Attachment 38062 Details for Bug 28823 – check request lengths before swapping

[patch] check request lengths before swapping

0004-glx-check-request-length-before-swapping.patch (text/plain), 19.29 KB, created by Julien Cristau on 2010-08-22 08:32:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Julien Cristau

Created: 2010-08-22 08:32:18 UTC

Size: 19.29 KB

patch

obsolete

>From 2525fb6d1d23220d98c2f8223e11cce58959b72c Mon Sep 17 00:00:00 2001
>From: Julien Cristau <jcristau@debian.org>
>Date: Sun, 22 Aug 2010 00:50:05 +0100
>Subject: [PATCH 4/5] glx: check request length before swapping
>
>Signed-off-by: Julien Cristau <jcristau@debian.org>
>---
> glx/glxcmdsswap.c |  135 +++++++++++++++++++++++++++++++++++++++++++++++++++--
> 1 files changed, 130 insertions(+), 5 deletions(-)
>
>diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
>index c414dc8..cca9843 100644
>--- a/glx/glxcmdsswap.c
>+++ b/glx/glxcmdsswap.c
>@@ -61,9 +61,12 @@
> 
> int __glXDispSwap_CreateContext(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreateContextReq *req = (xGLXCreateContextReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXCreateContextReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->context);
>     __GLX_SWAP_INT(&req->visual);
>@@ -75,9 +78,12 @@ int __glXDispSwap_CreateContext(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CreateNewContext(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreateNewContextReq *req = (xGLXCreateNewContextReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXCreateNewContextReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->context);
>     __GLX_SWAP_INT(&req->fbconfig);
>@@ -90,10 +96,13 @@ int __glXDispSwap_CreateNewContext(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CreateContextWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreateContextWithConfigSGIXReq *req =
> 	(xGLXCreateContextWithConfigSGIXReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXCreateContextWithConfigSGIXReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->context);
>     __GLX_SWAP_INT(&req->fbconfig);
>@@ -106,9 +115,12 @@ int __glXDispSwap_CreateContextWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_DestroyContext(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXDestroyContextReq *req = (xGLXDestroyContextReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXDestroyContextReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->context);
> 
>@@ -117,9 +129,12 @@ int __glXDispSwap_DestroyContext(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_MakeCurrent(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXMakeCurrentReq *req = (xGLXMakeCurrentReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXMakeCurrentReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->drawable);
>     __GLX_SWAP_INT(&req->context);
>@@ -130,9 +145,12 @@ int __glXDispSwap_MakeCurrent(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_MakeContextCurrent(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXMakeContextCurrentReq *req = (xGLXMakeContextCurrentReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXMakeContextCurrentReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->drawable);
>     __GLX_SWAP_INT(&req->readdrawable);
>@@ -144,9 +162,12 @@ int __glXDispSwap_MakeContextCurrent(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_MakeCurrentReadSGI(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXMakeCurrentReadSGIReq *req = (xGLXMakeCurrentReadSGIReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXMakeCurrentReadSGIReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->drawable);
>     __GLX_SWAP_INT(&req->readable);
>@@ -158,9 +179,12 @@ int __glXDispSwap_MakeCurrentReadSGI(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_IsDirect(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXIsDirectReq *req = (xGLXIsDirectReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXIsDirectReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->context);
> 
>@@ -169,9 +193,12 @@ int __glXDispSwap_IsDirect(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_QueryVersion(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXQueryVersionReq *req = (xGLXQueryVersionReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXQueryVersionReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->majorVersion);
>     __GLX_SWAP_INT(&req->minorVersion);
>@@ -181,9 +208,12 @@ int __glXDispSwap_QueryVersion(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_WaitGL(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXWaitGLReq *req = (xGLXWaitGLReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXWaitGLReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->contextTag);
> 
>@@ -192,9 +222,12 @@ int __glXDispSwap_WaitGL(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_WaitX(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXWaitXReq *req = (xGLXWaitXReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXWaitXReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->contextTag);
> 
>@@ -203,9 +236,12 @@ int __glXDispSwap_WaitX(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CopyContext(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCopyContextReq *req = (xGLXCopyContextReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXCopyContextReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->source);
>     __GLX_SWAP_INT(&req->dest);
>@@ -216,36 +252,48 @@ int __glXDispSwap_CopyContext(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_GetVisualConfigs(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXGetVisualConfigsReq *req = (xGLXGetVisualConfigsReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXGetVisualConfigsReq);
