Attachment #105885 for bug #157421

Lines 41-46 Link Here

(-)dbe/dbe.c.old (-12 / +23 lines)
41	#include <dix-config.h>	41	#include <dix-config.h>
42	#endif	42	#endif
43		43
		44	#if HAVE_STDINT_T
		45	#include <stdint.h>
		46	#elif !defined(UINT32_MAX)
		47	#define UINT32_MAX 0xffffffffU
		48	#endif
		49
44	#include <X11/X.h>	50	#include <X11/X.h>
45	#include <X11/Xproto.h>	51	#include <X11/Xproto.h>
46	#include "scrnintstr.h"	52	#include "scrnintstr.h"
Lines 733-743 ProcDbeSwapBuffers(client) Link Here
733	return(Success);	739	return(Success);
734	}	740	}
735		741
		742	if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
		743	return BadAlloc;
		744
736	/* Get to the swap info appended to the end of the request. */	745	/* Get to the swap info appended to the end of the request. */
737	dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];	746	dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
738		747
739	/* Allocate array to record swap information. */	748	/* Allocate array to record swap information. */
740	swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec));	749	swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec));
741	if (swapInfo == NULL)	750	if (swapInfo == NULL)
742	{	751	{
743	return(BadAlloc);	752	return(BadAlloc);
Lines 752-765 ProcDbeSwapBuffers(client) Link Here
752	if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client,	761	if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client,
753	SecurityWriteAccess)))	762	SecurityWriteAccess)))
754	{	763	{
755	DEALLOCATE_LOCAL(swapInfo);	764	Xfree(swapInfo);
756	return(BadWindow);	765	return(BadWindow);
757	}	766	}
758		767
759	/* Each window must be double-buffered - BadMatch. */	768	/* Each window must be double-buffered - BadMatch. */
760	if (DBE_WINDOW_PRIV(pWin) == NULL)	769	if (DBE_WINDOW_PRIV(pWin) == NULL)
761	{	770	{
762	DEALLOCATE_LOCAL(swapInfo);	771	Xfree(swapInfo);
763	return(BadMatch);	772	return(BadMatch);
764	}	773	}
765		774
Lines 768-774 ProcDbeSwapBuffers(client) Link Here
768	{	777	{
769	if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)	778	if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)
770	{	779	{
771	DEALLOCATE_LOCAL(swapInfo);	780	Xfree(swapInfo);
772	return(BadMatch);	781	return(BadMatch);
773	}	782	}
774	}	783	}
Lines 779-785 ProcDbeSwapBuffers(client) Link Here
779	(dbeSwapInfo[i].swapAction != XdbeUntouched ) &&	788	(dbeSwapInfo[i].swapAction != XdbeUntouched ) &&
780	(dbeSwapInfo[i].swapAction != XdbeCopied ))	789	(dbeSwapInfo[i].swapAction != XdbeCopied ))
781	{	790	{
782	DEALLOCATE_LOCAL(swapInfo);	791	Xfree(swapInfo);
783	return(BadValue);	792	return(BadValue);
784	}	793	}
785		794
Lines 809-820 ProcDbeSwapBuffers(client) Link Here
809	error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);	818	error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);
810	if (error != Success)	819	if (error != Success)
811	{	820	{
812	DEALLOCATE_LOCAL(swapInfo);	821	Xfree(swapInfo);
813	return(error);	822	return(error);
814	}	823	}
815	}	824	}
816		825
817	DEALLOCATE_LOCAL(swapInfo);	826	Xfree(swapInfo);
818	return(Success);	827	return(Success);
819		828
820	} /* ProcDbeSwapBuffers() */	829	} /* ProcDbeSwapBuffers() */
Lines 898-907 ProcDbeGetVisualInfo(client) Link Here
898		907
899	REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);	908	REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
900		909
		910	if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
		911	return BadAlloc;
901	/* Make sure any specified drawables are valid. */	912	/* Make sure any specified drawables are valid. */
902	if (stuff->n != 0)	913	if (stuff->n != 0)
903	{	914	{
904	if (!(pDrawables = (DrawablePtr )ALLOCATE_LOCAL(stuff->n	915	if (!(pDrawables = (DrawablePtr )Xalloc(stuff->n
905	sizeof(DrawablePtr))))	916	sizeof(DrawablePtr))))
906	{	917	{
907	return(BadAlloc);	918	return(BadAlloc);
Lines 914-920 ProcDbeGetVisualInfo(client) Link Here
914	if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable(	925	if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable(
915	drawables[i], client, SecurityReadAccess)))	926	drawables[i], client, SecurityReadAccess)))
916	{	927	{
917	DEALLOCATE_LOCAL(pDrawables);	928	Xfree(pDrawables);
918	return(BadDrawable);	929	return(BadDrawable);
919	}	930	}
920	}	931	}
Lines 926-932 ProcDbeGetVisualInfo(client) Link Here
926	{	937	{
927	if (pDrawables)	938	if (pDrawables)
928	{	939	{
929	DEALLOCATE_LOCAL(pDrawables);	940	Xfree(pDrawables);
930	}	941	}
931		942
932	return(BadAlloc);	943	return(BadAlloc);
Lines 953-959 ProcDbeGetVisualInfo(client) Link Here
953	/* Free pDrawables if we needed to allocate it above. */	964	/* Free pDrawables if we needed to allocate it above. */
954	if (pDrawables)	965	if (pDrawables)
955	{	966	{
956	DEALLOCATE_LOCAL(pDrawables);	967	Xfree(pDrawables);
957	}	968	}
958		969
959	return(BadAlloc);	970	return(BadAlloc);
Lines 1034-1040 ProcDbeGetVisualInfo(client) Link Here
1034		1045
1035	if (pDrawables)	1046	if (pDrawables)
1036	{	1047	{
1037	DEALLOCATE_LOCAL(pDrawables);	1048	Xfree(pDrawables);
1038	}	1049	}
1039		1050
1040	return(client->noClientException);	1051	return(client->noClientException);

Lines 52-57 Link Here

(-)render/render.c.old (-3 / +12 lines)
52	#include "xf86_ansic.h"	52	#include "xf86_ansic.h"
53	#endif	53	#endif
54		54
		55	#if HAVE_STDINT_H
		56	#include <stdint.h>
		57	#elif !defined(UINT32_MAX)
		58	#define UINT32_MAX 0xffffffffU
		59	#endif
		60
55	static int ProcRenderQueryVersion (ClientPtr pClient);	61	static int ProcRenderQueryVersion (ClientPtr pClient);
56	static int ProcRenderQueryPictFormats (ClientPtr pClient);	62	static int ProcRenderQueryPictFormats (ClientPtr pClient);
57	static int ProcRenderQueryPictIndexValues (ClientPtr pClient);	63	static int ProcRenderQueryPictIndexValues (ClientPtr pClient);
Lines 1108-1118 ProcRenderAddGlyphs (ClientPtr client) Link Here
1108	}	1114	}
1109		1115
1110	nglyphs = stuff->nglyphs;	1116	nglyphs = stuff->nglyphs;
		1117	if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))
		1118	return BadAlloc;
		1119
1111	if (nglyphs <= NLOCALGLYPH)	1120	if (nglyphs <= NLOCALGLYPH)
1112	glyphsBase = glyphsLocal;	1121	glyphsBase = glyphsLocal;
1113	else	1122	else
1114	{	1123	{
1115	glyphsBase = (GlyphNewPtr) ALLOCATE_LOCAL (nglyphs * sizeof (GlyphNewRec));	1124	glyphsBase = (GlyphNewPtr) Xalloc (nglyphs * sizeof (GlyphNewRec));
1116	if (!glyphsBase)	1125	if (!glyphsBase)
1117	return BadAlloc;	1126	return BadAlloc;
1118	}	1127	}
Lines 1169-1175 ProcRenderAddGlyphs (ClientPtr client) Link Here
1169	}	1178	}
1170		1179
1171	if (glyphsBase != glyphsLocal)	1180	if (glyphsBase != glyphsLocal)
1172	DEALLOCATE_LOCAL (glyphsBase);	1181	Xfree (glyphsBase);
1173	return client->noClientException;	1182	return client->noClientException;
1174	bail:	1183	bail:
1175	while (glyphs != glyphsBase)	1184	while (glyphs != glyphsBase)
Lines 1178-1184 bail: Link Here
1178	xfree (glyphs->glyph);	1187	xfree (glyphs->glyph);
1179	}	1188	}
1180	if (glyphsBase != glyphsLocal)	1189	if (glyphsBase != glyphsLocal)
1181	DEALLOCATE_LOCAL (glyphsBase);	1190	Xfree (glyphsBase);
1182	return err;	1191	return err;
1183	}	1192	}
1184		1193

Return to bug 157421