Attachment 13099 Details for Bug 13520 – proposed fix - for both functions..

[patch] proposed fix - for both functions..

freedesktop-bug-13520.patch (text/plain), 2.98 KB, created by Dave Airlie on 2007-12-13 19:13:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dave Airlie

Created: 2007-12-13 19:13:54 UTC

Size: 2.98 KB

patch

obsolete

>--- xorg-server-1.1.1/Xext/shm.c.freedesktop-bug-13520	2006-07-06 04:31:36.000000000 +1000
>+++ xorg-server-1.1.1/Xext/shm.c	2007-12-14 13:08:59.000000000 +1000
>@@ -725,6 +725,8 @@
>     int i, j, result;
>     ShmDescPtr shmdesc;
>     REQUEST(xShmCreatePixmapReq);
>+    unsigned int width, height, depth;
>+    unsigned long size;
>     PanoramiXRes *newPix;
> 
>     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
>@@ -734,11 +736,26 @@
>     LEGAL_NEW_RESOURCE(stuff->pid, client);
>     VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
>     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
>-    if (!stuff->width || !stuff->height)
>+
>+    width = stuff->width;
>+    height = stuff->height;
>+    depth = stuff->depth;
>+    if (!width || !height || !depth)
>     {
> 	client->errorValue = 0;
>         return BadValue;
>     }
>+    if (width > 32767 || height > 32767)
>+        return BadAlloc;
>+    size = PixmapBytePad(width, depth) * height;
>+    if (sizeof(size) == 4) {
>+        if (size < width * height)
>+            return BadAlloc;
>+        /* thankfully, offset is unsigned */
>+        if (stuff->offset + size < size)
>+            return BadAlloc;
>+    }
>+
>     if (stuff->depth != 1)
>     {
>         pDepth = pDraw->pScreen->allowedDepths;
>@@ -749,9 +766,7 @@
>         return BadValue;
>     }
> CreatePmap:
>-    VERIFY_SHMSIZE(shmdesc, stuff->offset,
>-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
>-		   client);
>+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
> 
>     if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
> 	return BadAlloc;
>@@ -1049,6 +1064,8 @@
>     register int i;
>     ShmDescPtr shmdesc;
>     REQUEST(xShmCreatePixmapReq);
>+    unsigned int width, height, depth;
>+    unsigned long size;
> 
>     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
>     client->errorValue = stuff->pid;
>@@ -1057,11 +1074,26 @@
>     LEGAL_NEW_RESOURCE(stuff->pid, client);
>     VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
>     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
>-    if (!stuff->width || !stuff->height)
>+    
>+    width = stuff->width;
>+    height = stuff->height;
>+    depth = stuff->depth;
>+    if (!width || !height || !depth)
>     {
> 	client->errorValue = 0;
>         return BadValue;
>     }
>+    if (width > 32767 || height > 32767)
>+	return BadAlloc;
>+    size = PixmapBytePad(width, depth) * height;
>+    if (sizeof(size) == 4) {
>+	if (size < width * height)
>+	    return BadAlloc;
>+	/* thankfully, offset is unsigned */
>+	if (stuff->offset + size < size)
>+	    return BadAlloc;
>+    }
>+
>     if (stuff->depth != 1)
>     {
>         pDepth = pDraw->pScreen->allowedDepths;
>@@ -1072,9 +1104,7 @@
>         return BadValue;
>     }
> CreatePmap:
>-    VERIFY_SHMSIZE(shmdesc, stuff->offset,
>-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
>-		   client);
>+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
>     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
> 			    pDraw->pScreen, stuff->width,
> 			    stuff->height, stuff->depth,

Actions: View | Splinter Review

Attachments on bug 13520: 12941 | 13034 | 13099 | 13178 | 13779

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.