Commit Graph

62 Commits

Author SHA1 Message Date
Nathan Kidd cad5a1050b Unvalidated lengths
v2: Add overflow check and remove unnecessary check (Julien Cristau)

This addresses:
CVE-2017-12184 in XINERAMA
CVE-2017-12185 in MIT-SCREEN-SAVER
CVE-2017-12186 in X-Resource
CVE-2017-12187 in RENDER

Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Nathan Kidd <nkidd@opentext.com>
Signed-off-by: Julien Cristau <jcristau@debian.org>
2017-10-10 23:33:34 +02:00
Adam Jackson dc7ceda90f dispatch: Mark swapped dispatch as _X_COLD
This touches everything that ends up in the Xorg binary; the big missing
part is GLX since that's all generated code. Cuts about 14k from the
binary on amd64.

Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2017-03-01 10:16:20 -05:00
Adam Jackson 2f981c06a5 xv: Remove some dumb calls SendErrorToClient
We already generate errors from the top level when non-Success is
returned from a dispatch function, so really we were emitting errors
twice.

Signed-off-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Daniel Stone <daniels@collabora.com>
2016-08-16 15:56:22 -04:00
Alan Coopersmith 32a95fb7c7 Xv: unvalidated lengths in XVideo extension swapped procs [CVE-2014-8099]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08 18:09:48 -08:00
Peter Hutterer 732fd7e571 Drop trailing whitespaces
sed -i "s/[ ]\+$//g" **/*.(c|h)

happy reviewing...
git diff -w is an empty diff.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-11-12 10:25:00 +10:00
Eric Anholt ef258fa4fd xv: Drop the ClientPtr from the interface to the DDX.
Nobody was using it.

v2: Merge the hunk that was accidentally in the previous commit into
    this one.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-07 12:39:53 -07:00
Eric Anholt 850b268e2b xv: Remove the no-op AllocatePort/FreePort interfaces.
v2: Fix accidentally squashed-in change for dropping client from the
    arguments, which should have been in the next commit.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com> (v2)
2014-08-07 12:39:48 -07:00
Eric Anholt a146c6d421 xv: Drop the ddQueryAdaptors() interface.
The core was passing pointers to pxvs's nAdaptors and pAdaptors, and
the two hardware implementations were copying pxvs's nAdaptors and
pAdaptors into those pointers.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-08-06 20:12:20 -07:00
Keith Packard 60014a4a98 Replace 'pointer' type with 'void *'
This lets us stop using the 'pointer' typedef in Xdefs.h as 'pointer'
is used throughout the X server for other things, and having duplicate
names generates compiler warnings.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2014-01-12 10:24:11 -08:00
Keith Packard 7710f2b927 Xext: Move MIT-SHM 'ShmDesc' to shmint.h
This data structure is required to use shared memory objects in any
extension. That includes the Xv extension, which (before this patch)
duplicated the definition of this structure in its own code.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-31 16:57:57 -07:00
Peter Hutterer 8bbea9f48f Xext: renaming shadowing variable
xvdisp.c: In function 'ProcXvStopVideo':
xvdisp.c:712:11: warning: declaration of 'rc' shadows a previous local
[-Wshadow]
xvdisp.c:705:17: warning: shadowed declaration is here [-Wshadow]

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
2013-02-15 11:58:27 +10:00
Alan Coopersmith 9805cedf7b Use C99 designated initializers in extension Events
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Daniel Stone <daniel@fooishbar.org>
2012-07-09 22:52:30 -07:00
Alan Coopersmith 6a721e3af5 Use C99 designated initializers in Xext Replies
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Daniel Stone <daniel@fooishbar.org>
2012-07-09 19:58:30 -07:00
Alan Coopersmith 789d64e19a Remove unneccesary casts from WriteToClient calls
Casting return to (void) was used to tell lint that you intended
to ignore the return value, so it didn't warn you about it.

Casting the third argument to (char *) was used as the most generic
pointer type in the days before compilers supported C89 (void *)
(except for a couple places it's used for byte-sized pointer math).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Daniel Stone <daniel@fooishbar.org>
2012-07-09 19:12:56 -07:00
Keith Packard 9838b7032e Introduce a consistent coding style
This is strictly the application of the script 'x-indent-all.sh'
from util/modular. Compared to the patch that Daniel posted in
January, I've added a few indent flags:

	-bap
	-psl
	-T PrivatePtr
	-T pmWait
	-T _XFUNCPROTOBEGIN
	-T _XFUNCPROTOEND
	-T _X_EXPORT

The typedefs were needed to make the output of sdksyms.sh match the
previous output, otherwise, the code is formatted badly enough that
sdksyms.sh generates incorrect output.

The generated code was compared with the previous version and found to
be essentially identical -- "assert" line numbers and BUILD_TIME were
the only differences found.

The comparison was done with this script:

dir1=$1
dir2=$2

for dir in $dir1 $dir2; do
	(cd $dir && find . -name '*.o' | while read file; do
		dir=`dirname $file`
		base=`basename $file .o`
		dump=$dir/$base.dump
		objdump -d $file > $dump
	done)
done

find $dir1 -name '*.dump' | while read dump; do
	otherdump=`echo $dump | sed "s;$dir1;$dir2;"`
	diff -u $dump $otherdump
done

Signed-off-by: Keith Packard <keithp@keithp.com>
Acked-by: Daniel Stone <daniel@fooishbar.org>
Acked-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2012-03-21 13:54:42 -07:00
Dave Airlie 41229392b7 xv: test correct number of requests. (v2)
Pointed out by coverity.

v2: fix swapped as well, as pointed out by Alan

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-12-06 16:01:50 +00:00
Matt Turner 2c7c520cfe Use internal temp variable for swap macros
Also, fix whitespace, mainly around
	swaps(&rep.sequenceNumber)

Reviewed-by: Peter Harris <pharris@opentext.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
2011-09-21 17:12:04 -04:00
Dave Airlie 5fb329a04a panoramiX: convert 1->panoramiXNumScreens loops to use macro (v2)
This converts all the remaining 1->num loops to the macro,
this removes nearly all the panoramiXNumScreens usage in
loops, and is a step to replacing it.

v2: move some from the other patch.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-03-10 11:01:51 +10:00
Dave Airlie 0bccfcc97b panoramiX: convert 0->panoramiXNumScreens loops to macro (v3)
This just uses the FOR_NSCREENS macro instead.

v2: remove some of the 1->x loops.
v3: drop the 1->0 loop, will rework later.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-03-10 11:01:09 +10:00
Mikhail Gusarov 7287ef9e6c Remove unnecessary parentheses around return values in functions
This patch was generated by the following Perl code:

perl -i -pe 's/([^_])return\s*\(\s*([^(]+?)\s*\)s*;(\s+(\n))?/$1return $2;$4/g;'

Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
2010-06-10 06:42:42 -07:00
Jamey Sharp a83cff9f4d Move each screen's x/y origin into ScreenRec.
Many references to the dixScreenOrigins array already had the
corresponding screen pointer handy, which meant they usually looked like
"dixScreenOrigins[pScreen->myNum]". Adding a field to ScreenRec instead
of keeping this information in a parallel array simplifies those
expressions, and eliminates a MAXSCREENS-sized array.

Since dix declared the dixScreenOrigins array, I figure allocating a
screen private for these values is overkill.

Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Tested-by: Tiago Vignatti <tiago.vignatti@nokia.com> (i686 GNU/Linux)
2010-06-03 14:03:23 -07:00
Jamey Sharp 217ccaa5a3 Delete panoramiXdataPtr: it's redundant.
This eliminates a dynamically-allocated MAXSCREENS-sized array.

Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Tested-by: Tiago Vignatti <tiago.vignatti@nokia.com> (i686 GNU/Linux)
2010-06-03 14:03:23 -07:00
Jamey Sharp c38552d115 Add typed resource-lookup errors for non-core resource types.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2010-05-19 12:32:48 -07:00
Jamey Sharp 8033fb6c97 Set event sequence number in WriteEventsToClient instead of at callers.
TryClientEvents already did this; this commit just moves the assignment
one level down so that no event source has to worry about sequence
numbers.