>+
>     __GLX_SWAP_INT(&req->screen);
>     return __glXDisp_GetVisualConfigs(cl, pc);
> }
> 
> int __glXDispSwap_GetFBConfigs(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXGetFBConfigsReq *req = (xGLXGetFBConfigsReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXGetFBConfigsReq);
>+
>     __GLX_SWAP_INT(&req->screen);
>     return __glXDisp_GetFBConfigs(cl, pc);
> }
> 
> int __glXDispSwap_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
>+
>     __GLX_SWAP_INT(&req->screen);
>     return __glXDisp_GetFBConfigsSGIX(cl, pc);
> }
> 
> int __glXDispSwap_CreateGLXPixmap(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreateGLXPixmapReq *req = (xGLXCreateGLXPixmapReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXCreateGLXPixmapReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->screen);
>     __GLX_SWAP_INT(&req->visual);
>@@ -257,17 +305,22 @@ int __glXDispSwap_CreateGLXPixmap(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CreatePixmap(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreatePixmapReq *req = (xGLXCreatePixmapReq *) pc;
>     CARD32 *attribs;
>     __GLX_DECLARE_SWAP_VARIABLES;
>     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXCreatePixmapReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->screen);
>     __GLX_SWAP_INT(&req->fbconfig);
>     __GLX_SWAP_INT(&req->pixmap);
>     __GLX_SWAP_INT(&req->glxpixmap);
>     __GLX_SWAP_INT(&req->numAttribs);
>+
>+    REQUEST_FIXED_SIZE(xGLXCreatePixmapReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
> 
>@@ -276,10 +329,13 @@ int __glXDispSwap_CreatePixmap(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CreateGLXPixmapWithConfigSGIX(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreateGLXPixmapWithConfigSGIXReq *req = 
> 	(xGLXCreateGLXPixmapWithConfigSGIXReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXCreateGLXPixmapWithConfigSGIXReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->screen);
>     __GLX_SWAP_INT(&req->fbconfig);
>@@ -291,9 +347,12 @@ int __glXDispSwap_CreateGLXPixmapWithConfigSGIX(__GLXclientState *cl, GLbyte *pc
> 
> int __glXDispSwap_DestroyGLXPixmap(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->glxpixmap);
> 
>@@ -302,9 +361,12 @@ int __glXDispSwap_DestroyGLXPixmap(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->glxpixmap);
> 
>@@ -313,9 +375,12 @@ int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_QueryContext(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXQueryContextReq *req = (xGLXQueryContextReq *) pc;    
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXQueryContextReq);
>+
>     __GLX_SWAP_INT(&req->context);
> 
>     return __glXDisp_QueryContext(cl, pc);
>@@ -323,15 +388,20 @@ int __glXDispSwap_QueryContext(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CreatePbuffer(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreatePbufferReq *req = (xGLXCreatePbufferReq *) pc;    
>     __GLX_DECLARE_SWAP_VARIABLES;
>     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
>     CARD32 *attribs;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXCreatePbufferReq);
>+
>     __GLX_SWAP_INT(&req->screen);
>     __GLX_SWAP_INT(&req->fbconfig);
>     __GLX_SWAP_INT(&req->pbuffer);
>     __GLX_SWAP_INT(&req->numAttribs);
>+
>+    REQUEST_FIXED_SIZE(xGLXCreatePbufferReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
> 
>@@ -340,9 +410,12 @@ int __glXDispSwap_CreatePbuffer(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreateGLXPbufferSGIXReq *req = (xGLXCreateGLXPbufferSGIXReq *) pc;    
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXCreateGLXPbufferSGIXReq);
>+
>     __GLX_SWAP_INT(&req->screen);
>     __GLX_SWAP_INT(&req->fbconfig);
>     __GLX_SWAP_INT(&req->pbuffer);
>@@ -354,9 +427,12 @@ int __glXDispSwap_CreateGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_DestroyPbuffer(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXDestroyPbufferReq *req = (xGLXDestroyPbufferReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXDestroyPbufferReq);
>+
>     __GLX_SWAP_INT(&req->pbuffer);
> 
>     return __glXDisp_DestroyPbuffer(cl, pc);
>@@ -364,9 +440,12 @@ int __glXDispSwap_DestroyPbuffer(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_DestroyGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXDestroyGLXPbufferSGIXReq *req = (xGLXDestroyGLXPbufferSGIXReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXDestroyGLXPbufferSGIXReq);
>+
>     __GLX_SWAP_INT(&req->pbuffer);
> 
>     return __glXDisp_DestroyGLXPbufferSGIX(cl, pc);
>@@ -374,14 +453,19 @@ int __glXDispSwap_DestroyGLXPbufferSGIX(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXChangeDrawableAttributesReq *req =
> 	(xGLXChangeDrawableAttributesReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
>     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
>     CARD32 *attribs;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesReq);
>+
>     __GLX_SWAP_INT(&req->drawable);
>     __GLX_SWAP_INT(&req->numAttribs);
>+
>+    REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
> 
>@@ -391,14 +475,19 @@ int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
> int __glXDispSwap_ChangeDrawableAttributesSGIX(__GLXclientState *cl,
> 					       GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXChangeDrawableAttributesSGIXReq *req =
> 	(xGLXChangeDrawableAttributesSGIXReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
>     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
>     CARD32 *attribs;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXChangeDrawableAttributesSGIXReq);
>+
>     __GLX_SWAP_INT(&req->drawable);
>     __GLX_SWAP_INT(&req->numAttribs);
>+
>+    REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesSGIXReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
> 
>@@ -407,16 +496,21 @@ int __glXDispSwap_ChangeDrawableAttributesSGIX(__GLXclientState *cl,
> 
> int __glXDispSwap_CreateWindow(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXCreateWindowReq *req = (xGLXCreateWindowReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
>     __GLX_DECLARE_SWAP_ARRAY_VARIABLES;
>     CARD32 *attribs;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXCreateWindowReq);
>+
>     __GLX_SWAP_INT(&req->screen);
>     __GLX_SWAP_INT(&req->fbconfig);
>     __GLX_SWAP_INT(&req->window);
>     __GLX_SWAP_INT(&req->glxwindow);
>     __GLX_SWAP_INT(&req->numAttribs);
>+
>+    REQUEST_FIXED_SIZE(xGLXCreateWindowReq, req->numAttribs << 3);
>     attribs = (CARD32*)(req + 1);
>     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs);
> 
>@@ -425,9 +519,12 @@ int __glXDispSwap_CreateWindow(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
>+
>     __GLX_SWAP_INT(&req->glxwindow);
> 
>     return __glXDisp_DestroyWindow(cl, pc);
>@@ -435,9 +532,12 @@ int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_SwapBuffers(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXSwapBuffersReq *req = (xGLXSwapBuffersReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXSwapBuffersReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->contextTag);
>     __GLX_SWAP_INT(&req->drawable);
>@@ -447,9 +547,12 @@ int __glXDispSwap_SwapBuffers(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_UseXFont(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXUseXFontReq *req = (xGLXUseXFontReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXUseXFontReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->contextTag);
>     __GLX_SWAP_INT(&req->font);
>@@ -463,9 +566,12 @@ int __glXDispSwap_UseXFont(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_QueryExtensionsString(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXQueryExtensionsStringReq *req = (xGLXQueryExtensionsStringReq *)pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXQueryExtensionsStringReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->screen);
> 
>@@ -474,9 +580,12 @@ int __glXDispSwap_QueryExtensionsString(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_QueryServerString(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXQueryServerStringReq *req = (xGLXQueryServerStringReq *)pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXQueryServerStringReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->screen);
>     __GLX_SWAP_INT(&req->name);
>@@ -486,9 +595,12 @@ int __glXDispSwap_QueryServerString(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_ClientInfo(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXClientInfoReq *req = (xGLXClientInfoReq *)pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_AT_LEAST_SIZE(xGLXClientInfoReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->major);
>     __GLX_SWAP_INT(&req->minor);
>@@ -499,9 +611,12 @@ int __glXDispSwap_ClientInfo(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_QueryContextInfoEXT(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXQueryContextInfoEXTReq *req = (xGLXQueryContextInfoEXTReq *) pc;
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXQueryContextInfoEXTReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->context);
> 
>@@ -510,12 +625,14 @@ int __glXDispSwap_QueryContextInfoEXT(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
>     GLXDrawable		 *drawId;
>     int			 *buffer;
>-    
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8);
>+
>     pc += __GLX_VENDPRIV_HDR_SIZE;
> 
>     drawId = ((GLXDrawable *) (pc));
>@@ -531,12 +648,14 @@ int __glXDispSwap_BindTexImageEXT(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_ReleaseTexImageEXT(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
>     GLXDrawable		 *drawId;
>     int			 *buffer;
>-    
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 8);
>+
>     pc += __GLX_VENDPRIV_HDR_SIZE;
> 
>     drawId = ((GLXDrawable *) (pc));
>@@ -552,12 +671,14 @@ int __glXDispSwap_ReleaseTexImageEXT(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_CopySubBufferMESA(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXVendorPrivateReq *req = (xGLXVendorPrivateReq *) pc;
>     GLXDrawable		 *drawId;
>     int			 *buffer;
>-
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_FIXED_SIZE(xGLXVendorPrivateReq, 20);
>+
>     (void) drawId;
>     (void) buffer;
> 
>@@ -577,11 +698,13 @@ int __glXDispSwap_CopySubBufferMESA(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_GetDrawableAttributesSGIX(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXVendorPrivateWithReplyReq *req = (xGLXVendorPrivateWithReplyReq *)pc;
>     CARD32 *data;
>-    
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesSGIXReq);
>+
>     data = (CARD32 *) (req + 1);
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->contextTag);
>@@ -592,10 +715,12 @@ int __glXDispSwap_GetDrawableAttributesSGIX(__GLXclientState *cl, GLbyte *pc)
> 
> int __glXDispSwap_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
> {
>+    ClientPtr client = cl->client;
>     xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc;
>-    
>     __GLX_DECLARE_SWAP_VARIABLES;
> 
>+    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
>+
>     __GLX_SWAP_SHORT(&req->length);
>     __GLX_SWAP_INT(&req->drawable);
> 
>-- 
>1.7.1
>

Actions: View | Splinter Review

Attachments on bug 28823: 36729 | 36730 | 36731 | 38061 | 38062 | 38063 | 40181 | 40185

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.