Skip to content

N
nx-libs
Commit b7916400 authored by Reinhard Tartler's avatar Reinhard Tartler
Browse files
Options

Imported nxagent-3.2.0-5.tar.gz

Summary: Imported nxagent-3.2.0-5.tar.gz Keywords: Imported nxagent-3.2.0-5.tar.gz into Git repository
parent 1c25e92b
Show whitespace changes
Inline Side-by-side
Showing with 1342 additions and 326 deletions
nx-X11/programs/Xserver/hw/nxagent/Args.c
View file @ b7916400
...@@ -2080,8 +2080,8 @@ void nxagentSetDeferLevel() ...@@ -2080,8 +2080,8 @@ void nxagentSetDeferLevel()
deferTimeout = 200; deferTimeout = 200;
tileWidth = 4096; tileWidth = 65536;
tileHeight = 4096; tileHeight = 65536;
break; break;
} }
...@@ -2091,8 +2091,8 @@ void nxagentSetDeferLevel() ...@@ -2091,8 +2091,8 @@ void nxagentSetDeferLevel()
deferTimeout = 200; deferTimeout = 200;
tileWidth = 4096; tileWidth = 65536;
tileHeight = 4096; tileHeight = 65536;
break; break;
} }
...@@ -2103,8 +2103,8 @@ void nxagentSetDeferLevel() ...@@ -2103,8 +2103,8 @@ void nxagentSetDeferLevel()
deferTimeout = 200; deferTimeout = 200;
tileWidth = 4096; tileWidth = 65536;
tileHeight = 4096; tileHeight = 65536;
break; break;
} }
......
nx-X11/programs/Xserver/hw/nxagent/CHANGELOG
View file @ b7916400
ChangeLog: ChangeLog:
nxagent-3.2.0-10
- Extended fix for TR07F02091 to include font names having zero in
fields RESOLUTION_X and RESOLUTION_Y.
nxagent-3.2.0-9
- Fixed TR07F02091. Scalable fonts were not correctly listed among
available fonts.
- Fixed TR06F02080. Use the corrupted area extents as maximum size of
the image data.
nxagent-3.2.0-8
- Fixed TR07F02082. The agent server could be unable to init core
keyboard on 64 bit systems.
nxagent-3.2.0-7
- Imported patch fixing issues from X.Org security advisory, June
11th, 2008: Multiple vulnerabilities in X server extensions. CVE
IDs: CVE-2008-1377, CVE-2008-1379, CVE-2008-2360, CVE-2008-2361,
CVE-2008-2362.
nxagent-3.2.0-6
- Fixed TR05F02063. Ignore ReparentNotify events for non-rootless
sessions.
- Fixed TR06F02068. Try to pack images only if format is ZPixmap.
- Don't require reparent on close of NX window.
nxagent-3.2.0-5 nxagent-3.2.0-5
- Fixed TR04F02044. Restored the original MakeRootTile() function in - Fixed TR04F02044. Restored the original MakeRootTile() function in
......
nx-X11/programs/Xserver/hw/nxagent/CHANGELOG.orig deleted 100644 → 0
View file @ 1c25e92b
This source diff could not be displayed because it is too large. You can view the blob instead.
nx-X11/programs/Xserver/hw/nxagent/Drawable.c
View file @ b7916400
...@@ -371,7 +371,6 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned ...@@ -371,7 +371,6 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned
int nBox; int nBox;
int x, y; int x, y;
int w, h; int w, h;
int extentWidth, extentHeight;
int tileWidth, tileHeight; int tileWidth, tileHeight;
int length, format, leftPad; int length, format, leftPad;
int i; int i;
...@@ -591,20 +590,8 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned ...@@ -591,20 +590,8 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned
pDrawable -> x, pDrawable -> y, pDrawable -> width, pDrawable -> height); pDrawable -> x, pDrawable -> y, pDrawable -> width, pDrawable -> height);
#endif #endif
/* w = tileWidth = (nxagentOption(TileWidth) > pDrawable -> width ? pDrawable -> width : nxagentOption(TileWidth));
* We are going to synchronize the corrupted h = tileHeight = (nxagentOption(TileHeight) > pDrawable -> height ? pDrawable -> height : nxagentOption(TileHeight));
* area, so we use the corrupted extents as
* maximum size of the image data. It's im-
* portant to avoid using the drawable size,
* because in case of a huge window it had to
* result in a failed data memory allocation.
*/
extentWidth = clipRegion -> extents.x2 - clipRegion -> extents.x1;
extentHeight = clipRegion -> extents.y2 - clipRegion -> extents.y1;
w = tileWidth = (nxagentOption(TileWidth) > extentWidth ? extentWidth : nxagentOption(TileWidth));
h = tileHeight = (nxagentOption(TileHeight) > extentHeight ? extentHeight : nxagentOption(TileHeight));
#ifdef DEBUG #ifdef DEBUG
fprintf(stderr, "nxagentSynchronizeRegion: Using tiles of size [%dx%d].\n", tileWidth, tileHeight); fprintf(stderr, "nxagentSynchronizeRegion: Using tiles of size [%dx%d].\n", tileWidth, tileHeight);
...@@ -2626,10 +2613,7 @@ void nxagentCreateDrawableBitmap(DrawablePtr pDrawable) ...@@ -2626,10 +2613,7 @@ void nxagentCreateDrawableBitmap(DrawablePtr pDrawable)
* FIXME: A better way it would be create the bitmap * FIXME: A better way it would be create the bitmap
* with the same extents of the clipRegion. This * with the same extents of the clipRegion. This
* requires to save the offset with respect to the * requires to save the offset with respect to the
* drawable origin like in the backing store. This * drawable origin like in the backing store.
* becomes particularly important when the drawable
* is a huge window, because the pixmap creation
* would fail.
*/ */
pBitmap = nxagentCreatePixmap(pDrawable -> pScreen, pDrawable -> width, pDrawable -> height, pDrawable -> depth); pBitmap = nxagentCreatePixmap(pDrawable -> pScreen, pDrawable -> width, pDrawable -> height, pDrawable -> depth);
......
nx-X11/programs/Xserver/hw/nxagent/Events.c
View file @ b7916400
...@@ -2261,11 +2261,7 @@ int nxagentHandleClientMessageEvent(XEvent *X, enum HandleEventResult *result) ...@@ -2261,11 +2261,7 @@ int nxagentHandleClientMessageEvent(XEvent *X, enum HandleEventResult *result)
{ {
pScreen = nxagentScreen(X -> xmap.window); pScreen = nxagentScreen(X -> xmap.window);
XMapRaised(nxagentDisplay, nxagentFullscreenWindow); nxagentMaximizeToFullScreen(pScreen);
XIconifyWindow(nxagentDisplay, nxagentIconWindow,
DefaultScreen(nxagentDisplay));
} }
if (X -> xclient.window == (nxagentOption(Fullscreen) ? if (X -> xclient.window == (nxagentOption(Fullscreen) ?
...@@ -3062,6 +3058,56 @@ int nxagentHandleReparentNotify(XEvent* X) ...@@ -3062,6 +3058,56 @@ int nxagentHandleReparentNotify(XEvent* X)
return 1; return 1;
} }
else
{
/*
* This code is supposed to detect if a window manager
* is running but in some cases it may be unreliable.
* Each window manager behaves differently so the check
* can fail for some less common WMs.
*/
if (!nxagentWMIsRunning && nxagentOption(Fullscreen) &&
X -> xreparent.window == nxagentDefaultWindows[pScreen -> myNum])
{
#ifdef WARNING
fprintf(stderr, "Warning: The agent window was reparented. Is a "
"window manager running?\n");
#endif
/*
* If no window manager is running and we are supposed to
* be in fullscreen mode then don't wait for the reparent
* event. We can assume that there is an undetected window
* manager and, as switching to fullscreen could have fail-
* ed, we try it again.
*/
nxagentSwitchFullscreen(pScreen, True);
nxagentWMIsRunning = True;
}
else if (nxagentWMIsRunning && X -> xreparent.window ==
nxagentDefaultWindows[pScreen -> myNum] && X -> xreparent.parent ==
RootWindow(nxagentDisplay, (pScreen -> myNum)))
{
#ifdef WARNING
fprintf(stderr, "Warning: The agent window has been reparented to the root.\n");
fprintf(stderr, "Warning: No window manager seems to be running.\n");
#endif
/*
* The agent window was unexpectedly reparented
* to the root window. We assume that the window
* manager was terminated.
*/
nxagentWMIsRunning = False;
}
}
return 1; return 1;
} }
......
nx-X11/programs/Xserver/hw/nxagent/Font.c
View file @ b7916400
...@@ -101,8 +101,6 @@ static XFontStruct *nxagentLoadQueryFont(register Display *dpy , char *fontName ...@@ -101,8 +101,6 @@ static XFontStruct *nxagentLoadQueryFont(register Display *dpy , char *fontName
int nxagentFreeFont(XFontStruct *fs); int nxagentFreeFont(XFontStruct *fs);
static Bool nxagentGetFontServerPath(char * fontServerPath); static Bool nxagentGetFontServerPath(char * fontServerPath);
static char * nxagentMakeScalableFontName(const char *fontName, int scalableResolution);
RESTYPE RT_NX_FONT; RESTYPE RT_NX_FONT;
#ifdef NXAGENT_RECONNECT_FONT_DEBUG #ifdef NXAGENT_RECONNECT_FONT_DEBUG
...@@ -421,59 +419,13 @@ Bool nxagentFontFind(const char *name, int *pos) ...@@ -421,59 +419,13 @@ Bool nxagentFontFind(const char *name, int *pos)
Bool nxagentFontLookUp(const char *name) Bool nxagentFontLookUp(const char *name)
{ {
int i; int i;
int result; if (name)
if (!strlen(name))
char *scalable;
if (name != NULL && strlen(name) == 0)
{
return 0; return 0;
} if (nxagentFontFind(name, &i))
result = nxagentFontFind(name, &i);
scalable = NULL;
/*
* Let's try with the scalable font description.
*/
if (result == 0)
{
scalable = nxagentMakeScalableFontName(name, 0);
if (scalable != NULL)
{
result = nxagentFontFind(scalable, &i);
free(scalable);
}
}
/*
* Let's try again after replacing zero to xdpi and ydpi in the pattern.
*/
if (result == 0)
{
scalable = nxagentMakeScalableFontName(name, 1);
if (scalable != NULL)
{
result = nxagentFontFind(scalable, &i);
free(scalable);
}
}
if (result == 0)
{
return 0;
}
else
{
return (nxagentRemoteFontList.list[i]->status > 0); return (nxagentRemoteFontList.list[i]->status > 0);
} else
return 0;
} }
Bool nxagentRealizeFont(ScreenPtr pScreen, FontPtr pFont) Bool nxagentRealizeFont(ScreenPtr pScreen, FontPtr pFont)
...@@ -1746,88 +1698,3 @@ int nxagentSplitString(char *string, char *fields[], int nfields, char *sep) ...@@ -1746,88 +1698,3 @@ int nxagentSplitString(char *string, char *fields[], int nfields, char *sep)
return i; return i;
} }
char *nxagentMakeScalableFontName(const char *fontName, int scalableResolution)
{
char *scalableFontName;
const char *s;
int len;
int field;
len = strlen(fontName) + 1;
scalableFontName = malloc(len);
if (scalableFontName == NULL)
{
#ifdef PANIC
fprintf(stderr, "nxagentMakeScalableFontName: PANIC! malloc() failed.\n");
#endif
return NULL;
}
scalableFontName[0] = 0;
if (*fontName != '-')
{
goto MakeScalableFontNameError;
}
s = fontName;
field = 0;
while (s != NULL)
{
s = strchr(s + 1, '-');
if (s != NULL)
{
if (field == 6 || field == 7 || field == 11)
{
/*
* PIXEL_SIZE || POINT_SIZE || AVERAGE_WIDTH
*/
strcat(scalableFontName, "-0");
}
else if (scalableResolution == 1 && (field == 8 || field == 9))
{
/*
* RESOLUTION_X || RESOLUTION_Y
*/
strcat(scalableFontName, "-0");
}
else
{
strncat(scalableFontName, fontName, s - fontName);
}
fontName = s;
}
else
{
strcat(scalableFontName, fontName);
}
field++;
}
if (field != 14)
{
goto MakeScalableFontNameError;
}
return scalableFontName;
MakeScalableFontNameError:
free(scalableFontName);
#ifdef DEBUG
fprintf(stderr, "nxagentMakeScalableFontName: Invalid font name.\n");
#endif
return NULL;
}
nx-X11/programs/Xserver/hw/nxagent/Image.c
View file @ b7916400
...@@ -1176,7 +1176,7 @@ FIXME: Should use an unpack resource here. ...@@ -1176,7 +1176,7 @@ FIXME: Should use an unpack resource here.
*/ */
pack = (nxagentOption(LinkType) != LINK_TYPE_NONE && pack = (nxagentOption(LinkType) != LINK_TYPE_NONE &&
packMethod != PACK_NONE && depth > 8 && format == ZPixmap); packMethod != PACK_NONE && depth > 8);
lossless = (packMethod == nxagentPackLossless); lossless = (packMethod == nxagentPackLossless);
......
nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
View file @ b7916400
...@@ -444,7 +444,7 @@ N/A ...@@ -444,7 +444,7 @@ N/A
max_keycode - min_keycode + 1, max_keycode - min_keycode + 1,
&mapWidth); &mapWidth);
if (keymap64 == NULL) if (keymap == NULL)
{ {
XFreeModifiermap(modifier_keymap); XFreeModifiermap(modifier_keymap);
......
nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c
View file @ b7916400
...@@ -69,17 +69,6 @@ ...@@ -69,17 +69,6 @@
#undef DEBUG #undef DEBUG
#undef TEST #undef TEST
#else
#include "picturestr.h"
#include "glyphstr.h"
#endif
#if HAVE_STDINT_H
#include <stdint.h>
#elif !defined(UINT32_MAX)
#define UINT32_MAX 0xffffffffU
#endif #endif
/* /*
...@@ -412,12 +401,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth) ...@@ -412,12 +401,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{ {
int size; int size;
GlyphPtr glyph; GlyphPtr glyph;
size_t padded_width;
padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]); size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
return 0;
size = gi->height * padded_width;
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec)); glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph) if (!glyph)
return 0; return 0;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original
View file @ b7916400
...@@ -69,17 +69,6 @@ ...@@ -69,17 +69,6 @@
#undef DEBUG #undef DEBUG
#undef TEST #undef TEST
#else
#include "picturestr.h"
#include "glyphstr.h"
#endif
#if HAVE_STDINT_H
#include <stdint.h>
#elif !defined(UINT32_MAX)
#define UINT32_MAX 0xffffffffU
#endif #endif
/* /*
...@@ -412,12 +401,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth) ...@@ -412,12 +401,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{ {
int size; int size;
GlyphPtr glyph; GlyphPtr glyph;
size_t padded_width;
padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]); size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
return 0;
size = gi->height * padded_width;
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec)); glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph) if (!glyph)
return 0; return 0;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original
View file @ b7916400
...@@ -43,12 +43,6 @@ ...@@ -43,12 +43,6 @@
#include "picturestr.h" #include "picturestr.h"
#include "glyphstr.h" #include "glyphstr.h"
#if HAVE_STDINT_H
#include <stdint.h>
#elif !defined(UINT32_MAX)
#define UINT32_MAX 0xffffffffU
#endif
/* /*
* From Knuth -- a good choice for hash/rehash values is p, p-2 where * From Knuth -- a good choice for hash/rehash values is p, p-2 where
* p and p-2 are both prime. These tables are sized to have an extra 10% * p and p-2 are both prime. These tables are sized to have an extra 10%
...@@ -340,12 +334,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth) ...@@ -340,12 +334,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{ {
int size; int size;
GlyphPtr glyph; GlyphPtr glyph;
size_t padded_width;
padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]); size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
return 0;
size = gi->height * padded_width;
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec)); glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph) if (!glyph)
return 0; return 0;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
View file @ b7916400
...@@ -1893,8 +1893,6 @@ ProcRenderCreateCursor (ClientPtr client) ...@@ -1893,8 +1893,6 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen; pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width; width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height; height = pSrc->pDrawable->height;
if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
return BadAlloc;
if ( stuff->x > width if ( stuff->x > width
|| stuff->y > height ) || stuff->y > height )
return (BadMatch); return (BadMatch);
...@@ -2355,8 +2353,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) ...@@ -2355,8 +2353,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client); LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -2959,18 +2955,18 @@ SProcRenderCreateSolidFill(ClientPtr client) ...@@ -2959,18 +2955,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client); return (*ProcRenderVector[stuff->renderReqType]) (client);
} }
static void swapStops(void *stuff, int num) static void swapStops(void *stuff, int n)
{ {
int i, n; int i;
CARD32 *stops; CARD32 *stops;
CARD16 *colors; CARD16 *colors;
stops = (CARD32 *)(stuff); stops = (CARD32 *)(stuff);
for (i = 0; i < num; ++i) { for (i = 0; i < n; ++i) {
swapl(stops, n); swapl(stops, n);
++stops; ++stops;
} }
colors = (CARD16 *)(stops); colors = (CARD16 *)(stops);
for (i = 0; i < 4*num; ++i) { for (i = 0; i < 4*n; ++i) {
swaps(stops, n); swaps(stops, n);
++stops; ++stops;
} }
...@@ -2993,8 +2989,6 @@ SProcRenderCreateLinearGradient (ClientPtr client) ...@@ -2993,8 +2989,6 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -3022,8 +3016,6 @@ SProcRenderCreateRadialGradient (ClientPtr client) ...@@ -3022,8 +3016,6 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -3048,8 +3040,6 @@ SProcRenderCreateConicalGradient (ClientPtr client) ...@@ -3048,8 +3040,6 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original
View file @ b7916400
...@@ -1893,8 +1893,6 @@ ProcRenderCreateCursor (ClientPtr client) ...@@ -1893,8 +1893,6 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen; pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width; width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height; height = pSrc->pDrawable->height;
if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
return BadAlloc;
if ( stuff->x > width if ( stuff->x > width
|| stuff->y > height ) || stuff->y > height )
return (BadMatch); return (BadMatch);
...@@ -2355,8 +2353,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) ...@@ -2355,8 +2353,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client); LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -2959,18 +2955,18 @@ SProcRenderCreateSolidFill(ClientPtr client) ...@@ -2959,18 +2955,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client); return (*ProcRenderVector[stuff->renderReqType]) (client);
} }
static void swapStops(void *stuff, int num) static void swapStops(void *stuff, int n)
{ {
int i, n; int i;
CARD32 *stops; CARD32 *stops;
CARD16 *colors; CARD16 *colors;
stops = (CARD32 *)(stuff); stops = (CARD32 *)(stuff);
for (i = 0; i < num; ++i) { for (i = 0; i < n; ++i) {
swapl(stops, n); swapl(stops, n);
++stops; ++stops;
} }
colors = (CARD16 *)(stops); colors = (CARD16 *)(stops);
for (i = 0; i < 4*num; ++i) { for (i = 0; i < 4*n; ++i) {
swaps(stops, n); swaps(stops, n);
++stops; ++stops;
} }
...@@ -2993,8 +2989,6 @@ SProcRenderCreateLinearGradient (ClientPtr client) ...@@ -2993,8 +2989,6 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -3022,8 +3016,6 @@ SProcRenderCreateRadialGradient (ClientPtr client) ...@@ -3022,8 +3016,6 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -3048,8 +3040,6 @@ SProcRenderCreateConicalGradient (ClientPtr client) ...@@ -3048,8 +3040,6 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original
View file @ b7916400
...@@ -1505,8 +1505,6 @@ ProcRenderCreateCursor (ClientPtr client) ...@@ -1505,8 +1505,6 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen; pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width; width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height; height = pSrc->pDrawable->height;
if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
return BadAlloc;
if ( stuff->x > width if ( stuff->x > width
|| stuff->y > height ) || stuff->y > height )
return (BadMatch); return (BadMatch);
...@@ -1920,8 +1918,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client) ...@@ -1920,8 +1918,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client); LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -2493,18 +2489,18 @@ SProcRenderCreateSolidFill(ClientPtr client) ...@@ -2493,18 +2489,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client); return (*ProcRenderVector[stuff->renderReqType]) (client);
} }
static void swapStops(void *stuff, int num) static void swapStops(void *stuff, int n)
{ {
int i, n; int i;
CARD32 *stops; CARD32 *stops;
CARD16 *colors; CARD16 *colors;
stops = (CARD32 *)(stuff); stops = (CARD32 *)(stuff);
for (i = 0; i < num; ++i) { for (i = 0; i < n; ++i) {
swapl(stops, n); swapl(stops, n);
++stops; ++stops;
} }
colors = (CARD16 *)(stops); colors = (CARD16 *)(stops);
for (i = 0; i < 4*num; ++i) { for (i = 0; i < 4*n; ++i) {
swaps(stops, n); swaps(stops, n);
++stops; ++stops;
} }
...@@ -2527,8 +2523,6 @@ SProcRenderCreateLinearGradient (ClientPtr client) ...@@ -2527,8 +2523,6 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -2556,8 +2550,6 @@ SProcRenderCreateRadialGradient (ClientPtr client) ...@@ -2556,8 +2550,6 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
...@@ -2582,8 +2574,6 @@ SProcRenderCreateConicalGradient (ClientPtr client) ...@@ -2582,8 +2574,6 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n); swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength; return BadLength;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original
View file @ b7916400
...@@ -194,6 +194,10 @@ static DeleteType *DeleteFuncs = (DeleteType *)NULL; ...@@ -194,6 +194,10 @@ static DeleteType *DeleteFuncs = (DeleteType *)NULL;
Atom * ResourceNames = NULL; Atom * ResourceNames = NULL;
#ifdef NXAGENT_SERVER
static int nxagentResChangedFlag = 0;
#endif
void RegisterResourceName (RESTYPE type, char *name) void RegisterResourceName (RESTYPE type, char *name)
{ {
ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE); ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE);
...@@ -201,10 +205,6 @@ void RegisterResourceName (RESTYPE type, char *name) ...@@ -201,10 +205,6 @@ void RegisterResourceName (RESTYPE type, char *name)
#endif #endif
#ifdef NXAGENT_SERVER
static int nxagentResChangedFlag = 0;
#endif
RESTYPE RESTYPE
CreateNewResourceType(DeleteType deleteFunc) CreateNewResourceType(DeleteType deleteFunc)
{ {
......
nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c~ 0 → 100644
View file @ b7916400
/**************************************************************************/
/* */
/* Copyright (c) 2001, 2007 NoMachine, http://www.nomachine.com/. */
/* */
/* NXAGENT, NX protocol compression and NX extensions to this software */
/* are copyright of NoMachine. Redistribution and use of the present */
/* software is allowed according to terms specified in the file LICENSE */
/* which comes in the source distribution. */
/* */
/* Check http://www.nomachine.com/licensing.html for applicability. */
/* */
/* NX and NoMachine are trademarks of NoMachine S.r.l. */
/* */
/* All rights reserved. */
/* */
/**************************************************************************/
/************************************************************
Copyright 1987, 1998 The Open Group
Permission to use, copy, modify, distribute, and sell this software and its
documentation for any purpose is hereby granted without fee, provided that
the above copyright notice appear in all copies and that both that
copyright notice and this permission notice appear in supporting
documentation.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Except as contained in this notice, the name of The Open Group shall not be
used in advertising or otherwise to promote the sale, use or other dealings
in this Software without prior written authorization from The Open Group.
Copyright 1987 by Digital Equipment Corporation, Maynard, Massachusetts.
All Rights Reserved
Permission to use, copy, modify, and distribute this software and its
documentation for any purpose and without fee is hereby granted,
provided that the above copyright notice appear in all copies and that
both that copyright notice and this permission notice appear in
supporting documentation, and that the name of Digital not be
used in advertising or publicity pertaining to distribution of the
software without specific, written prior permission.
DIGITAL DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
DIGITAL BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
SOFTWARE.
********************************************************/
/* The panoramix components contained the following notice */
/*****************************************************************
Copyright (c) 1991, 1997 Digital Equipment Corporation, Maynard, Massachusetts.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
DIGITAL EQUIPMENT CORPORATION BE LIABLE FOR ANY CLAIM, DAMAGES, INCLUDING,
BUT NOT LIMITED TO CONSEQUENTIAL OR INCIDENTAL DAMAGES, OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Except as contained in this notice, the name of Digital Equipment Corporation
shall not be used in advertising or otherwise to promote the sale, use or other
dealings in this Software without prior written authorization from Digital
Equipment Corporation.
******************************************************************/
/* $Xorg: resource.c,v 1.5 2001/02/09 02:04:40 xorgcvs Exp $ */
/* $XdotOrg: xc/programs/Xserver/dix/resource.c,v 1.8 2005/07/03 08:53:38 daniels Exp $ */
/* $TOG: resource.c /main/41 1998/02/09 14:20:31 kaleb $ */
/* Routines to manage various kinds of resources:
*
* CreateNewResourceType, CreateNewResourceClass, InitClientResources,
* FakeClientID, AddResource, FreeResource, FreeClientResources,
* FreeAllResources, LookupIDByType, LookupIDByClass, GetXIDRange
*/
/*
* A resource ID is a 32 bit quantity, the upper 2 bits of which are
* off-limits for client-visible resources. The next 8 bits are
* used as client ID, and the low 22 bits come from the client.
* A resource ID is "hashed" by extracting and xoring subfields
* (varying with the size of the hash table).
*
* It is sometimes necessary for the server to create an ID that looks
* like it belongs to a client. This ID, however, must not be one
* the client actually can create, or we have the potential for conflict.
* The 31st bit of the ID is reserved for the server's use for this
* purpose. By setting CLIENT_ID(id) to the client, the SERVER_BIT to
* 1, and an otherwise arbitrary ID in the low 22 bits, we can create a
* resource "owned" by the client.
