Skip to content

N
nx-libs
Commit b7916400 authored by Reinhard Tartler's avatar Reinhard Tartler
Browse files
Options

Imported nxagent-3.2.0-5.tar.gz

Summary: Imported nxagent-3.2.0-5.tar.gz Keywords: Imported nxagent-3.2.0-5.tar.gz into Git repository
parent 1c25e92b
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 96 additions and 330 deletions
nx-X11/programs/Xserver/hw/nxagent/Args.c
View file @ b7916400
......@@ -2080,8 +2080,8 @@ void nxagentSetDeferLevel()
deferTimeout = 200;
tileWidth = 4096;
tileHeight = 4096;
tileWidth = 65536;
tileHeight = 65536;
break;
}
......@@ -2091,8 +2091,8 @@ void nxagentSetDeferLevel()
deferTimeout = 200;
tileWidth = 4096;
tileHeight = 4096;
tileWidth = 65536;
tileHeight = 65536;
break;
}
......@@ -2103,8 +2103,8 @@ void nxagentSetDeferLevel()
deferTimeout = 200;
tileWidth = 4096;
tileHeight = 4096;
tileWidth = 65536;
tileHeight = 65536;
break;
}
......
nx-X11/programs/Xserver/hw/nxagent/CHANGELOG
View file @ b7916400
ChangeLog:
nxagent-3.2.0-10
- Extended fix for TR07F02091 to include font names having zero in
fields RESOLUTION_X and RESOLUTION_Y.
nxagent-3.2.0-9
- Fixed TR07F02091. Scalable fonts were not correctly listed among
available fonts.
- Fixed TR06F02080. Use the corrupted area extents as maximum size of
the image data.
nxagent-3.2.0-8
- Fixed TR07F02082. The agent server could be unable to init core
keyboard on 64 bit systems.
nxagent-3.2.0-7
- Imported patch fixing issues from X.Org security advisory, June
11th, 2008: Multiple vulnerabilities in X server extensions. CVE
IDs: CVE-2008-1377, CVE-2008-1379, CVE-2008-2360, CVE-2008-2361,
CVE-2008-2362.
nxagent-3.2.0-6
- Fixed TR05F02063. Ignore ReparentNotify events for non-rootless
sessions.
- Fixed TR06F02068. Try to pack images only if format is ZPixmap.
- Don't require reparent on close of NX window.
nxagent-3.2.0-5
- Fixed TR04F02044. Restored the original MakeRootTile() function in
......
nx-X11/programs/Xserver/hw/nxagent/CHANGELOG.orig deleted 100644 → 0
View file @ 1c25e92b
This source diff could not be displayed because it is too large. You can view the blob instead.
nx-X11/programs/Xserver/hw/nxagent/Drawable.c
View file @ b7916400
......@@ -371,7 +371,6 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned
int nBox;
int x, y;
int w, h;
int extentWidth, extentHeight;
int tileWidth, tileHeight;
int length, format, leftPad;
int i;
......@@ -591,20 +590,8 @@ int nxagentSynchronizeRegion(DrawablePtr pDrawable, RegionPtr pRegion, unsigned
pDrawable -> x, pDrawable -> y, pDrawable -> width, pDrawable -> height);
#endif
/*
* We are going to synchronize the corrupted
* area, so we use the corrupted extents as
* maximum size of the image data. It's im-
* portant to avoid using the drawable size,
* because in case of a huge window it had to
* result in a failed data memory allocation.
*/
extentWidth = clipRegion -> extents.x2 - clipRegion -> extents.x1;
extentHeight = clipRegion -> extents.y2 - clipRegion -> extents.y1;
w = tileWidth = (nxagentOption(TileWidth) > extentWidth ? extentWidth : nxagentOption(TileWidth));
h = tileHeight = (nxagentOption(TileHeight) > extentHeight ? extentHeight : nxagentOption(TileHeight));
w = tileWidth = (nxagentOption(TileWidth) > pDrawable -> width ? pDrawable -> width : nxagentOption(TileWidth));
h = tileHeight = (nxagentOption(TileHeight) > pDrawable -> height ? pDrawable -> height : nxagentOption(TileHeight));
#ifdef DEBUG
fprintf(stderr, "nxagentSynchronizeRegion: Using tiles of size [%dx%d].\n", tileWidth, tileHeight);
......@@ -2626,10 +2613,7 @@ void nxagentCreateDrawableBitmap(DrawablePtr pDrawable)
* FIXME: A better way it would be create the bitmap
* with the same extents of the clipRegion. This
* requires to save the offset with respect to the
* drawable origin like in the backing store. This
* becomes particularly important when the drawable
* is a huge window, because the pixmap creation
* would fail.
