When an Xnest instance is not viewable it will crash when a client in
that instance calls GetImage. This is because the Xnest server will
itself receives a BadMatch error.
This patch ignores the error. The application which has requested the
image will receive garbage - this however is fully legal according
to the specs as obscured areas will always contain garbage if there
isn't some sort of backing store as discussed in
https://bugs.freedesktop.org/show_bug.cgi?id=9488
The applied patch is a version from Dadek Doulik.
v2: Call XSync() before changing error handlers as suggested by
Daniel Stone <daniel@fooishbar.org>.
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Egbert Eich <eich@freedesktop.org>
Xnest variant of ModifyPixmapHeader that creates new Pixmap in parent X
server if it's size is modified from 0x0 to anything bigger.
xnestCreatePixmap doesn't create pixmap in parent X server if it has
dimensions 0x0. If it is later resized and accessed, Xnest will be
aborted with BadDrawable error from parent X server because it will
use XID 0. This happens with ScratchPixmap, for example as used from
XaceCensorImage. Applications using XACE crash Xnest.
Reviewed-by: Adam Jackson <ajax@redhat.com>
I'm getting a error building xorg-server-1.14.1.902 with thelatest snapshot
of gcc-4.8:
input.c:225:43: error: array subscript is above array bounds
[-Werror=array-bounds]
This is because kdNumInputFds can become equal to KD_MAX_INPUT_FDS in
KdRegisterFd(). This means that in KdUnregisterFd(), kdInputFds[j + 1] can
be beyond the end of the array.
Signed-off-by: Chris Clayton <chris2553@googlemail.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Like commit ac1a60e7b6, re-add
initialization of GLX after it was accidentally dropped from non-Xorg
servers in 5f5bbbe543.
Signed-off-by: Sebastien Bacher <seb128@ubuntu.com>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=62346
Reviewed-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
Given that the window title says "ctrl+shift", having pressing those
keys in that order not ungrab you is fairly mean.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Otherwise when you're doing the ctrl-shift mouse grab thing, you
don't know what state you're in until the next rendering occurs.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Unless you're working on the sw cursor rendering code, you surely want
to have real hardware cursors.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Note that EXTRA_DIST was always unnecessary, because automake notices
conditional compile of source files and includes them.
Copyright header is added because git noted that this was a 61%
rewrite.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
I suspect there's more cleanup possible in ephyrHostXVPutImage() by
sticking a bunch of the args in the port priv earlier.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
This obviously wanted a helper function beforehand, but even more so
now that we have XCB.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Now that we have XCB on the server side, we don't need to split these
functions out.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
No more extra event structure to translate between hostx.c and
ephyr.c!
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
We can include xcb bits from the same place as server headers, so
there's no need to hide them any more.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Now that we can include server headers in talking to host X, we don't
need to hide any more.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
v2: Fix trying to include xcb-dri in the non-dri-build case (Noted by
Julien)
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Drop obsolete comments about interaction between Xlib code and that
macro, and stop undefining it.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Eric Anholt <eric@anholt.net>
Require new xcb-xf86dri to get fixed GetDrawableInfo.
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Signed-off-by: Julien Cristau <jcristau@debian.org>
v2: Massive, conflict-filled rebase. I think I resolved everything
right, but this host xv code makes my eyes bleed. Touch-tested XV
after the rebase (anholt).
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net> (v1)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
v2: Rebase on indentation changes, squash in a simpler variant of the
later event compression patch, fix server hang or segfault on
window close by reimplementing the x_io_error_handler in the new
XCB event loop (anholt).
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net> (v1)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
v2: Dropped the hostx_load_keymap changes, now that that function is
gutted (anholt).
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net> (v1)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
This isn't used anywhere.
v2: Rebase to the top of the patch series (anholt)
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net> (v1)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Marc Haesen <marha@users.sourceforge.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
/jhbuild/checkout/xorg/xserver/hw/xwin/winauth.c: In function ‘MitGenerateCookie’:
/jhbuild/checkout/xorg/xserver/hw/xwin/winauth.c:87:5: error: implicit declaration of function ‘MitAddCookie’ [-Werror=implicit-function-declaration]
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Remove unneeded forward declaration of winProcessXEventsTimeout(), the actual
definition immediately follows.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Unused since 47c7b6d3e6 "Remove no-longer needed
tricks used to prevent the clipboard client from being killed"
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Fix erroneous use of unsigned long * for lpBits in winXCursorToHCURSOR() which
leads to ARGB cursors being vertically streched on x86_64 by interleaving blank
rows of pixels.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
The BITMAPINFO local only has room for a single RBGQUAD in bmiColors, but we
access two (black and white for a mono-color DIB). Fix by changing to a dynamic
allocation big enough for a BITMAPINFO and a RGBQUAD.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Rewrite winXCursorToHCURSOR() so access to BITMAPINFO bmiColors member doesn't
trigger an -Warray-bounds warning.
Note that the underlying storage is allocated as a BITMAPV4HEADER, so has
sufficent room for the extra RGBQUADs bmiColors after the BITMAPINFO bmiHeader.
wincursor.c: In function 'winSetCursor':
wincursor.c:293:24: error: array subscript is above array bounds [-Werror=array-bounds]
wincursor.c:294:24: error: array subscript is above array bounds [-Werror=array-bounds]
wincursor.c:295:24: error: array subscript is above array bounds [-Werror=array-bounds]
wincursor.c:296:24: error: array subscript is above array bounds [-Werror=array-bounds]
wincursor.c:297:24: error: array subscript is above array bounds [-Werror=array-bounds]
wincursor.c:298:24: error: array subscript is above array bounds [-Werror=array-bounds]
wincursor.c:299:24: error: array subscript is above array bounds [-Werror=array-bounds]
wincursor.c:300:24: error: array subscript is above array bounds [-Werror=array-bounds]
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Use the correct size of a HWND on x86_64 in XChangeProperty() and
XGetWindowProperty() calls for the _WINDOWSWM_NATIVE_HWND property.
Signed-off-by: Marc Haesen <marha@users.sourceforge.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Correct SetupRootMenu(), SetupSysMenu(), HandleCustomWM_INITMENU() and
HandleCustomWM_COMMAND() function signatures which use unsigned long parameters,
where just a specific HWND or HMENU handle type should have been used.
Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Move pseudoramiX code to a separate top-level directory. Link Xwin and Xquartz
with libPseudoramiX
I'm not sure moving this to a top-level directory is appropriate, but I'm not
sure where else it fits.
Future work: pseudoramiX can probably be consolidated with the rrxinerama code
(which I think provides fake xinerama data when real XINERAMA is disabled and we
only have one screen)
v2: fix distcheck
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Include pthread.h in winglobals.h to fix build with latest MinGW64 headers
In file included from
winmultiwindowicons.c:47:0:
winglobals.h:92:1: error: unknown type name ‘pthread_mutex_t’
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
Fix build with latest MinGW64 headers by wrapping Status type in shlobj.h as well
In file included from InitOutput.c:51:0:
/usr/i686-w64-mingw32/sys-root/mingw/include/shlobj.h:1231:44: error: expected identifier or ‘(’ before ‘int’
/usr/i686-w64-mingw32/sys-root/mingw/include/shlobj.h:1248:44: error: expected identifier or ‘(’ before ‘int’
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Marc Haesen <marha@users.sourceforge.net>
There's no reason to pass the data back out to the caller, since the
caller was dropping it on the floor. The original data is a CARD32,
so no need to mess with weird unsigned longs.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
The only cases that lead to !is_ok are already EPHYR_LOG_ERROR, and it
fixes set-but-unused compiler warnings.
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
This is unused as of the introduction of a helper in
e7150db535
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
newer automake gets quite noisy about this.
hw/xfree86/ddc/Makefile.am:7: warning:
'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
and many more of these.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Replace hardcoded SVR4 || linux || CSRG_BASED with an autoconf check and
the _POSIX_SAVED_IDS macro.
Suggested-by: Mark Kettenis <mark.kettenis@xs4all.nl>
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This at least mentions AutoAddGPU and hints at when you might
want to disable it.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Commit 8f4640bdb9 fixed a bit of a
chicken-and-egg problem by detaching GPU screens when their providers
are destroyed, which happens before CloseScreen is called. However,
this created a new problem: the GPU screen tears down its RandR crtc
objects during CloseScreen and if one of them is active, it tries to
detach the scanout pixmap then. This crashes because
RRCrtcDetachScanoutPixmap tries to get the master screen's screen
pixmap, but crtc->pScreen->current_master is already NULL at that
point.
It doesn't make sense for an unbound GPU screen to still be scanning
out its former master screen's pixmap, so detach them first when the
provider is destroyed.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
Numerous pieces of debug output cast a pointer to an int and then use a "%08x"
printf format.
Use "%p" format for 64-bit portability.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Fix a possible crash in winMultiWindowGetClassHint() when an application doesn't
null terminate the WM_CLASS property class name (which is an ICCCM conformance
bug in the application)
(Reported for running the contiki cooja simulator in multiwindow mode, although
it seems that many Java clients may have this problem, see [1])
Based on a patch by Marc Haesen.
v2: Avoid using strnlen() which is missing on MinGW
v3: Align with Xming patch
[1] http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6961123
Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Yaakov Selkowitz <yselkowitz@users.sourceforge.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Remove obsolete WIN_XEVENTS_SHUTDOWN. This event is never generated.
(I think the idea was to listen for WM_DELETE_WINDOW, but that's not a very
useful thing to do for a hidden window.)
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Check for python at configure time when building XWin with AIGLX, it's used to
generate the wrapper code for native GL functions.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Avoid a null dereference of DIB_pixels if CreateDIBSection() fails in
NetWMToWinIconAlpha()
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Handle WM_MOUSEHWHEEL tilt wheel messages, similarly to WM_MOUSEWHEEL scroll
wheel messages, to generate X button 6 and 7 presses and releases.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Map extra mouse buttons 1 and 2 to X buttons 8 and 9, as conventional, leaving X
buttons 6 and 7 for tilt wheel.
Also add button labels for buttons 6, 7, 8 and 9 and change btn_labels in from a
dynamic allocation to a fixed one of the required size for all the labels we
use.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Remove unneeded WM_XBUTTON message defines, they have been provided by w32api
for a long time now.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Change winTranslateKey() to return it's result as it's return value, and change
it's uses as well.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Handle left and right ctrl and shift keys independently
Assume that all modifiers are cleared when all keys are released on focus lost,
as internalKeyState doesn't record which modifier key was pressed.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Remove an extra '\n' from internal client IOError log messages
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
_NET_WM_STATE is ATOM[] not ATOM, a list of window state hints, so check all of
the atoms, not just the first one
See EWMH specifcation, section "Application Window Properties"
v2: Actually use [] on the returned atom data
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
Currently, WM_ENDSESSION just calls GiveUp() to set the DE_TERMINATE flag. But
for the X server to exit cleanly, we also need the X server dispatch loop to be
unblocked so it can notice that DE_TERMINATE has been set and exit, removing
it's lock file and any unix domain socket.
It appears that the system will terminate the process when the last UI thread in
that process returns from processing WM_ENDSESSION for the last top-level
window.
Since WM_ENDSESSION appears to sent by the system via SendMessage()
(synchronously) and the wndproc is called to process it in the message thread
for that window (the X server thread), we can't easily terminate the X server
dispatch loop from inside the WM_ENDSESSION message processing.
So, create a messaging window, a hidden, top-level window, with a separate
thread to catch this message, and process it by calling GiveUp() and then
blocking on a mutex until the X server dispatch loop exits.
Also, notice when this is a shutdown cancel WM_ENDSESSION message and take no
action.
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
XQuartz already conditionally renames main() as dix_main() so it can provide
it's own main(). This isn't the ideal way of doing this, as it prevents libdix
built this way from being useful with any other DDX.
So instead, always name that function dix_main(), and also provide a stub main()
which just calls dix_main(), which can be overriden in the DDX.
Add a main() to XWin (XQuartz already has one, of course).
It's no longer neccessary to link XWin and XQuartz with libmain.
v2: Remove unneeded stub main hw/xwin/InitOutput.c
Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
The peculiar way we handle coordinates results in relative coordinates on
absolute devices being added to the last value, then that value is mapped to
the screen (taking the device dimensions into account). From that mapped
value we get the final coordinates, both screen and device coordinates.
To avoid uneven scaling on relative coordinates, they are pre-scaled by
screen ratio:resolution:device ratio factor before being mapped. This
ensures that a circle drawn on the device is a circle on the screen.
Previously, we used the ratio to scale x up. Synaptics already does its own
scaling based on the resolution and that is done by scaling y down by the
ratio. So we can remove the code from the driver and get approximately the
same behaviour here.
Minor ABI bump, so we can remove this from synaptics.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Emmanuel Benisty <benisty.e@gmail.com>
Signed-off-by: Thomas Klausner <wiz@NetBSD.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Simplifies code and reduces risk of overflow from converting length
field in X replies from words to bytes.
One call to _XEatData is left in ephyrHostGLXGetStringFromServer where
it's already been checked for overflow, and other values have been
subtracted from it to reduce the size of data remaining to be eaten.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reduces risk of overflow from converting length field in X replies
from words to bytes. (Also seems to be what several calls were
already incorrectly passing to _XEatData.)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xlib already provides a function to eat padding bytes after the
data read, so use it instead of calculating it ourselves.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
clientDriverNameLength is a CARD32 and needs to be bounds checked before
adding one to it to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
busIdStringLength is a CARD32 and needs to be bounds checked before adding
one to it to come up with the total size to allocate, to avoid integer
overflow leading to underallocation and writing data from the network past
the end of the allocated buffer.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
reply.length & reply.size are CARD32s and need to be bounds checked before
multiplying or adding to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
numFBConfigs & numAttribs are CARD32s and need to be bounds checked before
multiplying by structure sizes to come up with the total size to allocate,
to avoid integer overflow leading to underallocation and writing data from
the network past the end of the allocated buffer.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
numVisuals & numProps are both CARD32 and need to be bounds checked before
multiplying by structure sizes to come up with the total size to allocate,
to avoid integer overflow leading to underallocation and writing data from
the network past the end of the allocated buffer.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
A constant deceleration of x simply means (delta * 1/x). We limited that to
values >= 1.0f for obvious reasons, but can also allow values from 0-1.
That means that ConstantDeceleration is actually a ConstantAcceleration, but
hey, if someone needs it...
X.Org Bug 66134 <http://bugs.freedesktop.org/show_bug.cgi?id=66134>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>