...No event source, that is, except XKB, which inexplicably calls
WriteToClient directly for several events.

Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2010-05-19 12:32:34 -07:00
Jamey Sharp 92ed75ac59 Eliminate boilerplate around client->noClientException.
Just let Dispatch() check for a noClientException, rather than making
every single dispatch procedure take care of it.

Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2010-05-13 17:14:07 -07:00
Mikhail Gusarov 3f3ff971ec Replace X-allocation functions with their C89 counterparts
The only remaining X-functions used in server are XNF*, the rest is converted to
plain alloc/calloc/realloc/free/strdup.

X* functions are still exported from server and x* macros are still defined in
header file, so both ABI and API are not affected by this change.

Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2010-05-13 00:22:37 +07:00
Jamey Sharp 22c4300ee2 Simplify XineramifyXv.
The structure of the adaptor-matching algorithm was obscured by trying
to use "continue" and "break" as the only control-flow primitives. It's
a lot more clear if you add "return" to that set.

Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2010-04-27 10:07:09 -07:00
Alan Coopersmith 895f40792a Add type name argument to CreateNewResourceType
Convert all calls of CreateNewResourceType to pass name argument

Breaks DIX ABI.

ABI versions bumped:

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2009-12-18 17:44:12 -08:00
Alan Coopersmith a11c58fa0c Ensure all resource types created have names registered
Calls RegisterResourceName to record the type name for
use by X-Resource, XACE/SELinux/XTsol, and DTrace.

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2009-12-18 16:51:45 -08:00
Alan Coopersmith eb750f8b5e Check for failures from CreateNewResourceType
Make sure to check return value before setting bitmask flags.
For most calls, just fails to init the extension.   Since Xinput
already calls FatalError() on initialization failure, so does
failure to allocate Xinput's resource type.

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2009-12-18 16:51:45 -08:00
Jamey Sharp 44efcdde50 Fix overlay detection when matching Xv adaptors across screens.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Acked-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2009-10-07 12:46:38 -07:00
Peter Hutterer d3f6b43a24 Update to xextproto 7.0.99.1.
xextproto had Xlib client headers moved into libXext.
Protocol header files are named fooproto.h, header files with constants
foo.h or fooconst.h where foo.h was already in use for client-side headers.
2009-07-15 17:00:05 +10:00
Peter Hutterer 7b9e84e320 Xext: switch to byte counting functions
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2009-07-14 10:14:01 +10:00
Eamon Walsh 57aff88c7d Fix most remaining deprecated resource lookups.
Callsites updated to use dixLookupResourceBy{Type,Class}.
TODO: Audit access modes to make sure they reflect the usage.
2009-04-29 01:04:37 -04:00
Adam Jackson f2d1de6c2a xv: remove useless XVCALL macro 2008-12-19 10:27:37 -05:00
Paulo Cesar Pereira de Andrade 49f77fff14 Rework symbol visibility for easier maintenance
Save in a few special cases, _X_EXPORT should not be used in C source
files. Instead, it should be used in headers, and the proper C source
include that header. Some special cases are symbols that need to be
shared between modules, but not expected to be used by external drivers,
and symbols that are accessible via LoaderSymbol/dlopen.

  This patch also adds conditionally some new sdk header files, depending
on extensions enabled. These files were added to match pattern for
other extensions/modules, that is, have the headers "deciding" symbol
visibility in the sdk. These headers are:
o Xext/panoramiXsrv.h, Xext/panoramiX.h
o fbpict.h (unconditionally)
o vidmodeproc.h
o mioverlay.h (unconditionally, used only by xaa)
o xfixes.h (unconditionally, symbols required by dri2)

  LoaderSymbol and similar functions now don't have different prototypes,
in loaderProcs.h and xf86Module.h, so that both headers can be included,
without the need of defining IN_LOADER.

  xf86NewInputDevice() device prototype readded to xf86Xinput.h, but
not exported (and with a comment about it).
2008-12-03 05:43:34 -02:00
Paulo Cesar Pereira de Andrade d6cbd4511e Export symbols defined in the sdk.
This is the biggest "visibility" patch. Instead of doing a "export"
symbol on demand, export everything in the sdk, so that if some module
fails due to an unresolved symbol, it is because it is using a symbol
not in the sdk.

