diff options
Diffstat (limited to 'x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495')
| -rw-r--r-- | x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495 | 397 |
1 files changed, 270 insertions, 127 deletions
diff --git a/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495 b/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495 index e6ac39da8a48..672d7b7e6222 100644 --- a/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495 +++ b/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495 @@ -1,169 +1,312 @@ ---- programs/Xserver/afb/afbpixmap.c.orig Tue Jun 3 16:11:07 1997 -+++ programs/Xserver/afb/afbpixmap.c Tue Sep 6 16:26:35 2005 -@@ -73,10 +73,14 @@ afbCreatePixmap(pScreen, width, height, - int depth; - { - PixmapPtr pPixmap; -- int datasize; -- int paddedWidth; -+ size_t datasize; -+ size_t paddedWidth; +Index: programs/Xserver/afb/afbpixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/afb/afbpixmap.c,v +retrieving revision 3.1 +retrieving revision 3.1.20.1 +diff -u -r3.1 -r3.1.20.1 +--- programs/Xserver/afb/afbpixmap.c 3 Jun 1997 14:11:07 -0000 3.1 ++++ programs/Xserver/afb/afbpixmap.c 18 Sep 2005 00:20:57 -0000 3.1.20.1 +@@ -76,6 +76,9 @@ + int datasize; + int paddedWidth; - paddedWidth = BitmapBytePad(width); ++ if ((width > MAXSHORT) || (height > MAXSHORT)) ++ return NullPixmap; + -+ if (paddedWidth > 32767 || height > 32767) -+ return NullPixmap; -+ + paddedWidth = BitmapBytePad(width); datasize = height * paddedWidth * depth; pPixmap = AllocatePixmap(pScreen, datasize); - if (!pPixmap) ---- programs/Xserver/cfb/cfbpixmap.c.orig Fri Dec 14 20:59:23 2001 -+++ programs/Xserver/cfb/cfbpixmap.c Tue Sep 6 16:26:35 2005 -@@ -70,10 +70,13 @@ cfbCreatePixmap (pScreen, width, height, - int depth; - { - PixmapPtr pPixmap; -- int datasize; -- int paddedWidth; -+ size_t datasize; -+ size_t paddedWidth; +Index: programs/Xserver/cfb/cfbpixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/cfb/cfbpixmap.c,v +retrieving revision 1.5 +retrieving revision 1.5.8.1 +diff -u -r1.5 -r1.5.8.1 +--- programs/Xserver/cfb/cfbpixmap.c 14 Dec 2001 19:59:23 -0000 1.5 ++++ programs/Xserver/cfb/cfbpixmap.c 18 Sep 2005 00:20:57 -0000 1.5.8.1 +@@ -73,6 +72,9 @@ + int datasize; + int paddedWidth; - paddedWidth = PixmapBytePad(width, depth); -+ -+ if (paddedWidth > 32767 || height > 32767) ++ if ((width > MAXSHORT) || (height > MAXSHORT)) + return NullPixmap; ++ + paddedWidth = PixmapBytePad(width, depth); datasize = height * paddedWidth; pPixmap = AllocatePixmap(pScreen, datasize); +Index: programs/Xserver/dix/pixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/dix/pixmap.c,v +retrieving revision 3.5 +retrieving revision 3.5.8.1 +diff -u -r3.5 -r3.5.8.1 +--- programs/Xserver/dix/pixmap.c 14 Dec 2001 19:59:32 -0000 3.5 ++++ programs/Xserver/dix/pixmap.c 18 Sep 2005 00:20:58 -0000 3.5.8.1 +@@ -126,7 +125,9 @@ + unsigned size; + int i; + +- pPixmap = (PixmapPtr)xalloc(pScreen->totalPixmapSize + pixDataSize); ++ if (((unsigned)(-1) - pScreen->totalPixmapSize) < (unsigned)pixDataSize) ++ return NullPixmap; ++ pPixmap = xalloc(pScreen->totalPixmapSize + (unsigned)pixDataSize); if (!pPixmap) ---- programs/Xserver/dix/dispatch.c.orig Wed Jun 23 21:40:15 2004 -+++ programs/Xserver/dix/dispatch.c Tue Sep 6 16:26:35 2005 -@@ -1483,6 +1483,23 @@ ProcCreatePixmap(client) - client->errorValue = 0; - return BadValue; + return NullPixmap; + ppriv = (DevUnion *)(pPixmap + 1); +@@ -144,7 +145,7 @@ + ppriv->ptr = (pointer)NULL; } -+ if (stuff->width > 32767 || stuff->height > 32767) -+ { -+ /* It is allowed to try and allocate a pixmap which is larger than -+ * 32767 in either dimension. However, all of the framebuffer code -+ * is buggy and does not reliably draw to such big pixmaps, basically -+ * because the Region data structure operates with signed shorts -+ * for the rectangles in it. -+ * -+ * Furthermore, several places in the X server computes the -+ * size in bytes of the pixmap and tries to store it in an -+ * integer. This integer can overflow and cause the allocated size -+ * to be much smaller. -+ * -+ * So, such big pixmaps are rejected here with a BadAlloc -+ */ -+ return BadAlloc; -+ } - if (stuff->depth != 1) - { - pDepth = pDraw->pScreen->allowedDepths; ---- programs/Xserver/fb/fbpixmap.c.orig Mon Sep 16 20:05:34 2002 -+++ programs/Xserver/fb/fbpixmap.c Tue Sep 6 16:26:35 2005 -@@ -32,12 +32,14 @@ PixmapPtr - fbCreatePixmapBpp (ScreenPtr pScreen, int width, int height, int depth, int bpp) - { - PixmapPtr pPixmap; -- int datasize; -- int paddedWidth; -+ size_t datasize; -+ size_t paddedWidth; + #else +- pPixmap = (PixmapPtr)xalloc(sizeof(PixmapRec) + pixDataSize); ++ pPixmap = xalloc(sizeof(PixmapRec) + (unsigned)pixDataSize); + #endif + return pPixmap; + } +Index: programs/Xserver/fb/fbpixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/fb/fbpixmap.c,v +retrieving revision 1.11 +retrieving revision 1.11.6.1 +diff -u -r1.11 -r1.11.6.1 +--- programs/Xserver/fb/fbpixmap.c 16 Sep 2002 18:05:34 -0000 1.11 ++++ programs/Xserver/fb/fbpixmap.c 18 Sep 2005 00:20:58 -0000 1.11.6.1 +@@ -37,6 +37,9 @@ int adjust; int base; - paddedWidth = ((width * bpp + FB_MASK) >> FB_SHIFT) * sizeof (FbBits); -+ if (paddedWidth > 32767 || height > 32767) ++ if ((width > MAXSHORT) || (height > MAXSHORT)) + return NullPixmap; ++ + paddedWidth = ((width * bpp + FB_MASK) >> FB_SHIFT) * sizeof (FbBits); datasize = height * paddedWidth; #ifdef PIXPRIV - base = pScreen->totalPixmapSize; ---- programs/Xserver/hw/xfree86/xaa/xaaInit.c.orig Thu Jul 19 20:50:16 2001 -+++ programs/Xserver/hw/xfree86/xaa/xaaInit.c Tue Sep 6 16:26:35 2005 -@@ -480,6 +480,9 @@ XAACreatePixmap(ScreenPtr pScreen, int w +Index: programs/Xserver/hw/xfree86/xaa/xaaInit.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/hw/xfree86/xaa/xaaInit.c,v +retrieving revision 1.35 +retrieving revision 1.35.10.1 +diff -u -r1.35 -r1.35.10.1 +--- programs/Xserver/hw/xfree86/xaa/xaaInit.c 19 Jul 2001 18:50:16 -0000 1.35 ++++ programs/Xserver/hw/xfree86/xaa/xaaInit.c 18 Sep 2005 00:20:59 -0000 1.35.10.1 +@@ -479,8 +479,12 @@ + ScrnInfoPtr pScrn = xf86Screens[pScreen->myNum]; XAAPixmapPtr pPriv; PixmapPtr pPix = NULL; - int size = w * h; +- int size = w * h; ++ int size; + -+ if (w > 32767 || h > 32767) ++ if ((w > MAXSHORT) || (h > MAXSHORT)) + return NullPixmap; ++ size = w * h; if (!infoRec->offscreenDepthsInitialized) XAAInitializeOffscreenDepths (pScreen); ---- programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c.orig Thu Apr 27 18:26:49 2000 -+++ programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c Tue Sep 6 16:26:35 2005 -@@ -85,14 +85,18 @@ xf4bppCreatePixmap( pScreen, width, heig - int depth ; - { - register PixmapPtr pPixmap = (PixmapPtr)NULL; -- int size ; -+ size_t size ; + +Index: programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c,v +retrieving revision 1.5 +retrieving revision 1.5.14.1 +diff -u -r1.5 -r1.5.14.1 +--- programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c 27 Apr 2000 16:26:49 -0000 1.5 ++++ programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c 18 Sep 2005 00:21:00 -0000 1.5.14.1 +@@ -89,8 +89,8 @@ TRACE(("xf4bppCreatePixmap(pScreen=0x%x, width=%d, height=%d, depth=%d)\n", pScreen, width, height, depth)) ; - if ( depth > 8 ) - return (PixmapPtr) NULL ; +- if ( depth > 8 ) +- return (PixmapPtr) NULL ; ++ if ((depth > 8) || (width > MAXSHORT) || (height > MAXSHORT)) ++ return NullPixmap; -+ if (width > 32767 || height > 32767) -+ return (PixmapPtr) NULL ; -+ size = PixmapBytePad(width, depth); -+ pPixmap = AllocatePixmap (pScreen, (height * size)); - - if ( !pPixmap ) ---- programs/Xserver/ilbm/ilbmpixmap.c.orig Sun Aug 18 03:54:01 1996 -+++ programs/Xserver/ilbm/ilbmpixmap.c Tue Sep 6 16:26:35 2005 -@@ -75,10 +75,12 @@ ilbmCreatePixmap(pScreen, width, height, - int depth; - { - PixmapPtr pPixmap; -- int datasize; -- int paddedWidth; -+ size_t datasize; -+ size_t paddedWidth; +Index: programs/Xserver/ilbm/ilbmpixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/ilbm/ilbmpixmap.c,v +retrieving revision 3.0 +retrieving revision 3.0.26.1 +diff -u -r3.0 -r3.0.26.1 +--- programs/Xserver/ilbm/ilbmpixmap.c 18 Aug 1996 01:54:01 -0000 3.0 ++++ programs/Xserver/ilbm/ilbmpixmap.c 18 Sep 2005 00:21:00 -0000 3.0.26.1 +@@ -78,6 +78,9 @@ + int datasize; + int paddedWidth; - paddedWidth = BitmapBytePad(width); -+ if (paddedWidth > 32767 || height > 32767) ++ if ((width > MAXSHORT) || (height > MAXSHORT)) + return NullPixmap; ++ + paddedWidth = BitmapBytePad(width); datasize = height * paddedWidth * depth; pPixmap = AllocatePixmap(pScreen, datasize); - if (!pPixmap) ---- programs/Xserver/iplan2p4/iplpixmap.c.orig Mon Dec 17 21:00:46 2001 -+++ programs/Xserver/iplan2p4/iplpixmap.c Tue Sep 6 16:26:35 2005 -@@ -74,12 +74,14 @@ iplCreatePixmap (pScreen, width, height, - int depth; - { +Index: programs/Xserver/iplan2p4/iplpixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/iplan2p4/iplpixmap.c,v +retrieving revision 3.1 +retrieving revision 3.1.8.1 +diff -u -r3.1 -r3.1.8.1 +--- programs/Xserver/iplan2p4/iplpixmap.c 17 Dec 2001 20:00:46 -0000 3.1 ++++ programs/Xserver/iplan2p4/iplpixmap.c 18 Sep 2005 00:21:00 -0000 3.1.8.1 +@@ -76,8 +76,12 @@ PixmapPtr pPixmap; -- int datasize; -- int paddedWidth; -+ size_t datasize; -+ size_t paddedWidth; - int ipad=INTER_PLANES*2 - 1; + int datasize; + int paddedWidth; +- int ipad=INTER_PLANES*2 - 1; ++ int ipad; ++ if ((width > MAXSHORT) || (height > MAXSHORT)) ++ return NullPixmap; ++ ++ ipad = INTER_PLANES*2 - 1; paddedWidth = PixmapBytePad(width, depth); paddedWidth = (paddedWidth + ipad) & ~ipad; -+ if (paddedWidth > 32767 || height > 32767) -+ return NullPixmap; datasize = height * paddedWidth; - pPixmap = AllocatePixmap(pScreen, datasize); - if (!pPixmap) ---- programs/Xserver/mfb/mfbpixmap.c.orig Fri Dec 14 21:00:10 2001 -+++ programs/Xserver/mfb/mfbpixmap.c Tue Sep 6 16:26:35 2005 -@@ -72,10 +72,12 @@ mfbCreatePixmap (pScreen, width, height, - int depth; - { - PixmapPtr pPixmap; -- int datasize; -- int paddedWidth; -+ size_t datasize; -+ size_t paddedWidth; +Index: programs/Xserver/mfb/mfbpixmap.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/mfb/mfbpixmap.c,v +retrieving revision 1.2 +retrieving revision 1.2.8.1 +diff -u -r1.2 -r1.2.8.1 +--- programs/Xserver/mfb/mfbpixmap.c 14 Dec 2001 20:00:10 -0000 1.2 ++++ programs/Xserver/mfb/mfbpixmap.c 18 Sep 2005 00:21:00 -0000 1.2.8.1 +@@ -44,7 +45,6 @@ + SOFTWARE. - if (depth != 1) -+ return NullPixmap; -+ if (width > 32767 || height > 32767) + ******************************************************************/ +-/* $Xorg: mfbpixmap.c,v 1.4 2001/02/09 02:05:19 xorgcvs Exp $ */ + + /* pixmap management + written by drewry, september 1986 +@@ -75,8 +75,9 @@ + int datasize; + int paddedWidth; + +- if (depth != 1) ++ if ((depth != 1) || (width > MAXSHORT) || (height > MAXSHORT)) return NullPixmap; ++ paddedWidth = BitmapBytePad(width); datasize = height * paddedWidth; + pPixmap = AllocatePixmap(pScreen, datasize); +Index: programs/Xserver/os/utils.c +=================================================================== +RCS file: /cvs/xc/programs/Xserver/os/utils.c,v +retrieving revision 3.102 +retrieving revision 3.102.2.1 +diff -u -r3.102 -r3.102.2.1 +--- programs/Xserver/os/utils.c 3 Feb 2005 02:01:14 -0000 3.102 ++++ programs/Xserver/os/utils.c 18 Sep 2005 00:21:00 -0000 3.102.2.1 +@@ -1243,19 +1243,19 @@ + void * + Xalloc(unsigned long amount) + { +- register pointer ptr; +- +- if ((long)amount <= 0) +- return NULL; ++ pointer ptr; + + /* aligned extra on long word boundary */ + amount = (amount + (sizeof(long) - 1)) & ~(sizeof(long) - 1); ++ ++ if ((long)amount <= 0) ++ return NULL; + #ifdef MEMBUG + if (!Must_have_memory && Memory_fail && + ((random() % MEM_FAIL_SCALE) < Memory_fail)) + return NULL; + #endif +- if ((ptr = (pointer)malloc(amount))) { ++ if ((ptr = malloc(amount))) { + return ptr; + } + if (Must_have_memory) +@@ -1273,12 +1273,16 @@ + { + register pointer ptr; + +- if ((long)amount <= 0) +- return NULL; ++ if (amount == 0) ++ return NULL; + + /* aligned extra on long word boundary */ + amount = (amount + (sizeof(long) - 1)) & ~(sizeof(long) - 1); +- ptr = (pointer)malloc(amount); ++ ++ if ((long)amount <= 0) ++ FatalError("Bad request for memory"); ++ ++ ptr = malloc(amount); + if (!ptr) + FatalError("Out of memory"); + +@@ -1292,11 +1296,11 @@ + void * + Xcalloc(unsigned long amount) + { +- unsigned long *ret; ++ pointer ret; + +- ret = Xalloc (amount); ++ ret = Xalloc(amount); + if (ret) +- bzero ((void *) ret, (int) amount); ++ bzero (ret, (int) amount); + return ret; + } + +@@ -1307,13 +1311,17 @@ + void * + XNFcalloc(unsigned long amount) + { +- unsigned long *ret; ++ pointer ret; + +- ret = Xalloc (amount); +- if (ret) +- bzero ((char *) ret, (int) amount); +- else if ((long)amount > 0) ++ if (amount == 0) ++ return NULL; ++ ++ ret = Xalloc(amount); ++ if (!ret) + FatalError("Out of memory"); ++ ++ bzero (ret, (int) amount); ++ + return ret; + } + +@@ -1336,10 +1344,12 @@ + return NULL; + } + amount = (amount + (sizeof(long) - 1)) & ~(sizeof(long) - 1); ++ if ((long)amount <= 0) ++ return NULL; + if (ptr) +- ptr = (pointer)realloc((char *)ptr, amount); ++ ptr = realloc(ptr, amount); + else +- ptr = (pointer)malloc(amount); ++ ptr = malloc(amount); + if (ptr) + return ptr; + if (Must_have_memory) +@@ -1355,12 +1365,12 @@ + void * + XNFrealloc(pointer ptr, unsigned long amount) + { +- if (( ptr = (pointer)Xrealloc( ptr, amount ) ) == NULL) ++ if ((ptr = Xrealloc(ptr, amount)) == NULL) + { +- if ((long)amount > 0) ++ if (amount != 0) + FatalError( "Out of memory" ); + } +- return ((unsigned long *)ptr); ++ return ptr; + } + + /***************** |