* drawable origin like in the backing store.
*/
pBitmap = nxagentCreatePixmap(pDrawable -> pScreen, pDrawable -> width, pDrawable -> height, pDrawable -> depth);
......
nx-X11/programs/Xserver/hw/nxagent/Events.c
View file @ b7916400
......@@ -2261,11 +2261,7 @@ int nxagentHandleClientMessageEvent(XEvent *X, enum HandleEventResult *result)
{
pScreen = nxagentScreen(X -> xmap.window);
XMapRaised(nxagentDisplay, nxagentFullscreenWindow);
XIconifyWindow(nxagentDisplay, nxagentIconWindow,
DefaultScreen(nxagentDisplay));
nxagentMaximizeToFullScreen(pScreen);
}
if (X -> xclient.window == (nxagentOption(Fullscreen) ?
......@@ -3062,6 +3058,56 @@ int nxagentHandleReparentNotify(XEvent* X)
return 1;
}
else
{
/*
* This code is supposed to detect if a window manager
* is running but in some cases it may be unreliable.
* Each window manager behaves differently so the check
* can fail for some less common WMs.
*/
if (!nxagentWMIsRunning && nxagentOption(Fullscreen) &&
X -> xreparent.window == nxagentDefaultWindows[pScreen -> myNum])
{
#ifdef WARNING
fprintf(stderr, "Warning: The agent window was reparented. Is a "
"window manager running?\n");
#endif
/*
* If no window manager is running and we are supposed to
* be in fullscreen mode then don't wait for the reparent
* event. We can assume that there is an undetected window
* manager and, as switching to fullscreen could have fail-
* ed, we try it again.
*/
nxagentSwitchFullscreen(pScreen, True);
nxagentWMIsRunning = True;
}
else if (nxagentWMIsRunning && X -> xreparent.window ==
nxagentDefaultWindows[pScreen -> myNum] && X -> xreparent.parent ==
RootWindow(nxagentDisplay, (pScreen -> myNum)))
{
#ifdef WARNING
fprintf(stderr, "Warning: The agent window has been reparented to the root.\n");
fprintf(stderr, "Warning: No window manager seems to be running.\n");
#endif
/*
* The agent window was unexpectedly reparented
* to the root window. We assume that the window
* manager was terminated.
*/
nxagentWMIsRunning = False;
}
}
return 1;
}
......
nx-X11/programs/Xserver/hw/nxagent/Font.c
View file @ b7916400
......@@ -101,8 +101,6 @@ static XFontStruct *nxagentLoadQueryFont(register Display *dpy , char *fontName
int nxagentFreeFont(XFontStruct *fs);
static Bool nxagentGetFontServerPath(char * fontServerPath);
static char * nxagentMakeScalableFontName(const char *fontName, int scalableResolution);
RESTYPE RT_NX_FONT;
#ifdef NXAGENT_RECONNECT_FONT_DEBUG
......@@ -421,59 +419,13 @@ Bool nxagentFontFind(const char *name, int *pos)
Bool nxagentFontLookUp(const char *name)
{
int i;
int result;
char *scalable;
if (name != NULL && strlen(name) == 0)
{
return 0;
}
result = nxagentFontFind(name, &i);
scalable = NULL;
/*
* Let's try with the scalable font description.
*/
if (result == 0)
{
scalable = nxagentMakeScalableFontName(name, 0);
if (scalable != NULL)
{
result = nxagentFontFind(scalable, &i);
free(scalable);
}
}
/*
* Let's try again after replacing zero to xdpi and ydpi in the pattern.
*/
if (result == 0)
{
scalable = nxagentMakeScalableFontName(name, 1);
if (scalable != NULL)
{
result = nxagentFontFind(scalable, &i);
free(scalable);
}
}
if (result == 0)
{
return 0;
}
else
{
if (name)
if (!strlen(name))
return 0;
if (nxagentFontFind(name, &i))
return (nxagentRemoteFontList.list[i]->status > 0);
}
else
return 0;
}
Bool nxagentRealizeFont(ScreenPtr pScreen, FontPtr pFont)
......@@ -1746,88 +1698,3 @@ int nxagentSplitString(char *string, char *fields[], int nfields, char *sep)
return i;
}
char *nxagentMakeScalableFontName(const char *fontName, int scalableResolution)
{
char *scalableFontName;
const char *s;
int len;
int field;
len = strlen(fontName) + 1;
scalableFontName = malloc(len);
if (scalableFontName == NULL)
{
#ifdef PANIC
fprintf(stderr, "nxagentMakeScalableFontName: PANIC! malloc() failed.\n");
#endif
return NULL;
}
scalableFontName[0] = 0;
if (*fontName != '-')
{
goto MakeScalableFontNameError;
}
s = fontName;
field = 0;
while (s != NULL)
{
s = strchr(s + 1, '-');
if (s != NULL)
{
if (field == 6 || field == 7 || field == 11)
{
/*
* PIXEL_SIZE || POINT_SIZE || AVERAGE_WIDTH
*/
strcat(scalableFontName, "-0");
}
else if (scalableResolution == 1 && (field == 8 || field == 9))
{
/*
* RESOLUTION_X || RESOLUTION_Y
*/
strcat(scalableFontName, "-0");
}
else
{
strncat(scalableFontName, fontName, s - fontName);
}
fontName = s;
}
else
{
strcat(scalableFontName, fontName);
}
field++;
}
if (field != 14)
{
goto MakeScalableFontNameError;
}
return scalableFontName;
MakeScalableFontNameError:
free(scalableFontName);
#ifdef DEBUG
fprintf(stderr, "nxagentMakeScalableFontName: Invalid font name.\n");
#endif
return NULL;
}
nx-X11/programs/Xserver/hw/nxagent/Image.c
View file @ b7916400
......@@ -1176,7 +1176,7 @@ FIXME: Should use an unpack resource here.
*/
pack = (nxagentOption(LinkType) != LINK_TYPE_NONE &&
packMethod != PACK_NONE && depth > 8 && format == ZPixmap);
packMethod != PACK_NONE && depth > 8);
lossless = (packMethod == nxagentPackLossless);
......
nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
View file @ b7916400
......@@ -444,7 +444,7 @@ N/A
max_keycode - min_keycode + 1,
&mapWidth);
if (keymap64 == NULL)
if (keymap == NULL)
{
XFreeModifiermap(modifier_keymap);
......
nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c
View file @ b7916400
......@@ -69,17 +69,6 @@
#undef DEBUG
#undef TEST
#else
#include "picturestr.h"
#include "glyphstr.h"
#endif
#if HAVE_STDINT_H
#include <stdint.h>
#elif !defined(UINT32_MAX)
#define UINT32_MAX 0xffffffffU
#endif
/*
......@@ -412,12 +401,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{
int size;
GlyphPtr glyph;
size_t padded_width;
padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
return 0;
size = gi->height * padded_width;
size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph)
return 0;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.NX.original
View file @ b7916400
......@@ -69,17 +69,6 @@
#undef DEBUG
#undef TEST
#else
#include "picturestr.h"
#include "glyphstr.h"
#endif
#if HAVE_STDINT_H
#include <stdint.h>
#elif !defined(UINT32_MAX)
#define UINT32_MAX 0xffffffffU
#endif
/*
......@@ -412,12 +401,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{
int size;
GlyphPtr glyph;
size_t padded_width;
padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
return 0;
size = gi->height * padded_width;
size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph)
return 0;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXglyph.c.X.original
View file @ b7916400
......@@ -43,12 +43,6 @@
#include "picturestr.h"
#include "glyphstr.h"
#if HAVE_STDINT_H
#include <stdint.h>
#elif !defined(UINT32_MAX)
#define UINT32_MAX 0xffffffffU
#endif
/*
* From Knuth -- a good choice for hash/rehash values is p, p-2 where
* p and p-2 are both prime. These tables are sized to have an extra 10%
......@@ -340,12 +334,8 @@ AllocateGlyph (xGlyphInfo *gi, int fdepth)
{
int size;
GlyphPtr glyph;
size_t padded_width;
padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
return 0;
size = gi->height * padded_width;
size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
if (!glyph)
return 0;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c
View file @ b7916400
......@@ -1893,8 +1893,6 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height;
if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
return BadAlloc;
if ( stuff->x > width
|| stuff->y > height )
return (BadMatch);
......@@ -2355,8 +2353,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -2959,18 +2955,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client);
}
static void swapStops(void *stuff, int num)
static void swapStops(void *stuff, int n)
{
int i, n;
int i;
CARD32 *stops;
CARD16 *colors;
stops = (CARD32 *)(stuff);
for (i = 0; i < num; ++i) {
for (i = 0; i < n; ++i) {
swapl(stops, n);
++stops;
}
colors = (CARD16 *)(stops);
for (i = 0; i < 4*num; ++i) {
for (i = 0; i < 4*n; ++i) {
swaps(stops, n);
++stops;
}
......@@ -2993,8 +2989,6 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -3022,8 +3016,6 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -3048,8 +3040,6 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.NX.original
View file @ b7916400
......@@ -1893,8 +1893,6 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height;
if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
return BadAlloc;
if ( stuff->x > width
|| stuff->y > height )
return (BadMatch);
......@@ -2355,8 +2353,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -2959,18 +2955,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client);
}
static void swapStops(void *stuff, int num)
static void swapStops(void *stuff, int n)
{
int i, n;
int i;
CARD32 *stops;
CARD16 *colors;
stops = (CARD32 *)(stuff);
for (i = 0; i < num; ++i) {
for (i = 0; i < n; ++i) {
swapl(stops, n);
++stops;
}
colors = (CARD16 *)(stops);
for (i = 0; i < 4*num; ++i) {
for (i = 0; i < 4*n; ++i) {
swaps(stops, n);
++stops;
}
......@@ -2993,8 +2989,6 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -3022,8 +3016,6 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -3048,8 +3040,6 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXrender.c.X.original
View file @ b7916400
......@@ -1505,8 +1505,6 @@ ProcRenderCreateCursor (ClientPtr client)
pScreen = pSrc->pDrawable->pScreen;
width = pSrc->pDrawable->width;
height = pSrc->pDrawable->height;
if (height && width > UINT32_MAX/(height*sizeof(CARD32)))
return BadAlloc;
if ( stuff->x > width
|| stuff->y > height )
return (BadMatch);
......@@ -1920,8 +1918,6 @@ static int ProcRenderCreateLinearGradient (ClientPtr client)
LEGAL_NEW_RESOURCE(stuff->pid, client);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -2493,18 +2489,18 @@ SProcRenderCreateSolidFill(ClientPtr client)
return (*ProcRenderVector[stuff->renderReqType]) (client);
}
static void swapStops(void *stuff, int num)
static void swapStops(void *stuff, int n)
{
int i, n;
int i;
CARD32 *stops;
CARD16 *colors;
stops = (CARD32 *)(stuff);
for (i = 0; i < num; ++i) {
for (i = 0; i < n; ++i) {
swapl(stops, n);
++stops;
}
colors = (CARD16 *)(stops);
for (i = 0; i < 4*num; ++i) {
for (i = 0; i < 4*n; ++i) {
swaps(stops, n);
++stops;
}
......@@ -2527,8 +2523,6 @@ SProcRenderCreateLinearGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -2556,8 +2550,6 @@ SProcRenderCreateRadialGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......@@ -2582,8 +2574,6 @@ SProcRenderCreateConicalGradient (ClientPtr client)
swapl(&stuff->nStops, n);
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
return BadLength;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXresource.c.NX.original
View file @ b7916400
......@@ -194,6 +194,10 @@ static DeleteType *DeleteFuncs = (DeleteType *)NULL;
Atom * ResourceNames = NULL;
#ifdef NXAGENT_SERVER
static int nxagentResChangedFlag = 0;
#endif
void RegisterResourceName (RESTYPE type, char *name)
{
ResourceNames[type & TypeMask] = MakeAtom(name, strlen(name), TRUE);
......@@ -201,10 +205,6 @@ void RegisterResourceName (RESTYPE type, char *name)
#endif
#ifdef NXAGENT_SERVER
static int nxagentResChangedFlag = 0;
#endif
RESTYPE
CreateNewResourceType(DeleteType deleteFunc)
{
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c
View file @ b7916400
......@@ -967,17 +967,8 @@ ProcShmPutImage(client)
return BadValue;
}
/*
* There's a potential integer overflow in this check:
* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* client);
* the version below ought to avoid it
*/
if (stuff->totalHeight != 0 &&
length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
client->errorValue = stuff->totalWidth;
return BadValue;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
client);
if (stuff->srcX > stuff->totalWidth)
{
client->errorValue = stuff->srcX;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.NX.original
View file @ b7916400
......@@ -967,17 +967,8 @@ ProcShmPutImage(client)
return BadValue;
}
/*
* There's a potential integer overflow in this check:
* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* client);
* the version below ought to avoid it
*/
if (stuff->totalHeight != 0 &&
length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
client->errorValue = stuff->totalWidth;
return BadValue;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
client);
if (stuff->srcX > stuff->totalWidth)
{
client->errorValue = stuff->srcX;
......
nx-X11/programs/Xserver/hw/nxagent/X/NXshm.c.X.original
View file @ b7916400
......@@ -863,17 +863,8 @@ ProcShmPutImage(client)
return BadValue;
}
/*
* There's a potential integer overflow in this check:
* VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
* client);
* the version below ought to avoid it
*/
if (stuff->totalHeight != 0 &&
length > (shmdesc->size - stuff->offset)/stuff->totalHeight) {
client->errorValue = stuff->totalWidth;
return BadValue;
}
VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight,
client);
if (stuff->srcX > stuff->totalWidth)
{
client->errorValue = stuff->srcX;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment