Commit Graph

5696 Commits

Author SHA1 Message Date
Ryan Pavlik
3c501691a0 hw/xwin: Fix possible null ptr deref in winActivateAppPrimaryDD()
Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
2012-01-07 22:50:09 +00:00
Ryan Pavlik
a492c02649 hw/xwin: Fix possible null ptr deref in winActivateAppNativeGDI()
Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
2012-01-07 22:50:08 +00:00
Ryan Pavlik
b907079596 hw/xwin: Clarify an if statement mixed with ifdef in winSetEngine()
Use the same pattern as elsewhere so it's a bit clearer what we
are checking

Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
2012-01-07 22:50:06 +00:00
Ryan Pavlik
5c35dd7be7 hw/xwin: Fix rrScreenSetSize function pointer mismatch
winrandr.c: In function ‘winRandRInit’:
winrandr.c:218:31: warning: assignment from incompatible pointer type

Fix winRandRScreenSetSize() function signature to match RRScreenSetSizeProcPtr type,
to align with commit fd9331f6 'Revert "Separate out screen size and screen pixmap
sizes in RRScreenSizeSet"'

This is fall-out from the late revert of RANDR 1.4 in the 1.10 release cycle, it will
probably need to be reverted if/when that goes back in again.

Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
2012-01-07 22:50:04 +00:00
Ryan Pavlik
aa07d82908 hw/xwin: Remove an empty #if 0/#endif
Um... yeah

Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
2012-01-07 22:50:02 +00:00
Ryan Pavlik
d459f42e64 hw/xwin: Fix double-free in error path in winQueryRGBBitsAndMasks()
Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
2012-01-07 22:50:01 +00:00
Ryan Pavlik
cc7dedd6b5 hw/xwin: Fix a memory leak in error path in winInitWM()
Signed-off-by: Ryan Pavlik <rpavlik@iastate.edu>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
2012-01-07 22:49:51 +00:00
Keith Packard
8dedf9831b Merge remote-tracking branch 'kibi/master' 2011-12-27 13:13:48 -08:00
Cyril Brulebois
cf96183122 xorg.conf.man: Fix bad whatis entry.
Debian's QA tool “lintian” reported a bad whatis entry for the
xorg.conf(.d) manpages.

It comes with the following pointers:
  For manual pages that document multiple programs, functions, files, or
  other things, the part before "\-" should list each separated by a
  comma and a space. […]

  Refer to the lexgrog(1) manual page, the groff_man(7) manual page, and
  the groff_mdoc(7) manual page for details.

Indeed, the current situation is:
  $ whatis xorg.conf; whatis xorg.conf.d
  xorg.conf (5)        - (unknown subject)
  xorg.conf.d (5)      - (unknown subject)

With this patch:
  xorg.conf (5)        - configuration files for Xorg X server
  xorg.conf.d (5)      - configuration files for Xorg X server

Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Cyril Brulebois <kibi@debian.org>
2011-12-22 16:00:31 +01:00
Peter Hutterer
e395efc25f Merge branch 'master' of git+ssh://git.freedesktop.org/git/xorg/xserver into multitouch
Conflicts:
	configure.ac
	dix/inpututils.c

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-22 09:29:59 +10:00
Keith Packard
2d34b34ed7 Merge remote-tracking branch 'jeremyhu/master' 2011-12-20 00:23:33 -08:00
Ville Syrjälä
4df65d247b dri2: Invalidate window pixmaps
While a redirected window is flipped, its pixmap may still be used as
and EGL image and should also get invalidated. When sending invalidate
events for a window, also send the events for its pixmap.

Signed-off-by: Ville Syrjälä <syrjala@sci.fi>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-19 22:32:33 -08:00
Keith Packard
e8fd23fad0 dri2: Invalidate DRI2 buffers for all windows with the same pixmap on swap
Without this, when a compositing manager unredirects a fullscreen window which
uses DRI2 and page flipping, the DRI2 buffer information for the compositing
manager's output window (typically the Composite Overlay Window or root window)
may become stale, resulting in all kinds of hilarity.

Fixes https://bugs.freedesktop.org/show_bug.cgi?id=35452 .

[Original patch by Michel Dänzer <michel@daenzer.net>]
[Tree walk optimized version by Keith Packard <keithp@keithp.com>]

Signed-off-by: Ville Syrjälä <syrjala@sci.fi>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-19 22:31:14 -08:00
Michel Dänzer
6f916ffec7 dri2: Always re-generate front buffer information when asked for it.
Otherwise we might keep stale cached information, e.g. after the driver
performed page flipping.

This is part of the fix for
https://bugs.freedesktop.org/show_bug.cgi?id=35452 .

