Commit e364fde7 authored by Mike Gabriel's avatar Mike Gabriel

Merge pull request #36 from ArcticaProject/pr/render-cve-fixes

XRender CVE fixes for nxagent (X.Org CVE-2014-8100)
parents 230852e0 a0c90ad3
...@@ -387,10 +387,11 @@ ProcRenderQueryVersion (ClientPtr client) ...@@ -387,10 +387,11 @@ ProcRenderQueryVersion (ClientPtr client)
register int n; register int n;
REQUEST(xRenderQueryVersionReq); REQUEST(xRenderQueryVersionReq);
REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
pRenderClient->major_version = stuff->majorVersion; pRenderClient->major_version = stuff->majorVersion;
pRenderClient->minor_version = stuff->minorVersion; pRenderClient->minor_version = stuff->minorVersion;
REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
rep.type = X_Reply; rep.type = X_Reply;
rep.length = 0; rep.length = 0;
rep.sequenceNumber = client->sequence; rep.sequenceNumber = client->sequence;
...@@ -2531,6 +2532,7 @@ SProcRenderQueryVersion (ClientPtr client) ...@@ -2531,6 +2532,7 @@ SProcRenderQueryVersion (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderQueryVersionReq); REQUEST(xRenderQueryVersionReq);
REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->majorVersion, n); swapl(&stuff->majorVersion, n);
...@@ -2543,6 +2545,7 @@ SProcRenderQueryPictFormats (ClientPtr client) ...@@ -2543,6 +2545,7 @@ SProcRenderQueryPictFormats (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderQueryPictFormatsReq); REQUEST(xRenderQueryPictFormatsReq);
REQUEST_SIZE_MATCH(xRenderQueryPictFormatsReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
return (*ProcRenderVector[stuff->renderReqType]) (client); return (*ProcRenderVector[stuff->renderReqType]) (client);
} }
...@@ -2552,6 +2555,7 @@ SProcRenderQueryPictIndexValues (ClientPtr client) ...@@ -2552,6 +2555,7 @@ SProcRenderQueryPictIndexValues (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderQueryPictIndexValuesReq); REQUEST(xRenderQueryPictIndexValuesReq);
REQUEST_AT_LEAST_SIZE(xRenderQueryPictIndexValuesReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->format, n); swapl(&stuff->format, n);
return (*ProcRenderVector[stuff->renderReqType]) (client); return (*ProcRenderVector[stuff->renderReqType]) (client);
...@@ -2568,6 +2572,7 @@ SProcRenderCreatePicture (ClientPtr client) ...@@ -2568,6 +2572,7 @@ SProcRenderCreatePicture (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderCreatePictureReq); REQUEST(xRenderCreatePictureReq);
REQUEST_AT_LEAST_SIZE(xRenderCreatePictureReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->pid, n); swapl(&stuff->pid, n);
swapl(&stuff->drawable, n); swapl(&stuff->drawable, n);
...@@ -2582,6 +2587,7 @@ SProcRenderChangePicture (ClientPtr client) ...@@ -2582,6 +2587,7 @@ SProcRenderChangePicture (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderChangePictureReq); REQUEST(xRenderChangePictureReq);
REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->picture, n); swapl(&stuff->picture, n);
swapl(&stuff->mask, n); swapl(&stuff->mask, n);
...@@ -2594,6 +2600,7 @@ SProcRenderSetPictureClipRectangles (ClientPtr client) ...@@ -2594,6 +2600,7 @@ SProcRenderSetPictureClipRectangles (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderSetPictureClipRectanglesReq); REQUEST(xRenderSetPictureClipRectanglesReq);
REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->picture, n); swapl(&stuff->picture, n);
SwapRestS(stuff); SwapRestS(stuff);
...@@ -2605,6 +2612,7 @@ SProcRenderFreePicture (ClientPtr client) ...@@ -2605,6 +2612,7 @@ SProcRenderFreePicture (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderFreePictureReq); REQUEST(xRenderFreePictureReq);