  Most exported symbols shouldn't really be made visible, neither
advertised in the sdk, as they are only used by a single shared object.

  Symbols in the sdk (or referenced in sdk macros), but not defined
anywhere include:
XkbBuildCoreState()
XkbInitialMap
XkbXIUnsupported
XkbCheckActionVMods()
XkbSendCompatNotify()
XkbDDXFakePointerButton()
XkbDDXApplyConfig()
_XkbStrCaseCmp()
_XkbErrMessages[]
_XkbErrCode
_XkbErrLocation
_XkbErrData
XkbAccessXDetailText()
XkbNKNDetailMaskText()
XkbLookupGroupAndLevel()
XkbInitAtoms()
XkbGetOrderedDrawables()
XkbFreeOrderedDrawables()
XkbConvertXkbComponents()
XkbWriteXKBSemantics()
XkbWriteXKBLayout()
XkbWriteXKBKeymap()
XkbWriteXKBFile()
XkbWriteCFile()
XkbWriteXKMFile()
XkbWriteToServer()
XkbMergeFile()
XkmFindTOCEntry()
XkmReadFileSection()
XkmReadFileSectionName()
InitExtInput()
xf86CheckButton()
xf86SwitchCoreDevice()
RamDacSetGamma()
RamDacRestoreDACValues()
xf86Bpp
xf86ConfigPix24
xf86MouseCflags[]
xf86SupportedMouseTypes[]
xf86NumMouseTypes
xf86ChangeBusIndex()
xf86EntityEnter()
xf86EntityLeave()
xf86WrapperInit()
xf86RingBell()
xf86findOptionBoolean()
xf86debugListOptions()
LoadSubModuleLocal()
LoaderSymbolLocal()
getInt10Rec()
xf86CurrentScreen
xf86ReallocatePciResources()
xf86NewSerialNumber()
xf86RandRSetInitialMode()
fbCompositeSolidMask_nx1xn
fbCompositeSolidMask_nx8888x0565C
fbCompositeSolidMask_nx8888x8888C
fbCompositeSolidMask_nx8x0565
fbCompositeSolidMask_nx8x0888
fbCompositeSolidMask_nx8x8888
fbCompositeSrc_0565x0565
fbCompositeSrc_8888x0565
fbCompositeSrc_8888x0888
fbCompositeSrc_8888x8888
fbCompositeSrcAdd_1000x1000
fbCompositeSrcAdd_8000x8000
fbCompositeSrcAdd_8888x8888
fbGeneration
fbIn
fbOver
fbOver24
fbOverlayGeneration
fbRasterizeEdges
fbRestoreAreas
fbSaveAreas
composeFunctions
VBEBuildVbeModeList()
VBECalcVbeModeIndex()
TIramdac3030CalculateMNPForClock()
shadowBufPtr
shadowFindBuf()
miRRGetScreenInfo()
RRSetScreenConfig()
RRModePruneUnused()
PixmanImageFromPicture()
extern int miPointerGetMotionEvents()
miClipPicture()
miRasterizeTriangle()
fbPush1toN()
fbInitializeBackingStore()
ddxBeforeReset()
SetupSprite()
InitSprite()
DGADeliverEvent()

  SPECIAL CASES
o defined as _X_INTERNAL
	xf86NewInputDevice()
o defined as static
	fbGCPrivateKey
	fbOverlayScreenPrivateKey
	fbScreenPrivateKey
	fbWinPrivateKey
o defined in libXfont.so, but declared in xorg/dixfont.h
	GetGlyphs()
	QueryGlyphExtents()
	QueryTextExtents()
	ParseGlyphCachingMode()
	InitGlyphCaching()
	SetGlyphCachingMode()
2008-11-29 23:56:06 -02:00
Michel Dänzer e46f6ddecc Yet another Xv extension byte swapping fix. 2008-01-16 14:24:22 +01:00
Alan Coopersmith 6844bd2e63 More Xv extension byte swapping fixes 2008-01-09 19:52:00 -08:00
Alan Coopersmith dfd682b582 X.Org bug 4947/Sun bug 6646626: Xv extension not byte-swapping properly
X.Org Bugzilla #4947 <https://bugs.freedesktop.org/show_bug.cgi?id=4947>
Sun bug 6646626 <http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6646626>

Don't use swapped data after swapping it.   When done swapping data,
send the swapped data, not the address of the pointer to it, to the client.
2008-01-02 19:27:22 -08:00
Eamon Walsh c8feb73f58 Merge branch 'master' into XACE-SELINUX
Conflicts:

	Xext/EVI.c
	Xext/bigreq.c
	Xext/cup.c
	Xext/dpms.c
	Xext/fontcache.c
	Xext/mitmisc.c
	Xext/xcmisc.c
	Xext/xf86bigfont.c
	Xext/xtest.c
	configure.ac
	dbe/dbe.c
	hw/darwin/darwin.h
	hw/darwin/darwinEvents.c
	hw/darwin/iokit/xfIOKit.h
	hw/darwin/iokit/xfIOKitCursor.c
	hw/darwin/quartz/fullscreen/fullscreen.c
	hw/darwin/quartz/fullscreen/quartzCursor.c
	hw/darwin/quartz/quartz.c
	hw/darwin/quartz/quartzCommon.h
	hw/darwin/quartz/quartzCursor.c
	hw/darwin/quartz/xpr/dri.c
	hw/darwin/quartz/xpr/dristruct.h
	hw/darwin/quartz/xpr/xprCursor.c
	hw/darwin/quartz/xpr/xprFrame.c
	hw/xfree86/modes/xf86RandR12.c
	include/cursor.h
	miext/rootless/rootlessCommon.h
	miext/rootless/rootlessScreen.c
	miext/rootless/rootlessWindow.c
	render/picturestr.h

Trying to pick up the pieces from the darwin churn here...
2007-12-13 18:38:25 -05:00
Adam Jackson 0fff01f566 Fix swapped Xv dispatch under Xinerama.
Same-endian dispatch was properly calling through the Xinerama wrapping,
but other-endian dispatch wasn't.
2007-12-02 14:15:36 -05:00
Eamon Walsh b61461425e xace: add hooks + new access codes: XV extension.
May need to revisit this extension in the future, depending on observed use.
2007-09-25 09:56:00 -04:00
Eamon Walsh 9bd04055a2 xace: change prototype of VALIDATE_DRAWABLE_AND_GC macro to allow access
mode to be passed to dixLookupDrawable.
2007-09-25 09:33:51 -04:00
Eamon Walsh 4017d31902 devPrivates rework: since API is already broken, switch everything
over to new system.

Need to update documentation and address some remaining vestiges of
old system such as CursorRec structure, fb "offman" structure, and
FontRec privates.
2007-08-28 09:28:25 -04:00
Eamon Walsh 04c721854f Convert callers of LookupWindow() to dixLookupWindow(). 2006-12-15 14:19:54 -05:00
Eamon Walsh 00f0705b3b Remove instances of macros SECURITY_VERIFY_GEOMETRABLE and SECURITY_VERIFY_GC. 2006-12-14 19:15:21 -05:00
Eamon Walsh 0cf75e7432 Remove instances of macros LOOKUP_DRAWABLE and VERIFY_DRAWABLE. 2006-12-14 17:45:11 -05:00
Eamon Walsh 6c46645cfc Naming change: Security*Access -> Dix*Access 2006-12-14 14:45:42 -05:00
Adam Jackson 0aaac95b0d Remove RCS tags. Fix Xprint makefile braindamage. 2006-07-21 17:56:00 -04:00