Skip to content

N
nx-libs
Commit 266b5554 authored by Reinhard Tartler's avatar Reinhard Tartler
Browse files
Options

Imported nxagent-3.1.0-7.tar.gz

Summary: Imported nxagent-3.1.0-7.tar.gz Keywords: Imported nxagent-3.1.0-7.tar.gz into Git repository
parent 3e7c6697
Hide whitespace changes
Inline Side-by-side
Showing with 173 additions and 24 deletions
nx-X11/programs/Xserver/hw/nxagent/CHANGELOG
View file @ 266b5554
ChangeLog:
nxagent-3.1.0-7
- Imported patch fixing issues from X.Org security advisory, January
17th, 2008: Multiple vulnerabilities in the X server. CVE IDs:
CVE-2007-5760 CVE-2007-5958 CVE-2007-6427 CVE-2007-6428
CVE-2007-6429 CVE-2008-0006.
- Handled the case if nxagentCreateDrawableBitmap() fails to create
the pixmap intended to store the bitmap data.
nxagent-3.1.0-6
- Fixed a compile warning in Args.c.
......
nx-X11/programs/Xserver/hw/nxagent/Drawable.c
View file @ 266b5554
......@@ -2609,8 +2609,24 @@ void nxagentCreateDrawableBitmap(DrawablePtr pDrawable)
goto nxagentCreateDrawableBitmapEnd;
}
/*
* FIXME: A better way it would be create the bitmap
* with the same extents of the clipRegion. This
* requires to save the offset with respect to the
* drawable origin like in the backing store.
*/
pBitmap = nxagentCreatePixmap(pDrawable -> pScreen, pDrawable -> width, pDrawable -> height, pDrawable -> depth);
if (pBitmap == NULL)
{
#ifdef WARNING
fprintf(stderr, "nxagentCreateDrawableBitmap: Cannot create pixmap for the bitmap data.\n");
#endif
goto nxagentCreateDrawableBitmapEnd;
}
pGC = GetScratchGC(pBitmap -> drawable.depth, pBitmap -> drawable.pScreen);
ValidateGC((DrawablePtr) pBitmap, pGC);
......
nx-X11/programs/Xserver/hw/nxagent/X/NXdixfonts.c
View file @ 266b5554
......@@ -437,6 +437,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
err = BadFontName;
goto bail;
}
/* check values for firstCol, lastCol, firstRow, and lastRow */
if (pfont->info.firstCol > pfont->info.lastCol ||
pfont->info.firstRow > pfont->info.lastRow ||
pfont->info.lastCol - pfont->info.firstCol > 255) {
err = AllocError;
goto bail;
}
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXdixfonts.c.NX.original
View file @ 266b5554
......@@ -437,6 +437,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
err = BadFontName;
goto bail;
}
/* check values for firstCol, lastCol, firstRow, and lastRow */
if (pfont->info.firstCol > pfont->info.lastCol ||
pfont->info.firstRow > pfont->info.lastRow ||
pfont->info.lastCol - pfont->info.firstCol > 255) {
err = AllocError;
goto bail;
}
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXdixfonts.c.X.original
View file @ 266b5554
......@@ -336,6 +336,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
err = BadFontName;
goto bail;
}
/* check values for firstCol, lastCol, firstRow, and lastRow */
if (pfont->info.firstCol > pfont->info.lastCol ||
pfont->info.firstRow > pfont->info.lastRow ||
pfont->info.lastCol - pfont->info.firstCol > 255) {
err = AllocError;
goto bail;
}
if (!pfont->fpe)
pfont->fpe = fpe;
pfont->refcnt++;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c
View file @ 266b5554
......@@ -832,6 +832,8 @@ ProcPanoramiXShmCreatePixmap(
int i, j, result;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
unsigned int width, height, depth;
unsigned long size;
PanoramiXRes *newPix;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
......@@ -841,11 +843,18 @@ ProcPanoramiXShmCreatePixmap(
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
if (!stuff->width || !stuff->height)
width = stuff->width;
height = stuff->height;
depth = stuff->depth;
if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
if (width > 32767 || height > 32767)
return BadAlloc;
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
......@@ -855,10 +864,18 @@ ProcPanoramiXShmCreatePixmap(
client->errorValue = stuff->depth;
return BadValue;
}
CreatePmap:
VERIFY_SHMSIZE(shmdesc, stuff->offset,
PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
client);
size = PixmapBytePad(width, depth) * height;
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
/* thankfully, offset is unsigned */
if (stuff->offset + size < size)
return BadAlloc;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
return BadAlloc;
......@@ -1174,6 +1191,8 @@ ProcShmCreatePixmap(client)
register int i;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
unsigned int width, height, depth;
unsigned long size;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
client->errorValue = stuff->pid;
......@@ -1182,11 +1201,18 @@ ProcShmCreatePixmap(client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
if (!stuff->width || !stuff->height)
width = stuff->width;
height = stuff->height;
depth = stuff->depth;
if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
if (width > 32767 || height > 32767)
return BadAlloc;
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
......@@ -1196,10 +1222,18 @@ ProcShmCreatePixmap(client)
client->errorValue = stuff->depth;
return BadValue;
}
CreatePmap:
VERIFY_SHMSIZE(shmdesc, stuff->offset,
PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
client);
size = PixmapBytePad(width, depth) * height;
