height;
+ depth = stuff->depth;
+ if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
+ if (width > 32767 || height > 32767)
+ return BadAlloc;
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(size) == 4) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
@@ -1113,9 +1145,7 @@ ProcShmCreatePixmap(client)
return BadValue;
}
CreatePmap:
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
- client);
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
pDraw->pScreen, stuff->width,
stuff->height, stuff->depth,
diff --git a/Xext/shm.c b/Xext/shm.c
index c545e49..e46f6fc 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -783,14 +783,6 @@ ProcPanoramiXShmCreatePixmap(
}
if (width > 32767 || height > 32767)
return BadAlloc;
- size = PixmapBytePad(width, depth) * height;
- if (sizeof(size) == 4) {
- if (size < width * height)
- return BadAlloc;
- /* thankfully, offset is unsigned */
- if (stuff->offset + size < size)
- return BadAlloc;
- }
if (stuff->depth != 1)
{
@@ -801,7 +793,17 @@ ProcPanoramiXShmCreatePixmap(
client->errorValue = stuff->depth;
return BadValue;
}
+
CreatePmap:
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
@@ -1126,14 +1128,6 @@ ProcShmCreatePixmap(client)
}
if (width > 32767 || height > 32767)
return BadAlloc;
- size = PixmapBytePad(width, depth) * height;
- if (sizeof(size) == 4) {
- if (size < width * height)
- return BadAlloc;
- /* thankfully, offset is unsigned */
- if (stuff->offset + size < size)
- return BadAlloc;
- }
if (stuff->depth != 1)
{
@@ -1144,7 +1138,17 @@ ProcShmCreatePixmap(client)
client->errorValue = stuff->depth;
return BadValue;
}
+
CreatePmap:
+ size = PixmapBytePad(width, depth) * height;
+ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
+ if (size < width * height)
+ return BadAlloc;
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
+ }
+
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
pDraw->pScreen, stuff->width,
diff --git a/Xext/shm.c b/Xext/shm.c
index e46f6fc..a7a1ecf 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -799,10 +799,10 @@ CreatePmap:
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
- /* thankfully, offset is unsigned */
- if (stuff->offset + size < size)
- return BadAlloc;
}
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
@@ -1144,10 +1144,10 @@ CreatePmap:
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
- /* thankfully, offset is unsigned */
- if (stuff->offset + size < size)
- return BadAlloc;
}
+ /* thankfully, offset is unsigned */
+ if (stuff->offset + size < size)
+ return BadAlloc;
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
++++++ bug348296-pcf_font_parser.diff ++++++
--- dix/dixfonts.c.orig Thu Nov 16 10:01:22 2006
+++ dix/dixfonts.c Tue Dec 18 17:16:22 2007
@@ -329,6 +329,13 @@
err = BadFontName;
goto bail;
}
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
+ if (pfont->info.firstCol > pfont->info.lastCol ||
+ pfont->info.firstRow > pfont->info.lastRow ||
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
+ err = AllocError;
+ goto bail;
+ }
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Remember to have fun...
---------------------------------------------------------------------
To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-commit+help@opensuse.org