Gentoo Attachment #140149 for bug #204362

View | Details | Raw Unified
Collapse All | Expand All

(-) xorg-server-1.3.0.0/Xext/EVI.c (-1 / +14 lines)

Lines 34-39 THE USE OR PERFORMANCE OF THIS SOFTWARE.	Link Here

#include <X11/extensions/XEVIstr.h>

#include <X11/extensions/XEVIstr.h>

#include "EVIstruct.h"

#include "EVIstruct.h"

#include "modinit.h"

#include "modinit.h"

#include "scrnintstr.h"

#if 0

#if 0

static unsigned char XEVIReqCode = 0;

static unsigned char XEVIReqCode = 0;

Lines 87-96 ProcEVIGetVisualInfo(ClientPtr client)	Link Here

    REQUEST(xEVIGetVisualInfoReq);

    REQUEST(xEVIGetVisualInfoReq);

    xEVIGetVisualInfoReply rep;

    xEVIGetVisualInfoReply rep;

    int n, n_conflict, n_info, sz_info, sz_conflict;

    int i, n, n_conflict, n_info, sz_info, sz_conflict;

    VisualID32 *conflict;

    VisualID32 *conflict;

    unsigned int total_visuals = 0;

    xExtendedVisualInfo *eviInfo;

    xExtendedVisualInfo *eviInfo;

    int status;

    int status;

/*

     * do this first, otherwise REQUEST_FIXED_SIZE can overflow.  we assume

     * here that you don't have more than 2^32 visuals over all your screens;

     * this seems like a safe assumption.

*/

    for (i = 0; i < screenInfo.numScreens; i++)

	total_visuals += screenInfo.screens[i]->numVisuals;

    if (stuff->n_visual > total_visuals)

	return BadValue;

    REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);

    REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);

    status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,

    status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,

		&eviInfo, &n_info, &conflict, &n_conflict);

		&eviInfo, &n_info, &conflict, &n_conflict);

(-) xorg-server-1.3.0.0/Xext/cup.c (+3 lines)

Lines 196-201 int ProcGetReservedColormapEntries(	Link Here

    REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);

    REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);

    if (stuff->screen >= screenInfo.numScreens)

	return BadValue;

#ifndef HAVE_SPECIAL_DESKTOP_COLORS

#ifndef HAVE_SPECIAL_DESKTOP_COLORS

    citems[CUP_BLACK_PIXEL].pixel =

    citems[CUP_BLACK_PIXEL].pixel =

	screenInfo.screens[stuff->screen]->blackPixel;

	screenInfo.screens[stuff->screen]->blackPixel;

(-) xorg-server-1.3.0.0/Xext/sampleEVI.c (-5 / +24 lines)

Lines 35-40 THE USE OR PERFORMANCE OF THIS SOFTWARE.	Link Here

#include <X11/extensions/XEVIstr.h>

#include <X11/extensions/XEVIstr.h>

#include "EVIstruct.h"

#include "EVIstruct.h"

#include "scrnintstr.h"

#include "scrnintstr.h"

#if HAVE_STDINT_H

#include <stdint.h>

#elif !defined(INT_MAX)

#define INT_MAX 0x7fffffff

#endif

static int sampleGetVisualInfo(

static int sampleGetVisualInfo(

    VisualID32 *visual,

    VisualID32 *visual,

    int n_visual,

    int n_visual,

Lines 43-66 static int sampleGetVisualInfo(	Link Here

    VisualID32 **conflict_rn,

    VisualID32 **conflict_rn,

    int *n_conflict_rn)

    int *n_conflict_rn)

    int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;

    unsigned int max_sz_evi;

    VisualID32 *temp_conflict;

    VisualID32 *temp_conflict;

    xExtendedVisualInfo *evi;

    xExtendedVisualInfo *evi;

    int max_visuals = 0, max_sz_conflict, sz_conflict = 0;

    unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;

    register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;

    register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;

    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);

    if (!*evi_rn)

    if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))

         return BadAlloc;

	return BadAlloc;

    max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;

    for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

    for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

        if (screenInfo.screens[scrI]->numVisuals > max_visuals)

        if (screenInfo.screens[scrI]->numVisuals > max_visuals)

            max_visuals = screenInfo.screens[scrI]->numVisuals;

            max_visuals = screenInfo.screens[scrI]->numVisuals;

    if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens

			       * max_visuals))

	return BadAlloc;

    max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;

    max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;

    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);

    if (!*evi_rn)

         return BadAlloc;

    temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);

    temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);

    if (!temp_conflict) {

    if (!temp_conflict) {

        xfree(*evi_rn);

        xfree(*evi_rn);

        return BadAlloc;

        return BadAlloc;

    for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

    for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

        for (visualI = 0; visualI < n_visual; visualI++) {

        for (visualI = 0; visualI < n_visual; visualI++) {

	    evi[sz_evi].core_visual_id = visual[visualI];

	    evi[sz_evi].core_visual_id = visual[visualI];

(-) xorg-server-1.3.0.0/Xext/security.c (-2 / +2 lines)

Lines 1567-1573 SecurityLoadPropertyAccessList(void)	Link Here

	return;

	return;

#ifndef __UNIXOS2__

#ifndef __UNIXOS2__

    f = fopen(SecurityPolicyFile, "r");

    f = Fopen(SecurityPolicyFile, "r");

#else

#else

    f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");

    f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");

#endif

#endif

Lines 1653-1659 SecurityLoadPropertyAccessList(void)	Link Here

#endif /* PROPDEBUG */

#endif /* PROPDEBUG */

    fclose(f);

    Fclose(f);

} /* SecurityLoadPropertyAccessList */

} /* SecurityLoadPropertyAccessList */

(-) xorg-server-1.3.0.0/Xext/shm.c (-8 / +38 lines)

Lines 723-728 ProcPanoramiXShmCreatePixmap(	Link Here

    int i, j, result;

    int i, j, result;

    ShmDescPtr shmdesc;

    ShmDescPtr shmdesc;

    REQUEST(xShmCreatePixmapReq);

    REQUEST(xShmCreatePixmapReq);

    unsigned int width, height, depth;

    unsigned long size;

    PanoramiXRes *newPix;

    PanoramiXRes *newPix;

    REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

    REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

Lines 732-742 ProcPanoramiXShmCreatePixmap(	Link Here

    LEGAL_NEW_RESOURCE(stuff->pid, client);

    LEGAL_NEW_RESOURCE(stuff->pid, client);

    VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);

    VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);

    VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

    VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

    if (!stuff->width || !stuff->height)

    width = stuff->width;

    height = stuff->height;

    depth = stuff->depth;

    if (!width || !height || !depth)

	client->errorValue = 0;

	client->errorValue = 0;

        return BadValue;

        return BadValue;

    if (width > 32767 || height > 32767)

        return BadAlloc;

    size = PixmapBytePad(width, depth) * height;

    if (sizeof(size) == 4) {

        if (size < width * height)

            return BadAlloc;

        /* thankfully, offset is unsigned */

        if (stuff->offset + size < size)

            return BadAlloc;

    if (stuff->depth != 1)

    if (stuff->depth != 1)

        pDepth = pDraw->pScreen->allowedDepths;

        pDepth = pDraw->pScreen->allowedDepths;

Lines 747-755 ProcPanoramiXShmCreatePixmap(	Link Here

        return BadValue;

        return BadValue;

CreatePmap:

CreatePmap:

    VERIFY_SHMSIZE(shmdesc, stuff->offset,

    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);

		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,

		   client);

    if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))

    if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))

	return BadAlloc;

	return BadAlloc;

Lines 1047-1052 ProcShmCreatePixmap(client)	Link Here

    register int i;

    register int i;

    ShmDescPtr shmdesc;

    ShmDescPtr shmdesc;

    REQUEST(xShmCreatePixmapReq);

    REQUEST(xShmCreatePixmapReq);

    unsigned int width, height, depth;

    unsigned long size;

    REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

    REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

    client->errorValue = stuff->pid;

    client->errorValue = stuff->pid;

Lines 1055-1065 ProcShmCreatePixmap(client)	Link Here

    LEGAL_NEW_RESOURCE(stuff->pid, client);

    LEGAL_NEW_RESOURCE(stuff->pid, client);

    VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);

    VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);

    VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

    VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

    if (!stuff->width || !stuff->height)

    width = stuff->width;

    height = stuff->height;

    depth = stuff->depth;

    if (!width || !height || !depth)

	client->errorValue = 0;

	client->errorValue = 0;

        return BadValue;

        return BadValue;

    if (width > 32767 || height > 32767)

	return BadAlloc;

    size = PixmapBytePad(width, depth) * height;

    if (sizeof(size) == 4) {

	if (size < width * height)

	    return BadAlloc;

	/* thankfully, offset is unsigned */

	if (stuff->offset + size < size)

	    return BadAlloc;

    if (stuff->depth != 1)

    if (stuff->depth != 1)

        pDepth = pDraw->pScreen->allowedDepths;

        pDepth = pDraw->pScreen->allowedDepths;

Lines 1070-1078 ProcShmCreatePixmap(client)	Link Here

        return BadValue;

        return BadValue;

CreatePmap:

CreatePmap:

    VERIFY_SHMSIZE(shmdesc, stuff->offset,

    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);

		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,

		   client);

    pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(

    pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(

			    pDraw->pScreen, stuff->width,

			    pDraw->pScreen, stuff->width,

			    stuff->height, stuff->depth,

			    stuff->height, stuff->depth,

(-) xorg-server-1.3.0.0/Xi/chgfctl.c (-6 / +1 lines)

Lines 451-468 ChangeStringFeedback(ClientPtr client, D	Link Here

		     xStringFeedbackCtl * f)

		     xStringFeedbackCtl * f)

    register char n;

    register char n;

    register long *p;

    int i, j;

    int i, j;

    KeySym *syms, *sup_syms;

    KeySym *syms, *sup_syms;

    syms = (KeySym *) (f + 1);

    syms = (KeySym *) (f + 1);

    if (client->swapped) {

    if (client->swapped) {

	swaps(&f->length, n);	/* swapped num_keysyms in calling proc */

	swaps(&f->length, n);	/* swapped num_keysyms in calling proc */

	p = (long *)(syms);

	SwapLongs((CARD32 *) syms, f->num_keysyms);

	for (i = 0; i < f->num_keysyms; i++) {

	    swapl(p, n);

	    p++;

    if (f->num_keysyms > s->ctrl.max_symbols) {

    if (f->num_keysyms > s->ctrl.max_symbols) {

(-) xorg-server-1.3.0.0/Xi/chgkmap.c (-7 / +7 lines)

Lines 79-96 int	Link Here

SProcXChangeDeviceKeyMapping(register ClientPtr client)

SProcXChangeDeviceKeyMapping(register ClientPtr client)

    register char n;

    register char n;

    register long *p;

    register unsigned int count;

    register int i, count;

    REQUEST(xChangeDeviceKeyMappingReq);

    REQUEST(xChangeDeviceKeyMappingReq);

    swaps(&stuff->length, n);

    swaps(&stuff->length, n);

    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

    p = (long *)&stuff[1];

    count = stuff->keyCodes * stuff->keySymsPerKeyCode;

    count = stuff->keyCodes * stuff->keySymsPerKeyCode;

    for (i = 0; i < count; i++) {

    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));

	swapl(p, n);

    SwapLongs((CARD32 *) (&stuff[1]), count);

	p++;

    return (ProcXChangeDeviceKeyMapping(client));

    return (ProcXChangeDeviceKeyMapping(client));

Lines 106-115 ProcXChangeDeviceKeyMapping(register Cli	Link Here

    int ret;

    int ret;

    unsigned len;

    unsigned len;

    DeviceIntPtr dev;

    DeviceIntPtr dev;

    unsigned int count;

    REQUEST(xChangeDeviceKeyMappingReq);

    REQUEST(xChangeDeviceKeyMappingReq);

    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

    count = stuff->keyCodes * stuff->keySymsPerKeyCode;

    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));

    dev = LookupDeviceIntRec(stuff->deviceid);

    dev = LookupDeviceIntRec(stuff->deviceid);

    if (dev == NULL) {

    if (dev == NULL) {

	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,

	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,

(-) xorg-server-1.3.0.0/Xi/chgprop.c (-7 / +3 lines)

Lines 81-99 int	Link Here

SProcXChangeDeviceDontPropagateList(register ClientPtr client)