Signed-off-by: Michel Dänzer <daenzer@vmware.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@nokia.com>
Reviewed-by: Mario Kleiner <mario.kleiner@tuebingen.mpg.de>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-19 22:31:01 -08:00
Rami Ylimäki
603fcb3abf dri2: Initialize needInvalidate member of DRI2Drawable.
If the client is not behaving correctly and swaps buffers before
getting them, Valgrind will complain about uninitialized memory being
used in DRI2InvalidateDrawable.

Signed-off-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Reviewed-by: Ville Syrjälä <syrjala@sci.fi>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-19 22:30:11 -08:00
Peter Hutterer
3aca819940 dmx: force -fno-strict-aliasing for xinput example
Compiler warning:
xinput.c:272: warning: dereferencing pointer 'e' does break strict-aliasing
rules

The code itself is the usual XInput client-side code:
        XEvent event;
        XDeviceMotionEvent *e = (XDeviceMotionEvent *)&event;
        XNextEvent(display, &event);
        printf("%d\n", e->type);

Since XDeviceMotionEvent is not guaranteed the same size as XEvent, clients
must use pointer aliasing as above when using the XNextEvent API. Disable
strict aliasing for this example.

Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Gaetan Nadon <memsize@videotron.ca>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-19 22:27:17 -08:00
Jeremy Huddleston
1deede3c48 kdrive/linux: Fix compilation with -Werror=int-to-pointer-cast -Werror=pointer-to-int-cast
Reported-by: Arkadiusz Miśkiewicz <arekm@maven.pl>
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
2011-12-19 21:44:19 -08:00
Jeremy Huddleston
511beddffa XQuartz: Provide in-tree implementation of strndup(3) if needed
This function was added to Mac OS X 10.7, so we need to provide it
for earlier releases.

Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-12-19 21:43:29 -08:00
Peter Hutterer
1a133eb8b1 xfree86: bump the input ABI for the touch changes
New additions to the API:
- InitTouchClassDeviceStruct
- xf86PostTouchEvent

Changes to the ABI:
- DeviceIntRec now contains a TouchClassPtr

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
2011-12-19 09:08:36 +10:00
Daniel Stone
098b837440 Add the touch input API stubs
xf86PostTouchEvent is the driver API to submit touch events to the server.
This API doesn't do anything yet though but now we can at least bump the
API.

For valuators, drivers should use the existing xf86InitValuatorAxisStruct
function.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
2011-12-19 09:08:36 +10:00
Antoine Martin
ead968a430 xserver: check for elevated privileges not uid=0
This allows us to run the server as a normal user whilst still
being able to use the -modulepath, -logfile and -config switches
We define a xf86PrivsElevated which will do the checks and cache
the result in case it is called more than once.
Also renamed the paths #defines to match their new meaning.
Original discussion which led to this patch can be found here:
http://lists.freedesktop.org/archives/xorg-devel/2011-September/025853.html

Signed-off-by: Antoine Martin <antoine@nagafix.co.uk>
Tested-by: Michal Suchanek <hramrach at centrum.cz>
Reviewed-by: Jamey Sharp <jamey at minilop.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2011-12-16 15:38:13 -08:00
Gaetan Nadon
2c1d0a539c dmx: fix distcheck failure, missing compsize.h in Makefile.am
which was added in commit:
dmx: Build fix for -Werror=implicit-function-declaration

Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Gaetan Nadon <memsize@videotron.ca>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-15 14:17:16 -08:00
Keith Packard
7da7aa96a0 Merge remote-tracking branch 'whot/for-keith' 2011-12-14 11:40:10 -08:00
Alan Coopersmith
b79de3f42f xf86 parser: convert Error to a varargs macro to clear gcc format warnings
Previously it always passed a format string with exactly one argument,
using NULL when the format string needed none.   Now pass the right number
of arguments to clear gcc warnings of 'too many arguments for format'.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:13 -08:00
Alan Coopersmith
7801b3dcd6 Add some printf format attributes suggested by gcc
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:12 -08:00
Alan Coopersmith
f68df9dfd2 xf86Priv.h: Add some noreturn attributes suggested by gcc
Both functions call exit() at the end and have no other return path.
Also correct comment/heading to reflect commit 6450f6ca7e moving
DoShowOptions into xf86Configure.c.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:12 -08:00
Alan Coopersmith
3823eedf3c Remove duplicate declarations of KdAdd*Driver in kdrive.h
Clears gcc warnings in every file that includes kdrive.h:
kdrive.h:507:1: warning: redundant redeclaration of 'KdAddPointerDriver'
kdrive.h:225:6: note: previous declaration of 'KdAddPointerDriver' was here
kdrive.h:510:1: warning: redundant redeclaration of 'KdAddKeyboardDriver'
kdrive.h:284:6: note: previous declaration of 'KdAddKeyboardDriver' was here

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:12 -08:00
Alan Coopersmith
471e5373b6 Remove duplicate declaration of xf86ValidateModesFlags in xf86Modes.h
Clears gcc warning in every file that includes xf86Modes.h:
xf86Modes.h:102:1: warning: redundant redeclaration of 'xf86ValidateModesFlags'
xf86Modes.h:72:1: note: previous declaration of 'xf86ValidateModesFlags' was here

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:12 -08:00
Alan Coopersmith
9edfa47bd5 KdParseFindNext: Constify delim argument
It's only used as input to strchr to find the delimiters, never
written to.

Clears a bunch of gcc warnings of the form:
kdrive.c:323:2: warning: passing argument 2 of 'KdParseFindNext' discards qualifiers from pointer target type
kdrive.c:261:1: note: expected 'char *' but argument is of type 'const char *'

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:11 -08:00
Alan Coopersmith
ff64ad6c74 Convert KdDoSwitchCmd to use asprintf instead of malloc/strcat/etc.
Also fix the reason argument to be const char * to clear several gcc
warnings of:
kdrive.c:151:2: warning: passing argument 1 of 'KdDoSwitchCmd' discards qualifiers from pointer target type
kdrive.c:116:1: note: expected 'char *' but argument is of type 'const char *'

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:11 -08:00
Alan Coopersmith
5bc590bde2 DoShowOptions: preserve constness of options list as we walk it
Since all we do with the option list is walk down the list printing
the names, there's no need to cast away its constness.

Clears gcc warning:
xf86Configure.c: In function 'DoShowOptions':
xf86Configure.c:781:4: warning: cast discards qualifiers from pointer target type

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:11 -08:00
Alan Coopersmith
71efd86828 x86emu: constify debug strings
Strings are all pointers to literal constants, just used as input
to printf calls when debugging is enabled.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-12 17:03:11 -08:00
Alan Coopersmith
b2bc38e4a5 Even more correctly free config file names
If we didn't go into the if (!autoconfig) { } block, the filename,
dirname, and sysdirname pointers were never initialized, but we
freed them outside the block, leading to potential memory corruption.

Move the frees inside the block where they're initialized to avoid this.

To avoid similar problems, move the declarations of the variables that
are only used in this block inside the block.

Regression introduced by commit 3d635fe84d

Found by gcc warning:
xf86Config.c: In function 'xf86HandleConfigFile':
xf86Config.c:2303:11: warning: 'filename' may be used uninitialized in this function
xf86Config.c:2303:22: warning: 'dirname' may be used uninitialized in this function
xf86Config.c:2303:32: warning: 'sysdirname' may be used uninitialized in this function

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
2011-12-12 16:50:25 -08:00
Alan Coopersmith
33d6e6743d xf86RegisterRootWindowProperty is confused about xnfcalloc
It will never return NULL, so don't try to handle a NULL condition,
since that just confuses programmers and static analyzers.

It uses calloc, so all the allocated memory is cleared, so there's
no point looping over the memory to manually initialize it NULL.

And just because it's annoying, it doesn't need to be the only
place in this file to do if (NULL==...) instead of if (... == NULL).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
2011-12-10 11:51:03 -08:00
Peter Hutterer
e5aa00989c Change GetXI2/XI/CoreType to just take a type argument
Avoids the dummy-event dance if we have an event type and need to get the
matching XI2 type.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
2011-12-10 17:54:34 +10:00
Keith Packard
522f8bcc03 Merge remote-tracking branch 'whot/for-keith' 2011-12-08 20:57:26 -08:00
Peter Hutterer
4fc797f375 xfree86: include xorg-config.h from xaalocal.h
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-12-09 14:56:24 +10:00
Peter Hutterer
9b570ecbda xfree86: bump the input ABI
The last few patches broke the ABI, bump it for convenience.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-09 14:56:23 +10:00
Keith Packard
3ab8ee3247 Merge remote-tracking branch 'airlied/reviewed-fixes' 2011-12-07 12:42:17 -08:00
Keith Packard
22a666f995 Merge remote-tracking branch 'alanc/master' 2011-12-07 12:27:23 -08:00
Keith Packard
3824f558cc hw/xfree86: fix segfault in config parser when config dir is missing
Treat a scandir error from a missing (or unusable) directory return as
if it simply returned no files at all, which is what we want.

cc: Paulo Zanoni <przanoni@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-07 12:13:37 -08:00
Dave Airlie
98c4a888a4 kdrive: drop screen crossing code.
The only kdrive server we probably care about anymore is Xephyr,
and this screen enable/disable code totally breaks it in multi-screen mode.

When you are in one screen the other stops updating.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=757457

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-12-06 16:04:56 +00:00
Dave Airlie
1049139499 xaa: avoid possible freed pointer reuse in epilogue
If the pGCPriv->flags == 2, then we try to assign the freed pGCPriv->XAAOps
avoid this by clearing the flags in to be destroyed pGCPriv.

Reported by coverity.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-12-06 16:00:35 +00:00
Adam Jackson
22605effd1 fbdevhw: iterate over all modes that match a mode. (v3)
So on RHEL5 anaconda sets an xorg.conf with a fixed 800x600 mode in it,
we run radeonfb and fbdev since ati won't work in userspace due to domain
issues in the older codebase.

On certain pseries blades the built-in KVM can't accept an 800x600-43 mode,
it requires the 800x600-60 mode, so we have to have the kernel radeonfb
driver reject the 800x600-43 mode when it sees it. However then fbdev
doesn't try any of the other 800x600 modes in the modelist, and we end up
getting a default 640x480 mode we don't want.

This patch changes the mode validation loop to continue on with the other modes
that match to find one that works.

v2: move code around to avoid extra loop, after comment from Jamey.
v3: move loop setup back into loop as per Jeremy's review.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-12-06 16:00:35 +00:00
Alan Coopersmith
c19c55a93a Fix builds of Xnest & Xephyr with Solaris Studio compilers
Required in order to build with Studio cc now that xorg-macros is
setting -errwarn=E_FUNC_HAS_NO_RETURN_STMT since a bug in the Solaris
system headers causes the noreturn attribute to not be correctly
applied to the exit() prototype in <stdlib.h> when building with
Studio instead of gcc.

Otherwise compiler exits with errors:
"Display.c", line 65: Function has no return statement : x_io_error_handler
"hostx.c", line 341: Function has no return statement : x_io_error_handler

Uses Studio-specific pragma instead of adding another exit() prototype
with a noreturn attribute to avoid causing gcc to warn about having
a redundant prototype for the exit() function.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
2011-12-05 14:33:00 -08:00
Alan Coopersmith
e4dcf580f0 LoaderOpen returns either a valid pointer or NULL, so don't check for < 0
Fixes Sun cc warning that was recently elevated to error by the
stricter default CFLAGS changes to xorg-macros:

"loadmod.c", line 914: improper pointer/integer combination: op "<"

Should have been changed when commit ab7f057ce9 changed the
LoaderOpen return type from int to void *.

Changes log message when file is found but dlopen() fails from:
 (EE) LoadModule: Module dbe does not have a dbeModuleData data object.
 (EE) Failed to load module "dbe" (invalid module, 0)
to:
 (EE) Failed to load module "dbe" (loader failed, 7)

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2011-12-05 14:33:00 -08:00
Alan Coopersmith
8b6a750097 Fix gcc warnings about redundant declarations of fallback functions
Ensure ffs, strndup, strlcat, etc. aren't defined by our headers
if they're already defined in the system headers.

This does export the HAVE_FFS, HAVE_STRNDUP, etc. definitions to drivers,
but if you built the Xserver with a libc that had those, and then build
the drivers with a less capable libc, you're going to have problems anyway,
and this should solve some reported problems with conflicts between our
strndup definition and gcc magic for it.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2011-12-05 14:32:59 -08:00
Alan Coopersmith
d829a7c5cb Move to autoconf standard function name checks & defines
Replace multiple methods of checking for functions with AC_CHECK_FUNCS
Replace multiple methods of selecting fallback funcs with AC_REPLACE_FUNCS
Replace HAS_* and NEED_* #defines with autogenerated HAVE_*

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
2011-12-05 14:32:45 -08:00
Alan Coopersmith
feebf67463 Limit the number of screens Xvfb will attempt to allocate memory for
Commit f9e3a2955d removing the MAXSCREEN limit left the screen
number too unlimited, and allowed any positive int for a screen number:

Xvfb :1 -screen 2147483647 1024x1024x8

Fatal server error:
Not enough memory for screen 2147483647

Found by Parfait 0.3.7:
Error: Integer overflow (CWE 190)
   Integer parameter of memory allocation function realloc() may overflow due to multiplication with constant value 1112
        at line 293 of hw/vfb/InitOutput.c in function 'ddxProcessArgument'.

Since the X11 connection setup only has a CARD8 for number of SCREENS,
limit to 255 screens, which is also low enough to avoid overflow on the
sizeof(*vfbScreens) * (screenNum + 1) calculation for realloc.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
2011-12-02 00:17:28 -08:00
Matt Turner
2dc5ba4a1b Remove another if (E != NULL) check around free(E)
I wonder if there are any other patterns we haven't seen yet?

Reviewed-by: Jamey Sharp <jamey@minilop.net>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-12-01 14:24:54 +00:00