andreacavalli
/
xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

More missing version checks in SProcs 

The bug in XFixes was also found in GenericEvent and Damage.
This commit is contained in:
Demi Marie Obenour 2021-08-06 13:23:08 -04:00 committed by Povilas Kanapickas
parent e4dabe8d93
commit 659260a0b7
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Xext/geext.c
View File

@ -138,9 +138,15 @@ ProcGEDispatch(ClientPtr client)
static int _X_COLD static int _X_COLD
SProcGEDispatch(ClientPtr client) SProcGEDispatch(ClientPtr client)
{ {
GEClientInfoPtr pGEClient = GEGetClient(client);
REQUEST(xGEReq); REQUEST(xGEReq);
if (stuff->ReqType >= GENumberRequests)
if (pGEClient->major_version >= ARRAY_SIZE(version_requests))
return BadRequest; return BadRequest;
if (stuff->ReqType > version_requests[pGEClient->major_version])
return BadRequest;
return (*SProcGEVector[stuff->ReqType]) (client); return (*SProcGEVector[stuff->ReqType]) (client);
} }

6
damageext/damageext.c
View File

@ -561,7 +561,11 @@ static int _X_COLD
SProcDamageDispatch(ClientPtr client) SProcDamageDispatch(ClientPtr client)
{ {
REQUEST(xDamageReq); REQUEST(xDamageReq);
if (stuff->damageReqType >= XDamageNumberRequests) DamageClientPtr pDamageClient = GetDamageClient(client);
if (pDamageClient->major_version >= ARRAY_SIZE(version_requests))
return BadRequest;
if (stuff->damageReqType > version_requests[pDamageClient->major_version])
return BadRequest; return BadRequest;
return (*SProcDamageVector[stuff->damageReqType]) (client); return (*SProcDamageVector[stuff->damageReqType]) (client);
} }