Attachment 8309 Details for Bug 9267 – Updated patch for git master

[patch] Updated patch for git master

dbe-render-HEAD.diff (text/plain), 5.31 KB, created by Matthieu Herrb on 2007-01-06 01:17:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthieu Herrb

Created: 2007-01-06 01:17:11 UTC

Size: 5.31 KB

patch

obsolete

>diff --git a/dbe/dbe.c b/dbe/dbe.c
>index 38375f9..266ecdd 100644
>--- a/dbe/dbe.c
>+++ b/dbe/dbe.c
>@@ -39,6 +39,11 @@
> #endif
> 
> #include <string.h>
>+#if HAVE_STDINT_T
>+#include <stdint.h>
>+#elif !defined(UINT32_MAX)
>+#define UINT32_MAX 0xffffffffU
>+#endif
> 
> #include <X11/X.h>
> #include <X11/Xproto.h>
>@@ -711,11 +716,14 @@ ProcDbeSwapBuffers(ClientPtr client)
>         return(Success);
>     }
> 
>+    if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
>+	    return BadAlloc;
>+
>     /* Get to the swap info appended to the end of the request. */
>     dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
> 
>     /* Allocate array to record swap information. */ 
>-    swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec));
>+    swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec));
>     if (swapInfo == NULL)
>     {
>         return(BadAlloc);
>@@ -730,14 +738,14 @@ ProcDbeSwapBuffers(ClientPtr client)
> 	error = dixLookupWindow(&pWin, dbeSwapInfo[i].window, client,
> 				DixWriteAccess);
> 	if (error != Success) {
>-            DEALLOCATE_LOCAL(swapInfo);
>+            Xfree(swapInfo);
> 	    return error;
>         }
> 
>         /* Each window must be double-buffered - BadMatch. */
>         if (DBE_WINDOW_PRIV(pWin) == NULL)
>         {
>-            DEALLOCATE_LOCAL(swapInfo);
>+            Xfree(swapInfo);
>             return(BadMatch);
>         }
> 
>@@ -746,7 +754,7 @@ ProcDbeSwapBuffers(ClientPtr client)
>         {
>             if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)
>             {
>-                DEALLOCATE_LOCAL(swapInfo);
>+                Xfree(swapInfo);
>                 return(BadMatch);
> 	    }
>         }
>@@ -757,7 +765,7 @@ ProcDbeSwapBuffers(ClientPtr client)
>             (dbeSwapInfo[i].swapAction != XdbeUntouched ) &&
>             (dbeSwapInfo[i].swapAction != XdbeCopied    ))
>         {
>-            DEALLOCATE_LOCAL(swapInfo);
>+            Xfree(swapInfo);
>             return(BadValue);
>         }
> 
>@@ -787,12 +795,12 @@ ProcDbeSwapBuffers(ClientPtr client)
>         error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);
>         if (error != Success)
>         {
>-            DEALLOCATE_LOCAL(swapInfo);
>+            Xfree(swapInfo);
>             return(error);
>         }
>     }
>     
>-    DEALLOCATE_LOCAL(swapInfo);
>+    Xfree(swapInfo);
>     return(Success);
> 
> } /* ProcDbeSwapBuffers() */
>@@ -874,10 +882,12 @@ ProcDbeGetVisualInfo(ClientPtr client)
> 
>     REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
> 
>+    if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
>+	    return BadAlloc;
>     /* Make sure any specified drawables are valid. */
>     if (stuff->n != 0)
>     {
>-        if (!(pDrawables = (DrawablePtr *)ALLOCATE_LOCAL(stuff->n *
>+        if (!(pDrawables = (DrawablePtr *)Xalloc(stuff->n *
>                                                  sizeof(DrawablePtr))))
>         {
>             return(BadAlloc);
>@@ -890,7 +900,7 @@ ProcDbeGetVisualInfo(ClientPtr client)
> 	    rc = dixLookupDrawable(pDrawables+i, drawables[i], client, 0,
> 				   DixReadAccess);
> 	    if (rc != Success) {
>-                DEALLOCATE_LOCAL(pDrawables);
>+                Xfree(pDrawables);
>                 return rc;
>             }
>         }
>@@ -902,7 +912,7 @@ ProcDbeGetVisualInfo(ClientPtr client)
>     {
>         if (pDrawables)
>         {
>-            DEALLOCATE_LOCAL(pDrawables);
>+            Xfree(pDrawables);
>         }
> 
>         return(BadAlloc);
>@@ -929,7 +939,7 @@ ProcDbeGetVisualInfo(ClientPtr client)
>             /* Free pDrawables if we needed to allocate it above. */
>             if (pDrawables)
>             {
>-                DEALLOCATE_LOCAL(pDrawables);
>+                Xfree(pDrawables);
>             }
> 
>             return(BadAlloc);
>@@ -1010,7 +1020,7 @@ ProcDbeGetVisualInfo(ClientPtr client)
> 
>     if (pDrawables)
>     {
>-        DEALLOCATE_LOCAL(pDrawables);
>+        Xfree(pDrawables);
>     }
> 
>     return(client->noClientException);
>diff --git a/hw/xfree86/scanpci/pci.ids b/hw/xfree86/scanpci/pci.ids
>diff --git a/hw/xfree86/scanpci/xf86PciStdIds.h b/hw/xfree86/scanpci/xf86PciStdIds.h
>diff --git a/render/render.c b/render/render.c
>index 126d08d..348d4c6 100644
>--- a/render/render.c
>+++ b/render/render.c
>@@ -47,6 +47,12 @@
> #include <X11/Xfuncproto.h>
> #include "cursorstr.h"
> 
>+#if HAVE_STDINT_H
>+#include <stdint.h>
>+#elif !defined(UINT32_MAX)
>+#define UINT32_MAX 0xffffffffU
>+#endif
>+
> static int ProcRenderQueryVersion (ClientPtr pClient);
> static int ProcRenderQueryPictFormats (ClientPtr pClient);
> static int ProcRenderQueryPictIndexValues (ClientPtr pClient);
>@@ -1105,11 +1111,14 @@ ProcRenderAddGlyphs (ClientPtr client)
>     }
> 
>     nglyphs = stuff->nglyphs;
>+    if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))
>+	    return BadAlloc;
>+
>     if (nglyphs <= NLOCALGLYPH)
> 	glyphsBase = glyphsLocal;
>     else
>     {
>-	glyphsBase = (GlyphNewPtr) ALLOCATE_LOCAL (nglyphs * sizeof (GlyphNewRec));
>+	glyphsBase = (GlyphNewPtr) Xalloc (nglyphs * sizeof (GlyphNewRec));
> 	if (!glyphsBase)
> 	    return BadAlloc;
>     }
>@@ -1166,7 +1175,7 @@ ProcRenderAddGlyphs (ClientPtr client)
>     }
> 
>     if (glyphsBase != glyphsLocal)
>-	DEALLOCATE_LOCAL (glyphsBase);
>+	Xfree (glyphsBase);
>     return client->noClientException;
> bail:
>     while (glyphs != glyphsBase)
>@@ -1175,7 +1184,7 @@ bail:
> 	xfree (glyphs->glyph);
>     }
>     if (glyphsBase != glyphsLocal)
>-	DEALLOCATE_LOCAL (glyphsBase);
>+	Xfree (glyphsBase);
>     return err;
> }
>

Actions: View | Splinter Review

Attachments on bug 9267: 7986 | 7987 | 7988 | 7989 | 7990 | 7991 | 8007 | 8309 | 8310

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.