100 lines
3.1 KiB
Text
100 lines
3.1 KiB
Text
$NetBSD: patch-ef,v 1.1 2008/02/25 15:39:16 joerg Exp $
|
|
|
|
--- Xext/shm.c.orig 2008-02-25 15:43:05.000000000 +0100
|
|
+++ Xext/shm.c
|
|
@@ -723,6 +723,8 @@ ProcPanoramiXShmCreatePixmap(
|
|
int i, j, result;
|
|
ShmDescPtr shmdesc;
|
|
REQUEST(xShmCreatePixmapReq);
|
|
+ unsigned int width, height, depth;
|
|
+ unsigned long size;
|
|
PanoramiXRes *newPix;
|
|
|
|
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
|
|
@@ -732,11 +734,26 @@ ProcPanoramiXShmCreatePixmap(
|
|
LEGAL_NEW_RESOURCE(stuff->pid, client);
|
|
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
|
|
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
|
|
- if (!stuff->width || !stuff->height)
|
|
+
|
|
+ width = stuff->width;
|
|
+ height = stuff->height;
|
|
+ depth = stuff->depth;
|
|
+ if (!width || !height || !depth)
|
|
{
|
|
client->errorValue = 0;
|
|
return BadValue;
|
|
}
|
|
+ if (width > 32767 || height > 32767)
|
|
+ return BadAlloc;
|
|
+ size = PixmapBytePad(width, depth) * height;
|
|
+ if (sizeof(size) == 4) {
|
|
+ if (size < width * height)
|
|
+ return BadAlloc;
|
|
+ /* thankfully, offset is unsigned */
|
|
+ if (stuff->offset + size < size)
|
|
+ return BadAlloc;
|
|
+ }
|
|
+
|
|
if (stuff->depth != 1)
|
|
{
|
|
pDepth = pDraw->pScreen->allowedDepths;
|
|
@@ -747,9 +764,7 @@ ProcPanoramiXShmCreatePixmap(
|
|
return BadValue;
|
|
}
|
|
CreatePmap:
|
|
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
|
|
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
|
|
- client);
|
|
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
|
|
|
|
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
|
|
return BadAlloc;
|
|
@@ -1047,6 +1062,8 @@ ProcShmCreatePixmap(client)
|
|
register int i;
|
|
ShmDescPtr shmdesc;
|
|
REQUEST(xShmCreatePixmapReq);
|
|
+ unsigned int width, height, depth;
|
|
+ unsigned long size;
|
|
|
|
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
|
|
client->errorValue = stuff->pid;
|
|
@@ -1055,11 +1072,26 @@ ProcShmCreatePixmap(client)
|
|
LEGAL_NEW_RESOURCE(stuff->pid, client);
|
|
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
|
|
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
|
|
- if (!stuff->width || !stuff->height)
|
|
+
|
|
+ width = stuff->width;
|
|
+ height = stuff->height;
|
|
+ depth = stuff->depth;
|
|
+ if (!width || !height || !depth)
|
|
{
|
|
client->errorValue = 0;
|
|
return BadValue;
|
|
}
|
|
+ if (width > 32767 || height > 32767)
|
|
+ return BadAlloc;
|
|
+ size = PixmapBytePad(width, depth) * height;
|
|
+ if (sizeof(size) == 4) {
|
|
+ if (size < width * height)
|
|
+ return BadAlloc;
|
|
+ /* thankfully, offset is unsigned */
|
|
+ if (stuff->offset + size < size)
|
|
+ return BadAlloc;
|
|
+ }
|
|
+
|
|
if (stuff->depth != 1)
|
|
{
|
|
pDepth = pDraw->pScreen->allowedDepths;
|
|
@@ -1070,9 +1102,7 @@ ProcShmCreatePixmap(client)
|
|
return BadValue;
|
|
}
|
|
CreatePmap:
|
|
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
|
|
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
|
|
- client);
|
|
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
|
|
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
|
|
pDraw->pScreen, stuff->width,
|
|
stuff->height, stuff->depth,
|