*/
/* $XFree86: xc/programs/Xserver/dix/resource.c,v 3.13 2003/09/24 02:43:13 dawes Exp $ */
#define NEED_EVENTS
#ifdef HAVE_DIX_CONFIG_H
#include <dix-config.h>
#endif
#include <X11/X.h>
#include "misc.h"
#include "os.h"
#include "resource.h"
#include "dixstruct.h"
#include "opaque.h"
#include "windowstr.h"
#include "dixfont.h"
#include "colormap.h"
#include "inputstr.h"
#include "dixevents.h"
#include "dixgrabs.h"
#include "cursor.h"
#ifdef PANORAMIX
#include "panoramiX.h"
#include "panoramiXsrv.h"
#endif
#include <assert.h>
#ifdef NXAGENT_SERVER
#include "Agent.h"
#include "Font.h"
#include "Pixmaps.h"
#include "GCs.h"
#define PANIC
#define WARNING
#undef TEST
#undef DEBUG
#endif
static void RebuildTable(
int /*client*/
);
#define SERVER_MINID 32
#define INITBUCKETS 64
#define INITHASHSIZE 6
#define MAXHASHSIZE 11
typedef struct _Resource {
struct _Resource *next;
XID id;
RESTYPE type;
pointer value;
} ResourceRec, *ResourcePtr;
#define NullResource ((ResourcePtr)NULL)
typedef struct _ClientResource {
ResourcePtr *resources;
int elements;
int buckets;
int hashsize; /* log(2)(buckets) */
XID fakeID;
XID endFakeID;
XID expectID;
} ClientResourceRec;
RESTYPE lastResourceType;
static RESTYPE lastResourceClass;
RESTYPE TypeMask;
static DeleteType *DeleteFuncs = (DeleteType *)NULL;
#ifdef XResExtension
Atom * ResourceNames = NULL;
#ifdef NXAGENT_SERVER
static int nxagentResChangedFlag = 0;
#endif
void RegisterResourceName (RESTYPE type, char *name)
{
ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE);
}
#endif
RESTYPE
CreateNewResourceType(DeleteType deleteFunc)
{
RESTYPE next = lastResourceType + 1;
DeleteType *funcs;
if (next & lastResourceClass)
return 0;
funcs = (DeleteType *)xrealloc(DeleteFuncs,
(next + 1) * sizeof(DeleteType));
if (!funcs)
return 0;
#ifdef XResExtension
{
Atom *newnames;
newnames = xrealloc(ResourceNames, (next + 1) * sizeof(Atom));
if(!newnames)
return 0;
ResourceNames = newnames;
ResourceNames[next] = 0;
}
#endif
lastResourceType = next;
DeleteFuncs = funcs;
DeleteFuncs[next] = deleteFunc;
return next;
}
RESTYPE
CreateNewResourceClass()
{
RESTYPE next = lastResourceClass >> 1;
if (next & lastResourceType)
return 0;
lastResourceClass = next;
TypeMask = next - 1;
return next;
}
ClientResourceRec clientTable[MAXCLIENTS];
/*****************
* InitClientResources
* When a new client is created, call this to allocate space
* in resource table
*****************/
Bool
InitClientResources(ClientPtr client)
{
register int i, j;
if (client == serverClient)
{
lastResourceType = RT_LASTPREDEF;
lastResourceClass = RC_LASTPREDEF;
TypeMask = RC_LASTPREDEF - 1;
if (DeleteFuncs)
xfree(DeleteFuncs);
DeleteFuncs = (DeleteType *)xalloc((lastResourceType + 1) *
sizeof(DeleteType));
if (!DeleteFuncs)
return FALSE;
DeleteFuncs[RT_NONE & TypeMask] = (DeleteType)NoopDDA;
DeleteFuncs[RT_WINDOW & TypeMask] = DeleteWindow;
DeleteFuncs[RT_PIXMAP & TypeMask] = dixDestroyPixmap;
DeleteFuncs[RT_GC & TypeMask] = FreeGC;
DeleteFuncs[RT_FONT & TypeMask] = CloseFont;
DeleteFuncs[RT_CURSOR & TypeMask] = FreeCursor;
DeleteFuncs[RT_COLORMAP & TypeMask] = FreeColormap;
DeleteFuncs[RT_CMAPENTRY & TypeMask] = FreeClientPixels;
DeleteFuncs[RT_OTHERCLIENT & TypeMask] = OtherClientGone;
DeleteFuncs[RT_PASSIVEGRAB & TypeMask] = DeletePassiveGrab;
#ifdef XResExtension
if(ResourceNames)
xfree(ResourceNames);
ResourceNames = xalloc((lastResourceType + 1) * sizeof(Atom));
if(!ResourceNames)
return FALSE;
#endif
}
clientTable[i = client->index].resources =
(ResourcePtr *)xalloc(INITBUCKETS*sizeof(ResourcePtr));
if (!clientTable[i].resources)
return FALSE;
clientTable[i].buckets = INITBUCKETS;
clientTable[i].elements = 0;
clientTable[i].hashsize = INITHASHSIZE;
/* Many IDs allocated from the server client are visible to clients,
* so we don't use the SERVER_BIT for them, but we have to start
* past the magic value constants used in the protocol. For normal
* clients, we can start from zero, with SERVER_BIT set.
*/
clientTable[i].fakeID = client->clientAsMask |
(client->index ? SERVER_BIT : SERVER_MINID);
clientTable[i].endFakeID = (clientTable[i].fakeID | RESOURCE_ID_MASK) + 1;
clientTable[i].expectID = client->clientAsMask;
for (j=0; j<INITBUCKETS; j++)
{
clientTable[i].resources[j] = NullResource;
}
return TRUE;
}
static int
Hash(int client, register XID id)
{
id &= RESOURCE_ID_MASK;
switch (clientTable[client].hashsize)
{
case 6:
return ((int)(0x03F & (id ^ (id>>6) ^ (id>>12))));
case 7:
return ((int)(0x07F & (id ^ (id>>7) ^ (id>>13))));
case 8:
return ((int)(0x0FF & (id ^ (id>>8) ^ (id>>16))));
case 9:
return ((int)(0x1FF & (id ^ (id>>9))));
case 10:
return ((int)(0x3FF & (id ^ (id>>10))));
case 11:
return ((int)(0x7FF & (id ^ (id>>11))));
}
return -1;
}
static XID
AvailableID(
register int client,
register XID id,
register XID maxid,
register XID goodid)
{
register ResourcePtr res;
if ((goodid >= id) && (goodid <= maxid))
return goodid;
for (; id <= maxid; id++)
{
res = clientTable[client].resources[Hash(client, id)];
while (res && (res->id != id))
res = res->next;
if (!res)
return id;
}
return 0;
}
void
GetXIDRange(int client, Bool server, XID *minp, XID *maxp)
{
register XID id, maxid;
register ResourcePtr *resp;
register ResourcePtr res;
register int i;
XID goodid;
id = (Mask)client << CLIENTOFFSET;
if (server)
id |= client ? SERVER_BIT : SERVER_MINID;
maxid = id | RESOURCE_ID_MASK;
goodid = 0;
for (resp = clientTable[client].resources, i = clientTable[client].buckets;
--i >= 0;)
{
for (res = *resp++; res; res = res->next)
{
if ((res->id < id) || (res->id > maxid))
continue;
if (((res->id - id) >= (maxid - res->id)) ?
(goodid = AvailableID(client, id, res->id - 1, goodid)) :
!(goodid = AvailableID(client, res->id + 1, maxid, goodid)))
maxid = res->id - 1;
else
id = res->id + 1;
}
}
if (id > maxid)
id = maxid = 0;
*minp = id;
*maxp = maxid;
}
/**
* GetXIDList is called by the XC-MISC extension's MiscGetXIDList function.
* This function tries to find count unused XIDs for the given client. It
* puts the IDs in the array pids and returns the number found, which should
* almost always be the number requested.
*
* The circumstances that lead to a call to this function are very rare.
* Xlib must run out of IDs while trying to generate a request that wants
* multiple ID's, like the Multi-buffering CreateImageBuffers request.
*
* No rocket science in the implementation; just iterate over all
* possible IDs for the given client and pick the first count IDs
* that aren't in use. A more efficient algorithm could probably be
* invented, but this will be used so rarely that this should suffice.
*/
unsigned int
GetXIDList(ClientPtr pClient, unsigned count, XID *pids)
{
unsigned int found = 0;
XID id = pClient->clientAsMask;
XID maxid;
maxid = id | RESOURCE_ID_MASK;
while ( (found < count) && (id <= maxid) )
{
if (!LookupIDByClass(id, RC_ANY))
{
pids[found++] = id;
}
id++;
}
return found;
}
/*
* Return the next usable fake client ID.
*
* Normally this is just the next one in line, but if we've used the last
* in the range, we need to find a new range of safe IDs to avoid
* over-running another client.
*/
XID
FakeClientID(register int client)
{
XID id, maxid;
id = clientTable[client].fakeID++;
if (id != clientTable[client].endFakeID)
return id;
GetXIDRange(client, TRUE, &id, &maxid);
if (!id) {
if (!client)
FatalError("FakeClientID: server internal ids exhausted\n");
MarkClientException(clients[client]);
id = ((Mask)client << CLIENTOFFSET) | (SERVER_BIT * 3);
maxid = id | RESOURCE_ID_MASK;
}
clientTable[client].fakeID = id + 1;
clientTable[client].endFakeID = maxid + 1;
return id;
}
#ifdef NXAGENT_SERVER
int nxagentFindClientResource(int client, RESTYPE type, pointer value)
{
ResourcePtr pResource;
ResourcePtr *resources;
int i;
for (i = 0; i < clientTable[client].buckets; i++)
{
resources = clientTable[client].resources;
for (pResource = resources[i]; pResource; pResource = pResource -> next)
{
if (pResource -> type == type && pResource -> value == value)
{
#ifdef TEST
fprintf(stderr, "nxagentFindClientResource: Found resource [%p] type [%lu] "
"for client [%d].\n", (void *) value,
pResource -> type, client);
#endif
return 1;
}
}
}
return 0;
}
int nxagentSwitchResourceType(int client, RESTYPE type, pointer value)
{
ResourcePtr pResource;
ResourcePtr *resources;
RESTYPE internalType = 0;
int i;
if (type == RT_PIXMAP)
{
internalType = RT_NX_PIXMAP;
}
else if (type == RT_GC)
{
internalType = RT_NX_GC;
}
else if (type == RT_FONT)
{
internalType = RT_NX_FONT;
}
else
{
return 0;
}
if (client == serverClient -> index)
{
#ifdef TEST
fprintf(stderr, "nxagentSwitchResourceType: Requesting client is [%d]. Skipping the resource switch.\n",
client);
#endif
return 0;
}
for (i = 0; i < clientTable[serverClient -> index].buckets; i++)
{
resources = clientTable[serverClient -> index].resources;
for (pResource = resources[i]; pResource; pResource = pResource -> next)
{
if (pResource -> type == internalType &&
pResource -> value == value)
{
#ifdef TEST
fprintf(stderr, "nxagentSwitchResourceType: Changing resource [%p] type from [%lu] to "
"[%lu] for server client [%d].\n", (void *) value,
(unsigned long) pResource -> type, (unsigned long) type, serverClient -> index);
#endif
FreeResource(pResource -> id, RT_NONE);
return 1;
}
}
}
return 0;
}
#endif
Bool
AddResource(XID id, RESTYPE type, pointer value)
{
int client;
register ClientResourceRec *rrec;
register ResourcePtr res, *head;
client = CLIENT_ID(id);
rrec = &clientTable[client];
if (!rrec->buckets)
{
ErrorF("AddResource(%lx, %lx, %lx), client=%d \n",
(unsigned long)id, type, (unsigned long)value, client);
FatalError("client not in use\n");
}
#ifdef NXAGENT_SERVER
nxagentSwitchResourceType(client, type, value);
#ifdef TEST
fprintf(stderr, "AddResource: Adding resource for client [%d] type [%lu] value [%p] id [%lu].\n",
client, (unsigned long) type, (void *) value, (unsigned long) id);
#endif
#endif
if ((rrec->elements >= 4*rrec->buckets) &&
(rrec->hashsize < MAXHASHSIZE))
RebuildTable(client);
head = &rrec->resources[Hash(client, id)];
res = (ResourcePtr)xalloc(sizeof(ResourceRec));
if (!res)
{
(*DeleteFuncs[type & TypeMask])(value, id);
return FALSE;
}
res->next = *head;
res->id = id;
res->type = type;
res->value = value;
*head = res;
rrec->elements++;
#ifdef NXAGENT_SERVER
nxagentResChangedFlag = 1;
#endif
if (!(id & SERVER_BIT) && (id >= rrec->expectID))
rrec->expectID = id + 1;
return TRUE;
}
static void
RebuildTable(int client)
{
register int j;
register ResourcePtr res, next;
ResourcePtr **tails, *resources;
register ResourcePtr **tptr, *rptr;
/*
* For now, preserve insertion order, since some ddx layers depend
* on resources being free in the opposite order they are added.
*/
j = 2 * clientTable[client].buckets;
tails = (ResourcePtr **)ALLOCATE_LOCAL(j * sizeof(ResourcePtr *));
if (!tails)
return;
resources = (ResourcePtr *)xalloc(j * sizeof(ResourcePtr));
if (!resources)
{
DEALLOCATE_LOCAL(tails);
return;
}
for (rptr = resources, tptr = tails; --j >= 0; rptr++, tptr++)
{
*rptr = NullResource;
*tptr = rptr;
}
clientTable[client].hashsize++;
for (j = clientTable[client].buckets,
rptr = clientTable[client].resources;
--j >= 0;
rptr++)
{
for (res = *rptr; res; res = next)
{
next = res->next;
res->next = NullResource;
tptr = &tails[Hash(client, res->id)];
**tptr = res;
*tptr = &res->next;
}
}
DEALLOCATE_LOCAL(tails);
clientTable[client].buckets *= 2;
xfree(clientTable[client].resources);
clientTable[client].resources = resources;
}
void
FreeResource(XID id, RESTYPE skipDeleteFuncType)
{
int cid;
register ResourcePtr res;
register ResourcePtr *prev, *head;
register int *eltptr;
int elements;
Bool gotOne = FALSE;
#ifdef NXAGENT_SERVER
#ifdef TEST
fprintf(stderr, "FreeResource: Freeing resource id [%lu].\n", (unsigned long) id);
#endif
#endif
if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets)
{
head = &clientTable[cid].resources[Hash(cid, id)];
eltptr = &clientTable[cid].elements;
prev = head;
while ( (res = *prev) )
{
if (res->id == id)
{
RESTYPE rtype = res->type;
*prev = res->next;
elements = --*eltptr;
#ifdef NXAGENT_SERVER
nxagentResChangedFlag = 1;
#endif
if (rtype & RC_CACHED)
FlushClientCaches(res->id);
if (rtype != skipDeleteFuncType)
(*DeleteFuncs[rtype & TypeMask])(res->value, res->id);
xfree(res);
if (*eltptr != elements)
prev = head; /* prev may no longer be valid */
gotOne = TRUE;
}
else
prev = &res->next;
}
if(clients[cid] && (id == clients[cid]->lastDrawableID))
{
clients[cid]->lastDrawable = (DrawablePtr)WindowTable[0];
clients[cid]->lastDrawableID = WindowTable[0]->drawable.id;
}
}
if (!gotOne)
ErrorF("Freeing resource id=%lX which isn't there.\n",
(unsigned long)id);
}
void
FreeResourceByType(XID id, RESTYPE type, Bool skipFree)
{
int cid;
register ResourcePtr res;
register ResourcePtr *prev, *head;
if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets)
{
head = &clientTable[cid].resources[Hash(cid, id)];
prev = head;
while ( (res = *prev) )
{
if (res->id == id && res->type == type)
{
*prev = res->next;
#ifdef NXAGENT_SERVER
nxagentResChangedFlag = 1;
#endif
if (type & RC_CACHED)
FlushClientCaches(res->id);
if (!skipFree)
(*DeleteFuncs[type & TypeMask])(res->value, res->id);
xfree(res);
break;
}
else
prev = &res->next;
}
if(clients[cid] && (id == clients[cid]->lastDrawableID))
{
clients[cid]->lastDrawable = (DrawablePtr)WindowTable[0];
clients[cid]->lastDrawableID = WindowTable[0]->drawable.id;
}
}
}
/*
* Change the value associated with a resource id. Caller
* is responsible for "doing the right thing" with the old
* data
*/
Bool
ChangeResourceValue (XID id, RESTYPE rtype, pointer value)
{
int cid;
register ResourcePtr res;
if (((cid = CLIENT_ID(id)) < MAXCLIENTS) && clientTable[cid].buckets)
{
res = clientTable[cid].resources[Hash(cid, id)];
for (; res; res = res->next)
if ((res->id == id) && (res->type == rtype))
{
if (rtype & RC_CACHED)
FlushClientCaches(res->id);
res->value = value;
return TRUE;
}
}
return FALSE;
}
/* Note: if func adds or deletes resources, then func can get called
* more than once for some resources. If func adds new resources,
* func might or might not get called for them. func cannot both
* add and delete an equal number of resources!
