andreacavalli
/
xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

glxproxy: Use _XEatDataWords (from Xlib 1.6) instead of _XEatData 

Reduces risk of overflow from converting length field in X replies
from words to bytes.   (Also seems to be what several calls were
already incorrectly passing to _XEatData.)

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
This commit is contained in:
Alan Coopersmith 2013-07-05 22:35:32 -07:00
parent 87b0cabc14
commit a3d43edf71
5 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
configure.ac
View File

@ -2003,7 +2003,7 @@ AM_CONDITIONAL(STANDALONE_XPBPROXY, [test "x$STANDALONE_XPBPROXY" = xyes])
dnl DMX DDX
PKG_CHECK_MODULES(
[DMXMODULES],
[xmuu $LIBXEXT x11 xrender xfixes $LIBXI $DMXPROTO xau $XDMCP_MODULES],
[xmuu $LIBXEXT x11 >= 1.6 xrender xfixes $LIBXI $DMXPROTO xau $XDMCP_MODULES],
[PKG_CHECK_MODULES(
[XDMXCONFIG_DEP],
[xaw7 xmu xt xpm x11],

4
hw/dmx/glxProxy/glxcmds.c
View File

@ -2610,7 +2610,7 @@ __glXQueryExtensionsString(__GLXclientState * cl, GLbyte * pc)
be_buf = (char *) malloc(numbytes);
if (!be_buf) {
/* Throw data on the floor */
_XEatData(dpy, len);
_XEatDataWords(dpy, len);
}
else {
_XReadPad(dpy, (char *) be_buf, numbytes);
@ -2691,7 +2691,7 @@ __glXQueryServerString(__GLXclientState * cl, GLbyte * pc)
be_buf = (char *) malloc(numbytes);
if (!be_buf) {
/* Throw data on the floor */
_XEatData(dpy, len);
_XEatDataWords(dpy, len);
}
else {
_XReadPad(dpy, (char *) be_buf, numbytes);

2
hw/dmx/glxProxy/glxscreens.c
View File

@ -154,7 +154,7 @@ CalcServerVersionAndExtensions(void)
be_extensions[s] = (char *) malloc(numbytes);
if (!be_extensions[s]) {
/* Throw data on the floor */
_XEatData(dpy, length);
_XEatDataWords(dpy, length);
}
else {
_XReadPad(dpy, (char *) be_extensions[s], numbytes);

6
hw/dmx/glxProxy/glxsingle.c
View File

@ -258,7 +258,7 @@ __glXForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
_XEatData(dpy, be_buf_size);
_XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}
@ -357,7 +357,7 @@ __glXForwardAllWithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
_XEatData(dpy, be_buf_size);
_XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}
@ -993,7 +993,7 @@ __glXDisp_ReadPixels(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
_XEatData(dpy, be_buf_size);
_XEatDataWords(dpy, be_reply.length);
free(buf);
return BadAlloc;
}

4
hw/dmx/glxProxy/glxvendor.c
View File

@ -246,7 +246,7 @@ __glXVForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
_XEatData(dpy, be_buf_size);
_XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}
@ -340,7 +340,7 @@ __glXVForwardAllWithReply(__GLXclientState * cl, GLbyte * pc)
}
else {
/* Throw data on the floor */
_XEatData(dpy, be_buf_size);
_XEatDataWords(dpy, be_reply.length);
return BadAlloc;
}
}