SProcXChangeDeviceDontPropagateList(register ClientPtr client)

    register char n;

    register char n;

    register long *p;

    register int i;

    REQUEST(xChangeDeviceDontPropagateListReq);

    REQUEST(xChangeDeviceDontPropagateListReq);

    swaps(&stuff->length, n);

    swaps(&stuff->length, n);

    REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);

    REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);

    swapl(&stuff->window, n);

    swapl(&stuff->window, n);

    swaps(&stuff->count, n);

    swaps(&stuff->count, n);

    p = (long *)&stuff[1];

    REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,

    for (i = 0; i < stuff->count; i++) {

                      stuff->count * sizeof(CARD32));

	swapl(p, n);

    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);

	p++;

    return (ProcXChangeDeviceDontPropagateList(client));

    return (ProcXChangeDeviceDontPropagateList(client));

(-) xorg-server-1.3.0.0/Xi/grabdev.c (-7 / +5 lines)

Lines 82-89 int	Link Here

SProcXGrabDevice(register ClientPtr client)

SProcXGrabDevice(register ClientPtr client)

    register char n;

    register char n;

    register long *p;

    register int i;

    REQUEST(xGrabDeviceReq);

    REQUEST(xGrabDeviceReq);

    swaps(&stuff->length, n);

    swaps(&stuff->length, n);

Lines 91-101 SProcXGrabDevice(register ClientPtr clie	Link Here

    swapl(&stuff->grabWindow, n);

    swapl(&stuff->grabWindow, n);

    swapl(&stuff->time, n);

    swapl(&stuff->time, n);

    swaps(&stuff->event_count, n);

    swaps(&stuff->event_count, n);

    p = (long *)&stuff[1];

    for (i = 0; i < stuff->event_count; i++) {

    if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)

	swapl(p, n);

       return BadLength;

	p++;

    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);

    return (ProcXGrabDevice(client));

    return (ProcXGrabDevice(client));

(-) xorg-server-1.3.0.0/Xi/grabdevb.c (-7 / +3 lines)

Lines 80-87 int	Link Here

SProcXGrabDeviceButton(register ClientPtr client)

SProcXGrabDeviceButton(register ClientPtr client)

    register char n;

    register char n;

    register long *p;

    register int i;

    REQUEST(xGrabDeviceButtonReq);

    REQUEST(xGrabDeviceButtonReq);

    swaps(&stuff->length, n);

    swaps(&stuff->length, n);

Lines 89-99 SProcXGrabDeviceButton(register ClientPt	Link Here

    swapl(&stuff->grabWindow, n);

    swapl(&stuff->grabWindow, n);

    swaps(&stuff->modifiers, n);

    swaps(&stuff->modifiers, n);

    swaps(&stuff->event_count, n);

    swaps(&stuff->event_count, n);

    p = (long *)&stuff[1];

    REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,

    for (i = 0; i < stuff->event_count; i++) {

                      stuff->event_count * sizeof(CARD32));

	swapl(p, n);

    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);

	p++;

    return (ProcXGrabDeviceButton(client));

    return (ProcXGrabDeviceButton(client));

(-) xorg-server-1.3.0.0/Xi/grabdevk.c (-7 / +2 lines)

Lines 80-87 int	Link Here

SProcXGrabDeviceKey(register ClientPtr client)

SProcXGrabDeviceKey(register ClientPtr client)

    register char n;

    register char n;

    register long *p;

    register int i;

    REQUEST(xGrabDeviceKeyReq);

    REQUEST(xGrabDeviceKeyReq);

    swaps(&stuff->length, n);

    swaps(&stuff->length, n);

Lines 89-99 SProcXGrabDeviceKey(register ClientPtr c	Link Here

    swapl(&stuff->grabWindow, n);

    swapl(&stuff->grabWindow, n);

    swaps(&stuff->modifiers, n);

    swaps(&stuff->modifiers, n);

    swaps(&stuff->event_count, n);

    swaps(&stuff->event_count, n);

    p = (long *)&stuff[1];

    REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));

    for (i = 0; i < stuff->event_count; i++) {

    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);

	swapl(p, n);

	p++;

    return (ProcXGrabDeviceKey(client));

    return (ProcXGrabDeviceKey(client));

(-) xorg-server-1.3.0.0/Xi/selectev.c (-7 / +4 lines)

Lines 84-102 int	Link Here

SProcXSelectExtensionEvent(register ClientPtr client)

SProcXSelectExtensionEvent(register ClientPtr client)

    register char n;

    register char n;

    register long *p;

    register int i;

    REQUEST(xSelectExtensionEventReq);

    REQUEST(xSelectExtensionEventReq);

    swaps(&stuff->length, n);

    swaps(&stuff->length, n);

    REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);

    REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);

    swapl(&stuff->window, n);

    swapl(&stuff->window, n);

    swaps(&stuff->count, n);

    swaps(&stuff->count, n);

    p = (long *)&stuff[1];

    REQUEST_FIXED_SIZE(xSelectExtensionEventReq,

    for (i = 0; i < stuff->count; i++) {

                      stuff->count * sizeof(CARD32));

	swapl(p, n);

    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);

	p++;

    return (ProcXSelectExtensionEvent(client));

    return (ProcXSelectExtensionEvent(client));

(-) xorg-server-1.3.0.0/Xi/sendexev.c (-6 / +8 lines)

Lines 83-89 int	Link Here

SProcXSendExtensionEvent(register ClientPtr client)

SProcXSendExtensionEvent(register ClientPtr client)

    register char n;

    register char n;

    register long *p;

    register CARD32 *p;

    register int i;

    register int i;

    xEvent eventT;

    xEvent eventT;

    xEvent *eventP;

    xEvent *eventP;

Lines 94-99 SProcXSendExtensionEvent(register Client	Link Here

    REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);

    REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);

    swapl(&stuff->destination, n);

    swapl(&stuff->destination, n);

    swaps(&stuff->count, n);

    swaps(&stuff->count, n);

    if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +

       (stuff->num_events * (sizeof(xEvent) >> 2)))

       return BadLength;

    eventP = (xEvent *) & stuff[1];

    eventP = (xEvent *) & stuff[1];

    for (i = 0; i < stuff->num_events; i++, eventP++) {

    for (i = 0; i < stuff->num_events; i++, eventP++) {

	proc = EventSwapVector[eventP->u.u.type & 0177];

	proc = EventSwapVector[eventP->u.u.type & 0177];

Lines 103-113 SProcXSendExtensionEvent(register Client	Link Here

	*eventP = eventT;

	*eventP = eventT;

    p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events);

    p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);

    for (i = 0; i < stuff->count; i++) {

    SwapLongs(p, stuff->count);

	swapl(p, n);

	p++;

    return (ProcXSendExtensionEvent(client));

    return (ProcXSendExtensionEvent(client));

(-) xorg-server-1.3.0.0/dix/dixfonts.c (+7 lines)

Lines 329-334 doOpenFont(ClientPtr client, OFclosurePt	Link Here

	err = BadFontName;

	err = BadFontName;

	goto bail;

	goto bail;

    /* check values for firstCol, lastCol, firstRow, and lastRow */

    if (pfont->info.firstCol > pfont->info.lastCol ||

       pfont->info.firstRow > pfont->info.lastRow ||

       pfont->info.lastCol - pfont->info.firstCol > 255) {

       err = AllocError;

       goto bail;

    if (!pfont->fpe)

    if (!pfont->fpe)

	pfont->fpe = fpe;

	pfont->fpe = fpe;

    pfont->refcnt++;

    pfont->refcnt++;

(-) xorg-server-1.3.0.0/hw/xfree86/common/xf86MiscExt.c (+4 lines)

Lines 640-645 MiscExtPassMessage(int scrnIndex, const	Link Here

    DEBUG_P("MiscExtPassMessage");

    DEBUG_P("MiscExtPassMessage");

    /* should check this in the protocol, but xf86NumScreens isn't exported */

    if (scrnIndex >= xf86NumScreens)

	return BadValue;

    if (*pScr->HandleMessage == NULL)

    if (*pScr->HandleMessage == NULL)

	    return BadImplementation;

	    return BadImplementation;

    return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);

    return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);

Attachment #140149: 1.3.0.0-security-204362.patch for bug #204362