*/
void
FindClientResourcesByType(
ClientPtr client,
RESTYPE type,
FindResType func,
pointer cdata
){
register ResourcePtr *resources;
register ResourcePtr this, next;
int i, elements;
register int *eltptr;
#ifdef NXAGENT_SERVER
register ResourcePtr **resptr;
#endif
if (!client)
client = serverClient;
/*
* If func triggers a resource table
* rebuild then restart the loop.
*/
#ifdef NXAGENT_SERVER
RestartLoop:
#endif
resources = clientTable[client->index].resources;
#ifdef NXAGENT_SERVER
resptr = &clientTable[client->index].resources;
#endif
eltptr = &clientTable[client->index].elements;
for (i = 0; i < clientTable[client->index].buckets; i++)
{
for (this = resources[i]; this; this = next)
{
next = this->next;
if (!type || this->type == type) {
elements = *eltptr;
/*
* FIXME:
* It is not safe to let a function change the resource
* table we are reading!
*/
#ifdef NXAGENT_SERVER
nxagentResChangedFlag = 0;
#endif
(*func)(this->value, this->id, cdata);
/*
* Avoid that a call to RebuildTable() could invalidate the
* pointer. This is safe enough, because in RebuildTable()
* the new pointer is allocated just before the old one is
* freed, so it can't point to the same address.
*/
#ifdef NXAGENT_SERVER
if (*resptr != resources)
goto RestartLoop;
#endif
/*
* It's not enough to check if the number of elements has
* changed, beacause it could happen that the number of
* resources that have been added matches the number of
* the freed ones.
* 'nxagentResChangedFlag' is set if a resource has been
* added or freed.
*/
#ifdef NXAGENT_SERVER
if (*eltptr != elements || nxagentResChangedFlag)
#else
if (*eltptr != elements)
#endif
next = resources[i]; /* start over */
}
}
}
}
void
FindAllClientResources(
ClientPtr client,
FindAllRes func,
pointer cdata
){
register ResourcePtr *resources;
register ResourcePtr this, next;
int i, elements;
register int *eltptr;
#ifdef NXAGENT_SERVER
register ResourcePtr **resptr;
#endif
if (!client)
client = serverClient;
/*
* If func triggers a resource table
* rebuild then restart the loop.
*/
#ifdef NXAGENT_SERVER
RestartLoop:
#endif
resources = clientTable[client->index].resources;
#ifdef NXAGENT_SERVER
resptr = &clientTable[client->index].resources;
#endif
eltptr = &clientTable[client->index].elements;
for (i = 0; i < clientTable[client->index].buckets; i++)
{
for (this = resources[i]; this; this = next)
{
next = this->next;
elements = *eltptr;
/*
* FIXME:
* It is not safe to let a function change the resource
* table we are reading!
*/
#ifdef NXAGENT_SERVER
nxagentResChangedFlag = 0;
#endif
(*func)(this->value, this->id, this->type, cdata);
/*
* Avoid that a call to RebuildTable() could invalidate the
* pointer. This is safe enough, because in RebuildTable()
* the new pointer is allocated just before the old one is
* freed, so it can't point to the same address.
*/
#ifdef NXAGENT_SERVER
if (*resptr != resources)
goto RestartLoop;
#endif
/*
* It's not enough to check if the number of elements has
* changed, beacause it could happen that the number of
* resources that have been added matches the number of
* the freed ones.
* 'nxagentResChangedFlag' is set if a resource has been
* added or freed.
*/
#ifdef NXAGENT_SERVER
if (*eltptr != elements || nxagentResChangedFlag)
#else
if (*eltptr != elements)
#endif
next = resources[i]; /* start over */
}
}
}
pointer
LookupClientResourceComplex(
ClientPtr client,
RESTYPE type,
FindComplexResType func,
pointer cdata
){
ResourcePtr *resources;
ResourcePtr this;
int i;
#ifdef NXAGENT_SERVER
ResourcePtr **resptr;
Bool res;
#endif
if (!client)
client = serverClient;
/*
* If func triggers a resource table
* rebuild then restart the loop.
*/
#ifdef NXAGENT_SERVER
RestartLoop:
#endif
resources = clientTable[client->index].resources;
#ifdef NXAGENT_SERVER
resptr = &clientTable[client->index].resources;
#endif
for (i = 0; i < clientTable[client->index].buckets; i++) {
for (this = resources[i]; this; this = this->next) {
if (!type || this->type == type) {
#ifdef NXAGENT_SERVER
res = (*func)(this->value, this->id, cdata);
if (*resptr != resources)
goto RestartLoop;
if (res)
return this->value;
#else
if((*func)(this->value, this->id, cdata))
return this->value;
#endif
}
}
}
return NULL;
}
void
FreeClientNeverRetainResources(ClientPtr client)
{
ResourcePtr *resources;
ResourcePtr this;
ResourcePtr *prev;
int j;
if (!client)
return;
resources = clientTable[client->index].resources;
for (j=0; j < clientTable[client->index].buckets; j++)
{
prev = &resources[j];
while ( (this = *prev) )
{
RESTYPE rtype = this->type;
if (rtype & RC_NEVERRETAIN)
{
*prev = this->next;
if (rtype & RC_CACHED)
FlushClientCaches(this->id);
(*DeleteFuncs[rtype & TypeMask])(this->value, this->id);
xfree(this);
}
else
prev = &this->next;
}
}
}
void
FreeClientResources(ClientPtr client)
{
register ResourcePtr *resources;
register ResourcePtr this;
int j;
/* This routine shouldn't be called with a null client, but just in
case ... */
if (!client)
return;
HandleSaveSet(client);
resources = clientTable[client->index].resources;
for (j=0; j < clientTable[client->index].buckets; j++)
{
/* It may seem silly to update the head of this resource list as
we delete the members, since the entire list will be deleted any way,
but there are some resource deletion functions "FreeClientPixels" for
one which do a LookupID on another resource id (a Colormap id in this
case), so the resource list must be kept valid up to the point that
it is deleted, so every time we delete a resource, we must update the
head, just like in FreeResource. I hope that this doesn't slow down
mass deletion appreciably. PRH */
ResourcePtr *head;
head = &resources[j];
for (this = *head; this; this = *head)
{
RESTYPE rtype = this->type;
*head = this->next;
if (rtype & RC_CACHED)
FlushClientCaches(this->id);
(*DeleteFuncs[rtype & TypeMask])(this->value, this->id);
xfree(this);
}
}
xfree(clientTable[client->index].resources);
clientTable[client->index].resources = NULL;
clientTable[client->index].buckets = 0;
}
void
FreeAllResources()
{
int i;
for (i = currentMaxClients; --i >= 0; )
{
if (clientTable[i].buckets)
FreeClientResources(clients[i]);
}
}
Bool
LegalNewID(XID id, register ClientPtr client)
{
#ifdef PANORAMIX
XID minid, maxid;
if (!noPanoramiXExtension) {
minid = client->clientAsMask | (client->index ?
SERVER_BIT : SERVER_MINID);
maxid = (clientTable[client->index].fakeID | RESOURCE_ID_MASK) + 1;
if ((id >= minid) && (id <= maxid))
return TRUE;
}
#endif /* PANORAMIX */
return ((client->clientAsMask == (id & ~RESOURCE_ID_MASK)) &&
((clientTable[client->index].expectID <= id) ||
!LookupIDByClass(id, RC_ANY)));
}
#ifdef XCSECURITY
/* SecurityLookupIDByType and SecurityLookupIDByClass:
* These are the heart of the resource ID security system. They take
* two additional arguments compared to the old LookupID functions:
* the client doing the lookup, and the access mode (see resource.h).
* The resource is returned if it exists and the client is allowed access,
* else NULL is returned.
*/
pointer
SecurityLookupIDByType(ClientPtr client, XID id, RESTYPE rtype, Mask mode)
{
int cid;
register ResourcePtr res;
pointer retval = NULL;
assert(client == NullClient ||
(client->index <= currentMaxClients && clients[client->index] == client));
assert( (rtype & TypeMask) <= lastResourceType);
if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
clientTable[cid].buckets)
{
res = clientTable[cid].resources[Hash(cid, id)];
for (; res; res = res->next)
if ((res->id == id) && (res->type == rtype))
{
retval = res->value;
break;
}
}
if (retval && client && client->CheckAccess)
retval = (* client->CheckAccess)(client, id, rtype, mode, retval);
return retval;
}
pointer
SecurityLookupIDByClass(ClientPtr client, XID id, RESTYPE classes, Mask mode)
{
int cid;
register ResourcePtr res = NULL;
pointer retval = NULL;
assert(client == NullClient ||
(client->index <= currentMaxClients && clients[client->index] == client));
assert (classes >= lastResourceClass);
if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
clientTable[cid].buckets)
{
res = clientTable[cid].resources[Hash(cid, id)];
for (; res; res = res->next)
if ((res->id == id) && (res->type & classes))
{
retval = res->value;
break;
}
}
if (retval && client && client->CheckAccess)
retval = (* client->CheckAccess)(client, id, res->type, mode, retval);
return retval;
}
/* We can't replace the LookupIDByType and LookupIDByClass functions with
* macros because of compatibility with loadable servers.
*/
pointer
LookupIDByType(XID id, RESTYPE rtype)
{
return SecurityLookupIDByType(NullClient, id, rtype,
SecurityUnknownAccess);
}
pointer
LookupIDByClass(XID id, RESTYPE classes)
{
return SecurityLookupIDByClass(NullClient, id, classes,
SecurityUnknownAccess);
}
#else /* not XCSECURITY */
/*
* LookupIDByType returns the object with the given id and type, else NULL.
*/
pointer
LookupIDByType(XID id, RESTYPE rtype)
{
int cid;
register ResourcePtr res;
if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
clientTable[cid].buckets)
{
res = clientTable[cid].resources[Hash(cid, id)];
for (; res; res = res->next)
if ((res->id == id) && (res->type == rtype))
return res->value;
}
return (pointer)NULL;
}
/*
* LookupIDByClass returns the object with the given id and any one of the
* given classes, else NULL.
*/
pointer
LookupIDByClass(XID id, RESTYPE classes)
{
int cid;
register ResourcePtr res;
if (((cid = CLIENT_ID(id)) < MAXCLIENTS) &&
clientTable[cid].buckets)
{
res = clientTable[cid].resources[Hash(cid, id)];
for (; res; res = res->next)
if ((res->id == id) && (res->type & classes))
return res->value;
}
return (pointer)NULL;
}
#endif /* XCSECURITY */
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c
View file @ b7916400
...@@ -967,17 +967,8 @@ ProcShmPutImage(client) ...@@ -967,17 +967,8 @@ ProcShmPutImage(client)
return BadValue; return BadValue;
} }
/* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* There's a potential integer overflow in this check: client);
* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* client);
* the version below ought to avoid it
*/
if (stuff->totalHeight != 0 &&
length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
client->errorValue = stuff->totalWidth;
return BadValue;
}
if (stuff->srcX > stuff->totalWidth) if (stuff->srcX > stuff->totalWidth)
{ {
client->errorValue = stuff->srcX; client->errorValue = stuff->srcX;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original
View file @ b7916400
...@@ -967,17 +967,8 @@ ProcShmPutImage(client) ...@@ -967,17 +967,8 @@ ProcShmPutImage(client)
return BadValue; return BadValue;
} }
/* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* There's a potential integer overflow in this check: client);
* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* client);
* the version below ought to avoid it
*/
if (stuff->totalHeight != 0 &&
length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
client->errorValue = stuff->totalWidth;
return BadValue;
}
if (stuff->srcX > stuff->totalWidth) if (stuff->srcX > stuff->totalWidth)
{ {
client->errorValue = stuff->srcX; client->errorValue = stuff->srcX;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
View file @ b7916400
...@@ -863,17 +863,8 @@ ProcShmPutImage(client) ...@@ -863,17 +863,8 @@ ProcShmPutImage(client)
return BadValue; return BadValue;
} }
/* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* There's a potential integer overflow in this check: client);
* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* client);
* the version below ought to avoid it
*/
if (stuff->totalHeight != 0 &&
length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
client->errorValue = stuff->totalWidth;
return BadValue;
}
if (stuff->srcX > stuff->totalWidth) if (stuff->srcX > stuff->totalWidth)
{ {
client->errorValue = stuff->srcX; client->errorValue = stuff->srcX;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment