Attachment 8007 Details for Bug 9267 – Proposed patch

[patch] Proposed patch

idefense.diff (text/plain), 1.57 KB, created by Matthieu Herrb on 2006-12-07 13:03:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthieu Herrb

Created: 2006-12-07 13:03:21 UTC

Size: 1.57 KB

patch

obsolete

>diff --git a/dbe/dbe.c b/dbe/dbe.c
>index 5b43dd1..8fef5bd 100644
>--- a/dbe/dbe.c
>+++ b/dbe/dbe.c
>@@ -39,6 +39,11 @@ #include <dix-config.h>
> #endif
> 
> #include <string.h>
>+#if HAVE_STDINT_T
>+#include <stdint.h>
>+#else
>+#define UINT32_MAX 0xffffffffU
>+#endif
> 
> #include <X11/X.h>
> #include <X11/Xproto.h>
>@@ -713,6 +718,9 @@ ProcDbeSwapBuffers(ClientPtr client)
>         return(Success);
>     }
> 
>+    if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
>+	    return BadAlloc;
>+
>     /* Get to the swap info appended to the end of the request. */
>     dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
> 
>@@ -876,6 +884,8 @@ ProcDbeGetVisualInfo(ClientPtr client)
> 
>     REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
> 
>+    if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
>+	    return BadAlloc;
>     /* Make sure any specified drawables are valid. */
>     if (stuff->n != 0)
>     {
>diff --git a/render/render.c b/render/render.c
>index e4d8d6b..b539b6e 100644
>--- a/render/render.c
>+++ b/render/render.c
>@@ -47,6 +47,12 @@ #include "glyphstr.h"
> #include <X11/Xfuncproto.h>
> #include "cursorstr.h"
> 
>+#if HAVE_STDINT_H
>+#include <stdint.h>
>+#else 
>+#define UINT32_MAX 0xffffffffU
>+#endif
>+
> static int ProcRenderQueryVersion (ClientPtr pClient);
> static int ProcRenderQueryPictFormats (ClientPtr pClient);
> static int ProcRenderQueryPictIndexValues (ClientPtr pClient);
>@@ -1103,6 +1109,9 @@ ProcRenderAddGlyphs (ClientPtr client)
>     }
> 
>     nglyphs = stuff->nglyphs;
>+    if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))
>+	    return BadAlloc;
>+
>     if (nglyphs <= NLOCALGLYPH)
> 	glyphsBase = glyphsLocal;
>     else

Actions: View | Splinter Review

Attachments on bug 9267: 7986 | 7987 | 7988 | 7989 | 7990 | 7991 | 8007 | 8309 | 8310

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.