xserver-multidpi/dix
Aaron Plattner 587c3a2d19 Bug #22804: Reject out of bounds XGetImage requests
The XGetImage man page states:

    If the drawable is a window, the window must be viewable, and it must be the
    case that if there were no inferiors or overlapping windows, the specified
    rectangle of the window would be fully visible on the screen and wholly
    contained within the outside edges of the window, or a BadMatch error
    results.  Note that the borders of the window can be included and read with
    this request.

However, the server was only checking the requested region against the screen
bounds, allowing XGetImage requests to read pixels outside the bounds of a
window's ancestors.  Normally, this would just read other pixels from the
screen, but if one of the ancestor windows is redirected, the window's backing
pixmap may be smaller than the window itself.

This change checks the region against the window's bounding drawable, which is
either the screen pixmap, a redirected window's backing pixmap, or the root
window for servers that don't support GetWindowPixmap.

Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2009-07-22 12:52:49 -07:00
..
atom.c Constify atom name strings 2009-02-03 10:06:00 -08:00
buildatoms XFree86 4.3.0.1 2003-11-14 16:49:22 +00:00
BuiltInAtoms R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
colormap.c Fix most remaining deprecated resource lookups. 2009-04-29 01:04:37 -04:00
cursor.c Fix most remaining deprecated resource lookups. 2009-04-29 01:04:37 -04:00
deprecated.c Fix most remaining deprecated resource lookups. 2009-04-29 01:04:37 -04:00
devices.c dix: switch to byte-counting functions. 2009-07-14 10:05:54 +10:00
dispatch.c Bug #22804: Reject out of bounds XGetImage requests 2009-07-22 12:52:49 -07:00
dispatch.h Remove RCS tags. Fix Xprint makefile braindamage. 2006-07-21 17:56:00 -04:00
dixfonts.c dix: switch to byte-counting functions. 2009-07-14 10:05:54 +10:00
dixutils.c Fix most remaining deprecated resource lookups. 2009-04-29 01:04:37 -04:00
enterleave.c input: move inputstr.h to where its needed. 2009-06-10 11:15:24 +10:00
enterleave.h dix: move focus handling into enterleave.c. 2009-01-08 11:45:22 +10:00
eventconvert.c dix: use sizeof(FP3232) instead of 2 * sizeof(int32_t). 2009-07-15 10:36:30 +10:00
events.c dix: fix null-pointer dereference on activating enter/focus grabs. 2009-07-22 15:27:16 +10:00
extension.c dix: switch to byte-counting functions. 2009-07-14 10:05:54 +10:00
ffs.c Rework symbol visibility for easier maintenance 2008-12-03 05:43:34 -02:00
gc.c Replace dixLookupResource by dixLookupResourceBy{Type,Class} 2009-03-09 13:08:09 -07:00
getevents.c xserver: remove unused code in clipValuators 2009-07-15 17:09:22 +10:00
globals.c DPMS: Remove the defaultDPMS* variables 2009-04-03 18:22:20 -04:00
glyphcurs.c Rework symbol visibility for easier maintenance 2008-12-03 05:43:34 -02:00
grabs.c input: remove XI2 keysym grabs, use keycode grabs instead. 2009-07-22 12:12:51 +10:00
initatoms.c Rework symbol visibility for easier maintenance 2008-12-03 05:43:34 -02:00
inpututils.c dix: set the client's error value to the bad deviceid in check_butmap_change. 2009-07-01 08:46:30 +10:00
main.c Update to xextproto 7.0.99.1. 2009-07-15 17:00:05 +10:00
Makefile.am dix: xserver "make dist" fails due to eventconvert.h (#27825) 2009-07-19 20:01:12 +10:00
pixmap.c Remove a bunch of useless casts. 2009-01-22 02:11:16 -05:00
privates.c Remove a bunch of useless casts. 2009-01-22 02:11:16 -05:00
property.c Check if new space was actually allocated before freeing. 2009-07-22 12:13:04 +10:00
protocol.txt Add XI 1.5 event and requests to protocol.txt 2009-04-20 12:50:34 +02:00
ptrveloc.c Revert "Coverity Prevent: RESOURCE_LEAK in AccelSetProfileProperty:" 2009-07-17 06:34:00 +03:00
registry.c Rework symbol visibility for easier maintenance 2008-12-03 05:43:34 -02:00
resource.c dix/resource: fix use after free in resource code with DRI 2009-06-24 10:44:11 +10:00
selection.c xserver: Avoid sending uninitialized padding data over the network 2009-02-16 13:28:38 +10:00
swaprep.c dix: switch to byte-counting functions. 2009-07-14 10:05:54 +10:00
swapreq.c Remove #define NEED_EVENTS and NEED_REPLIES 2008-12-12 11:43:32 +10:00
tables.c Remove #define NEED_EVENTS and NEED_REPLIES 2008-12-12 11:43:32 +10:00
window.c dix: switch to byte-counting functions. 2009-07-14 10:05:54 +10:00
Xserver-dtrace.h.in Add DTrace probe points for X server <-> client communications 2006-11-03 12:54:43 -08:00
Xserver.d Add DTrace probe points for X server <-> client communications 2006-11-03 12:54:43 -08:00