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
/* thankfully, offset is unsigned */
if (stuff->offset + size < size)
return BadAlloc;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
pDraw->pScreen, stuff->width,
stuff->height, stuff->depth,
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original
View file @ 266b5554
......@@ -832,6 +832,8 @@ ProcPanoramiXShmCreatePixmap(
int i, j, result;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
unsigned int width, height, depth;
unsigned long size;
PanoramiXRes *newPix;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
......@@ -841,11 +843,18 @@ ProcPanoramiXShmCreatePixmap(
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
if (!stuff->width || !stuff->height)
width = stuff->width;
height = stuff->height;
depth = stuff->depth;
if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
if (width > 32767 || height > 32767)
return BadAlloc;
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
......@@ -855,10 +864,18 @@ ProcPanoramiXShmCreatePixmap(
client->errorValue = stuff->depth;
return BadValue;
}
CreatePmap:
VERIFY_SHMSIZE(shmdesc, stuff->offset,
PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
client);
size = PixmapBytePad(width, depth) * height;
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
/* thankfully, offset is unsigned */
if (stuff->offset + size < size)
return BadAlloc;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
return BadAlloc;
......@@ -1174,6 +1191,8 @@ ProcShmCreatePixmap(client)
register int i;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
unsigned int width, height, depth;
unsigned long size;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
client->errorValue = stuff->pid;
......@@ -1182,11 +1201,18 @@ ProcShmCreatePixmap(client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
if (!stuff->width || !stuff->height)
width = stuff->width;
height = stuff->height;
depth = stuff->depth;
if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
if (width > 32767 || height > 32767)
return BadAlloc;
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
......@@ -1196,10 +1222,18 @@ ProcShmCreatePixmap(client)
client->errorValue = stuff->depth;
return BadValue;
}
CreatePmap:
VERIFY_SHMSIZE(shmdesc, stuff->offset,
PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
client);
size = PixmapBytePad(width, depth) * height;
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
/* thankfully, offset is unsigned */
if (stuff->offset + size < size)
return BadAlloc;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
pDraw->pScreen, stuff->width,
stuff->height, stuff->depth,
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
View file @ 266b5554
......@@ -728,6 +728,8 @@ ProcPanoramiXShmCreatePixmap(
int i, j, result;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
unsigned int width, height, depth;
unsigned long size;
PanoramiXRes *newPix;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
......@@ -737,11 +739,18 @@ ProcPanoramiXShmCreatePixmap(
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
if (!stuff->width || !stuff->height)
width = stuff->width;
height = stuff->height;
depth = stuff->depth;
if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
if (width > 32767 || height > 32767)
return BadAlloc;
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
......@@ -751,10 +760,18 @@ ProcPanoramiXShmCreatePixmap(
client->errorValue = stuff->depth;
return BadValue;
}
CreatePmap:
VERIFY_SHMSIZE(shmdesc, stuff->offset,
PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
client);
size = PixmapBytePad(width, depth) * height;
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
/* thankfully, offset is unsigned */
if (stuff->offset + size < size)
return BadAlloc;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
return BadAlloc;
......@@ -1052,6 +1069,8 @@ ProcShmCreatePixmap(client)
register int i;
ShmDescPtr shmdesc;
REQUEST(xShmCreatePixmapReq);
unsigned int width, height, depth;
unsigned long size;
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
client->errorValue = stuff->pid;
......@@ -1060,11 +1079,18 @@ ProcShmCreatePixmap(client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
if (!stuff->width || !stuff->height)
width = stuff->width;
height = stuff->height;
depth = stuff->depth;
if (!width || !height || !depth)
{
client->errorValue = 0;
return BadValue;
}
if (width > 32767 || height > 32767)
return BadAlloc;
if (stuff->depth != 1)
{
pDepth = pDraw->pScreen->allowedDepths;
......@@ -1074,10 +1100,18 @@ ProcShmCreatePixmap(client)
client->errorValue = stuff->depth;
return BadValue;
}
CreatePmap:
VERIFY_SHMSIZE(shmdesc, stuff->offset,
PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
client);
size = PixmapBytePad(width, depth) * height;
if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
if (size < width * height)
return BadAlloc;
/* thankfully, offset is unsigned */
if (stuff->offset + size < size)
return BadAlloc;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
pDraw->pScreen, stuff->width,
stuff->height, stuff->depth,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment