Commit Graph

424 Commits

Author SHA1 Message Date
Alan Coopersmith
cccafabd56 Mark arguments to fopen/popen/system wrappers as const char *
Silencing more gcc -Wwrite-strings warnings

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-11-23 12:15:06 -08:00
Alan Coopersmith
05d8a7f7a7 Convert a bunch of sprintf to snprintf calls
This batch is the straightforward set - others are more complex and
need more analysis to determine right size to pass.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-11-23 12:15:06 -08:00
Alan Coopersmith
f3cb512dc4 LogVMessageVerb: Fix const mismatch warning
"log.c", line 382: warning: assignment type mismatch:
	pointer to char "=" pointer to const char

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-11-23 12:15:06 -08:00
Alan Coopersmith
3d2d88029b AuthAudit: clean up string handling calls
The extra "out" pointer to redirect writes to the array isn't needed since
the removal of LBX (commit a9ed5a8790), and eliminating it allows more
logical use of sizeof(addr) in length-checked strlcpy & snprintf calls to
write to it.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-11-23 12:15:06 -08:00
Alan Coopersmith
780133f9ae Convert DetermineClientCmd to use strdup instead of malloc+strncpy
*cmdname is initialized to NULL earlier in the function, so it's
okay to overwrite it with NULL if strdup fails, don't need that
extra check.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-11-23 12:15:05 -08:00
Alan Coopersmith
6e6d732bac Convert strncpy/strncat to strlcpy/strlcat
As long as we're carrying around a compatibility copy in os/strl*.c,
might as well use them.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-11-23 12:15:05 -08:00
Alan Coopersmith
08093c25a9 Convert some malloc + strncpy pairs into strndup calls
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-11-23 12:15:05 -08:00
Alan Coopersmith
acde97a39d Add fallback implementation of strndup()
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
Linux test code fixed by: Keith Packard <keithp@keithp.com>
2011-11-23 12:15:05 -08:00
Alan Coopersmith
7ee7fd1f4c Remove a couple Error() instances left behind by 09dbfcb0ad
Two instances found in the SIOCGIFCONF code for listing network interfaces.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-11-23 12:15:05 -08:00
Rami Ylimäki
c1bb8f43b9 record: Prevent out of bounds access when recording a reply.
Any pad bytes in replies are written to the client from a zeroed
array. However, record extension tries to incorrectly access the pad
bytes from the end of reply data.

Signed-off-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Reviewed-by: Erkki Seppälä <erkki.seppala@vincit.fi>
2011-11-18 11:26:02 -08:00
Keith Packard
c841336204 Merge remote-tracking branch 'herrb/master' 2011-10-18 07:45:24 -07:00
Matthieu Herrb
b67581cf82 Fix CVE-2011-4029: File permission change vulnerability.
Use fchmod() to change permissions of the lock file instead
of chmod(), thus avoid the race that can be exploited to set
a symbolic link to any file or directory in the system.

Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-10-18 15:58:00 +02:00
Matthieu Herrb
6ba44b91e3 Fix CVE-2011-4028: File disclosure vulnerability.
use O_NOFOLLOW to open the existing lock file, so symbolic links
aren't followed, thus avoid revealing if it point to an existing
file.

Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-10-18 15:58:00 +02:00
Jeremy Huddleston
09dbfcb0ad os: Remove Error()
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-10-11 21:23:46 -07:00
Keith Packard
9a55b3661b Merge remote-tracking branch 'alanc/master' 2011-10-03 11:49:23 -07:00
Keith Packard
afb1fe695d Merge remote-tracking branch 'whot/next' 2011-09-26 20:24:15 -07:00
Gaetan Nadon
84bb0207f6 dix and os: gitignore dix.O and os.O
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Gaetan Nadon <memsize@videotron.ca>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-09-23 17:14:47 -07:00
Matt Turner
2c7c520cfe Use internal temp variable for swap macros
Also, fix whitespace, mainly around
	swaps(&rep.sequenceNumber)

Reviewed-by: Peter Harris <pharris@opentext.com>
Signed-off-by: Matt Turner <mattst88@gmail.com>
2011-09-21 17:12:04 -04:00
Lennart Poettering
159b03e137 config: add udev/systemd multi-seat support
Add support for multi-seat-aware input device hotplugging. This
implements the multi-seat scheme explained here:

http://www.freedesktop.org/wiki/Software/systemd/multiseat

This introduces a new X server switch "-seat" which allows configuration
of the seat to enumerate hotplugging devices on. If specified the value
of this parameter will also be exported as root window property
Xorg_Seat.

To properly support input hotplugging devices need to be tagged in udev
according to the seat they are on. Untagged devices are assumed to be on
the default seat "seat0". If no "-seat" parameter is passed only devices
on "seat0" are used. This means that the new scheme is perfectly
compatible with existing setups which have no tagged input devices.

Note that the -seat switch takes a completely generic identifier, and
that it has no effect on non-Linux systems. In fact, on other OSes a
completely different identifier scheme for seats could be used but still
be exposed with the Xorg_Seat and -seat.

I tried to follow the coding style of the surrounding code blocks if
there was any one could follow.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-08-22 15:56:49 +10:00
Daniel Kurtz
b31d104fc0 os/log: Add LogVHdrMessageVerb and friends
LogVHdrMessageVerb allows a custom header to be inserted in a log message,
between the Log system's MessageType string, and a formatted variable
message body. The custom header can itself be a formatted variable string.

These functions can be used, for example, by driver abstraction layers to
format specific driver messages in a standard format, but do it in a way
that is efficient, obeys the log-layers verbosity settings, and is safe
to use in signal handlers (because they don't call malloc), even for
types besides X_NONE.

Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-08-22 15:49:18 +10:00
Daniel Kurtz
b82f934db6 os/log: Pull LogMessageTypeVerbString out of LogVMessageVerb
Also, optimize how the type and format strings are combined.

Signed-off-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Guillem Jover <guillem@hadrons.org>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-08-22 15:48:14 +10:00
Peter Hutterer
f51e42f583 Terminate the log with one last message.
Instead of just closing the log when everything is done, put one more
message in stating that we're actually terminating. Users or scripts that
look at the Xorg.log will then know that a) the server has terminated
properly and b) why the server terminated (to some degree, given that most
real-world errors will be caused by AbortServer()).

Acked-by: Gaetan Nadon <memsize@videotron.ca>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Tested-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
Tested-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-07-27 09:31:02 +10:00
Dan Nicholson
7d5c8a12cb Don't use empty source files
When an empty _SOURCES variable is declared, automake will recognize that
only linking is needed.

Signed-off-by: Dan Nicholson <dbn.lists@gmail.com>
Tested-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
2011-06-23 05:28:31 -07:00
Jeremy Huddleston
b47d2e43eb XQuartz: Make a copy of args for our crash reporter vsnprintf
Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-05-05 09:04:41 -07:00
Jeremy Huddleston
c524f8bb76 os: Silence warnings when building with clang
access.c:1492:20: error: equality comparison with extraneous parentheses [-Werror,-Wparentheses]
        if ((host->family == FamilyServerInterpreted)) {
             ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
access.c:1492:20: note: use '=' to turn this equality comparison into an assignment
        if ((host->family == FamilyServerInterpreted)) {
                          ^~
                          =
access.c:1492:20: note: remove extraneous parentheses around the comparison to silence this warning
        if ((host->family == FamilyServerInterpreted)) {
            ~             ^                         ~

In file included from xstrans.c:8:
In file included from /usr/X11/include/X11/Xtrans/transport.c:62:
/usr/X11/include/X11/Xtrans/Xtranssock.c:262:5: error: implicit declaration of function 'ErrorF' is invalid in C99
      [-Werror,-Wimplicit-function-declaration]
    PRMSG (3,"SocketSelectFamily(%s)\n", family, 0, 0);
    ^

log.c:180:29: error: format string is not a string literal [-Werror,-Wformat-nonliteral]
        if (asprintf(&logFileName, fname, display) == -1)
                                   ^~~~~
log.c:190:26: error: format string is not a string literal [-Werror,-Wformat-nonliteral]
                if ((asprintf(&suffix, backup, display) == -1) ||
                                       ^~~~~~
log.c:382:25: error: format string is not a string literal [-Werror,-Wformat-nonliteral]
        LogVWrite(verb, tmpBuf, args);
                        ^~~~~~

Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
2011-04-25 10:45:34 -07:00
Tiago Vignatti
f603061e94 os: fix use after free in EstablishNewConnections
In the case of failure on AllocNewConnection, new_trans_conn cannot be
dereferenced because it's already freed. Swapping the order of this logic fix
the changes introduced in 04956b8043.

Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com>
CC: Jeremy Huddleston <jeremyhu@freedesktop.org>
Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-04-07 19:57:38 +03:00
Tiago Vignatti
a6c71ce5d2 os: fix memory and fd leaks in Popen
Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Nicolas Peninguy <nico@lostgeeks.org>
2011-04-04 15:41:47 +03:00
Tiago Vignatti
bafec9a25e os: use DebugF for debugging
Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Nicolas Peninguy <nico@lostgeeks.org>
2011-04-04 15:41:47 +03:00
Erkki Seppälä
2ef4ff45ef os/client: Prevent rare fd leak in DetermineClientPid
DetermineClientPid didn't close file descriptor if read on
/proc/pid/cmdline failed. Adjusted the code to disregard the close
return value and perform the return after that, if the read failed or
returned EOF.

Signed-off-by: Mark Kettenis <mark.kettenis@xs4all.nl>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Reviewed-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-03-27 18:16:36 -07:00
Jon TURNEY
a713832cbe When XDMCP -from is specified, only register the requested address
When XDMCP -from is specified, only register the requested address,
rather than the requested address, and any others we have of different
address families to the requested address.

e.g. if we have 4 interfaces with both IPv4 and IPv6 addresses (which
are not IPv6 mapped IPV4 addresses), using -from with one of those IPv4
addresses currently means only that IPv4 address, and all IPv6 addresses
are used in the connection data in XDMCP REQUEST packet.

(See http://cygwin.com/ml/cygwin-xfree/2011-02/msg00000.html)

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2011-03-14 13:11:38 -07:00
Christopher James Halse Rogers
d17a9fb841 Consolidate all the PATH_MAX handling into misc.h
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Christopher James Halse Rogers <christopher.halse.rogers@canonical.com>
2011-03-14 13:42:55 -04:00
Keith Packard
8e4c3ce55b Merge remote branch 'rjy/clientids' 2011-03-03 13:42:07 -08:00
Adam Jackson
f953ae7d8a os: Reduce smart scheduler setup calls
We can return from WaitForSomething with no clients ready for any number
of reasons.  There's no reason to set up the scheduler timer when this
happens.

Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2011-01-20 21:08:17 -05:00
Pauli Nieminen
2d67ada3c4 os: always check if client is local when connection is accepted
LocalClient is used for all DRI2 requests that makes it frequently
called function. Querying if connection is local or not takes 10-15us
(on ARM) depending on malloc speed.

Signed-off-by: Pauli Nieminen <ext-pauli.nieminen@nokia.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2010-12-31 12:52:51 +00:00
Pauli Nieminen
617b7d2211 os: Fix a memory leak
Signed-off-by: Pauli Nieminen <ext-pauli.nieminen@nokia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2010-12-31 12:52:51 +00:00
Daniel Stone
44adb31bfe GetTimeInMillis: Use CLOCK_MONOTONIC_COARSE where available
On some systems, using CLOCK_MONOTONIC forces a readback of HPET or some
similarly expensive timer.  CLOCK_MONOTONIC_COARSE can alleviate this,
at the cost of negligibly-reduced resolution, so prefer that where we
can.

Signed-off-by: Daniel Stone <daniel@fooishbar.org>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com>
2010-12-27 09:43:44 -08:00
Rami Ylimäki
1e933665be os: Add facilities for client ID tracking.
An interface is provided for figuring out the PID and process name of
a client. Make some existing functionality from SELinux and IA
extensions available for general use.

Signed-off-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com>
2010-12-23 13:53:18 +02:00
Rami Ylimäki
2b364bf970 Revert "os: Prevent backtrace from being stopped in noreturn functions."
This reverts commit 579715f830.

The patch is not needed anymore. I haven't encountered backtrace
problems with GCC 4.3.3. Even if the problems still persisted, this
commit should be removed and instead the definition of _X_NORETURN
should be modified to be empty if GCC/ARM is used. However, currently
it seems that ARM backtraces are OK even if _X_NORETURN is used and
-mapcs-frame is not defined in CFLAGS.

Signed-off-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
2010-12-23 11:20:42 +02:00
Adam Jackson
f28e48834e Remove SCO support
This has never been buildable in any modular server release.

Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2010-12-20 12:11:11 -05:00
Colin Harrison
1324b0ca9f Typo in xserver Xvasprintf()
I needed this patch in the wrapper around vsnprintf() in os/xprintf.c
(MinGW for Windows build) to correct various crashes.

Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2010-12-18 00:22:29 -08:00
Alan Coopersmith
3a9bb93dd1 Convert alloc+sprintf pairs into asprintf() & XNFasprintf() calls
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
2010-12-07 11:10:35 -08:00
Alan Coopersmith
c95c1d338f Add asprintf() implementation for platforms without it
Provides a portable implementation of this common allocating sprintf()
API found in many, but not yet all, of the platforms we support.
If the platform provides vasprintf() we simply wrap it, otherwise we
implement it - either way callers can use it regardless of platform.

Since not all platforms guarantee to NULL out the return pointer on
failure, we don't either, and require callers to check the return
value for -1.

The old Xprintf() API is deprecated, but left for compatibility for now.

The new API is added in a new header so that it can be used in parts of
the server such as hw/xfree86/parser that don't include all the server
headers.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
2010-12-07 11:10:35 -08:00
Alan Coopersmith
2db6951763 Sun's copyrights now belong to Oracle
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
2010-12-07 11:10:35 -08:00
Keith Packard
c4a7a5917a Merge remote branch 'jeremyhu/master' 2010-12-06 19:28:07 -08:00
Jeremy Huddleston
14f00449eb XQuartz: Cleanup some compiler warnings
Mark __crashreporter_info__ as __attribute__((__used__))

Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2010-12-03 16:46:45 -08:00
Alan Coopersmith
8f42b2b693 Simplify Error() - don't allocate temporary copy of error string
Doesn't seem to be any reason to just not pass the error string
as another argument directly to LogVWrite()

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
2010-11-30 16:25:22 -08:00
Tiago Vignatti
8976e9766e dix: adds support for none root window background
It lets the driver notify the server whether it can draw a background when
'-background none' option is used by the system platform. Use cases for that
could be video drivers performing mode-setting in kernel time, before X is up,
so a seamless transition would happen until X clients start to show up.

If the driver can copy the framebuffer cleanly then it can set the flag
(canDoBGNoneRoot), otherwise the server will fallback to the normal behaviour.
The system must explicit indicates willingness of doing so through
'-background none'. We could do this option as default; in such case,
malicious users would be able to steal the framebuffer with a bit of tricks.

For instance, I can see the content of my nVidia Quadro FX 580 framebuffer
old X session modifying a bit nv driver:

     xf86DPMSInit(pScreen, xf86DPMSSet, 0);

-    /* Clear the screen */
-    if(pNv->xaa) {
-        /* Use the acceleration engine */
-        pNv->xaa->SetupForSolidFill(pScrn, 0, GXcopy, ~0);
-        pNv->xaa->SubsequentSolidFillRect(pScrn,
-            0, 0, pScrn->displayWidth, pNv->offscreenHeight);
-        G80DmaKickoff(pNv);
-    } else {
-        /* Use a slow software clear path */
-        memset(pNv->mem, 0, pitch * pNv->offscreenHeight);
-    }
+    pScreen->canDoBGNoneRoot = TRUE;

The commit is originally based on discussions happened on xorg-devel:
http://lists.freedesktop.org/archives/xorg-devel/2010-June/009755.html

Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Acked-by: Pauli Nieminen <ext-pauli.nieminen@nokia.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2010-11-11 23:24:43 +02:00
Tiago Vignatti
bfe9cdd11b dix: delete logo hack screen saver
Protocol doesn't mention about screen saver with logo being required and
people are already using more intelligent ways to draw screen saver themes. So
consider -logo as deprecated option, deleting its code.

Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Mikhail Gusarov <dottedmag@dottedmag.net>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2010-11-11 23:20:35 +02:00
Keith Packard
4ed4915bc0 Merge remote branch 'whot/for-keith' 2010-11-10 16:58:21 -08:00
Aaron Plattner
c80c41767e os: Fix BigReq ignoring when another request is pending
Commit cf88363db0 fixed the handling of
BigReq requests that are way too large and handles the case where the
read() syscall returns a short read.  However, it neglected to handle
the case where it returns a long read, which happens when the client
has another request in the queue after the bogus large one.

Handle the long read case by subtracting the smaller of 'needed' and
'gotnow' from oci->ignoreBytes.  If needed < gotnow, simply subtract
the two, leaving gotnow equal to the number of extra bytes read.
Since the code immediately following the (oci->ignoreBytes > 0) block
tries to handle the next request, advance oci->bufptr immediately
instead of setting oci->lenLastReq and letting the next call to
ReadRequestFromClient do it.

Fixes the XTS pChangeKeyboardMapping-3 test.

         CASES TESTS  PASS UNSUP UNTST NOTIU  WARN   FIP  FAIL UNRES  UNIN ABORT
-Xproto    122   389   367     2    19     0     0     0     1     0     0     0
+Xproto    122   389   368     2    19     0     0     0     0     0     0     0

Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2010-11-10 14:58:28 -08:00