REQUEST_SIZE_MATCH(xRenderFreePictureReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->picture, n); swapl(&stuff->picture, n);
return (*ProcRenderVector[stuff->renderReqType]) (client); return (*ProcRenderVector[stuff->renderReqType]) (client);
...@@ -2615,6 +2623,7 @@ SProcRenderComposite (ClientPtr client) ...@@ -2615,6 +2623,7 @@ SProcRenderComposite (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderCompositeReq); REQUEST(xRenderCompositeReq);
REQUEST_SIZE_MATCH(xRenderCompositeReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->src, n); swapl(&stuff->src, n);
swapl(&stuff->mask, n); swapl(&stuff->mask, n);
...@@ -2635,6 +2644,7 @@ SProcRenderScale (ClientPtr client) ...@@ -2635,6 +2644,7 @@ SProcRenderScale (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderScaleReq); REQUEST(xRenderScaleReq);
REQUEST_SIZE_MATCH(xRenderScaleReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->src, n); swapl(&stuff->src, n);
swapl(&stuff->dst, n); swapl(&stuff->dst, n);
...@@ -2740,6 +2750,7 @@ SProcRenderCreateGlyphSet (ClientPtr client) ...@@ -2740,6 +2750,7 @@ SProcRenderCreateGlyphSet (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderCreateGlyphSetReq); REQUEST(xRenderCreateGlyphSetReq);
REQUEST_SIZE_MATCH(xRenderCreateGlyphSetReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->gsid, n); swapl(&stuff->gsid, n);
swapl(&stuff->format, n); swapl(&stuff->format, n);
...@@ -2751,6 +2762,7 @@ SProcRenderReferenceGlyphSet (ClientPtr client) ...@@ -2751,6 +2762,7 @@ SProcRenderReferenceGlyphSet (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderReferenceGlyphSetReq); REQUEST(xRenderReferenceGlyphSetReq);
REQUEST_SIZE_MATCH(xRenderReferenceGlyphSetReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->gsid, n); swapl(&stuff->gsid, n);
swapl(&stuff->existing, n); swapl(&stuff->existing, n);
...@@ -2762,6 +2774,7 @@ SProcRenderFreeGlyphSet (ClientPtr client) ...@@ -2762,6 +2774,7 @@ SProcRenderFreeGlyphSet (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderFreeGlyphSetReq); REQUEST(xRenderFreeGlyphSetReq);
REQUEST_SIZE_MATCH(xRenderFreeGlyphSetReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->glyphset, n); swapl(&stuff->glyphset, n);
return (*ProcRenderVector[stuff->renderReqType]) (client); return (*ProcRenderVector[stuff->renderReqType]) (client);
...@@ -2776,6 +2789,7 @@ SProcRenderAddGlyphs (ClientPtr client) ...@@ -2776,6 +2789,7 @@ SProcRenderAddGlyphs (ClientPtr client)
void *end; void *end;
xGlyphInfo *gi; xGlyphInfo *gi;
REQUEST(xRenderAddGlyphsReq); REQUEST(xRenderAddGlyphsReq);
REQUEST_AT_LEAST_SIZE(xRenderAddGlyphsReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->glyphset, n); swapl(&stuff->glyphset, n);
swapl(&stuff->nglyphs, n); swapl(&stuff->nglyphs, n);
...@@ -2812,6 +2826,7 @@ SProcRenderFreeGlyphs (ClientPtr client) ...@@ -2812,6 +2826,7 @@ SProcRenderFreeGlyphs (ClientPtr client)
{ {
register int n; register int n;
REQUEST(xRenderFreeGlyphsReq); REQUEST(xRenderFreeGlyphsReq);
REQUEST_AT_LEAST_SIZE(xRenderFreeGlyphsReq);
swaps(&stuff->length, n); swaps(&stuff->length, n);
swapl(&stuff->glyphset, n); swapl(&stuff->glyphset, n);
SwapRestL(stuff); SwapRestL(stuff);
...@@ -2830,7 +2845,8 @@ SProcRenderCompositeGlyphs (ClientPtr client) ...@@ -2830,7 +2845,8 @@ SProcRenderCompositeGlyphs (ClientPtr client)
int size; int size;
REQUEST(xRenderCompositeGlyphsReq); REQUEST(xRenderCompositeGlyphsReq);
REQUEST_AT_LEAST_SIZE(xRenderCompositeGlyphsReq);
switch (stuff->renderReqType) { switch (stuff->renderReqType) {
default: size = 1; break; default: size = 1; break;
case X_RenderCompositeGlyphs16: size = 2; break; case X_RenderCompositeGlyphs16: size = 2; break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment