Attachment #105889 for bug #157421

Lines 39-44 Link Here

(-)a/dbe/dbe.c (-12 / +22 lines)
39	#endif	39	#endif
40		40
41	#include <string.h>	41	#include <string.h>
		42	#if HAVE_STDINT_T
		43	#include <stdint.h>
		44	#elif !defined(UINT32_MAX)
		45	#define UINT32_MAX 0xffffffffU
		46	#endif
42		47
43	#include <X11/X.h>	48	#include <X11/X.h>
44	#include <X11/Xproto.h>	49	#include <X11/Xproto.h>
Lines 713-723 ProcDbeSwapBuffers(ClientPtr client) Link Here
713	return(Success);	718	return(Success);
714	}	719	}
715		720
		721	if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))
		722	return BadAlloc;
		723
716	/* Get to the swap info appended to the end of the request. */	724	/* Get to the swap info appended to the end of the request. */
717	dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];	725	dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];
718		726
719	/* Allocate array to record swap information. */	727	/* Allocate array to record swap information. */
720	swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec));	728	swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec));
721	if (swapInfo == NULL)	729	if (swapInfo == NULL)
722	{	730	{
723	return(BadAlloc);	731	return(BadAlloc);
Lines 732-745 ProcDbeSwapBuffers(ClientPtr client) Link Here
732	if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client,	740	if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client,
733	SecurityWriteAccess)))	741	SecurityWriteAccess)))
734	{	742	{
735	DEALLOCATE_LOCAL(swapInfo);	743	Xfree(swapInfo);
736	return(BadWindow);	744	return(BadWindow);
737	}	745	}
738		746
739	/* Each window must be double-buffered - BadMatch. */	747	/* Each window must be double-buffered - BadMatch. */
740	if (DBE_WINDOW_PRIV(pWin) == NULL)	748	if (DBE_WINDOW_PRIV(pWin) == NULL)
741	{	749	{
742	DEALLOCATE_LOCAL(swapInfo);	750	Xfree(swapInfo);
743	return(BadMatch);	751	return(BadMatch);
744	}	752	}
745		753
Lines 748-754 ProcDbeSwapBuffers(ClientPtr client) Link Here
748	{	756	{
749	if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)	757	if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)
750	{	758	{
751	DEALLOCATE_LOCAL(swapInfo);	759	Xfree(swapInfo);
752	return(BadMatch);	760	return(BadMatch);
753	}	761	}
754	}	762	}
Lines 759-765 ProcDbeSwapBuffers(ClientPtr client) Link Here
759	(dbeSwapInfo[i].swapAction != XdbeUntouched ) &&	767	(dbeSwapInfo[i].swapAction != XdbeUntouched ) &&
760	(dbeSwapInfo[i].swapAction != XdbeCopied ))	768	(dbeSwapInfo[i].swapAction != XdbeCopied ))
761	{	769	{
762	DEALLOCATE_LOCAL(swapInfo);	770	Xfree(swapInfo);
763	return(BadValue);	771	return(BadValue);
764	}	772	}
765		773
Lines 789-800 ProcDbeSwapBuffers(ClientPtr client) Link Here
789	error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);	797	error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);
790	if (error != Success)	798	if (error != Success)
791	{	799	{
792	DEALLOCATE_LOCAL(swapInfo);	800	Xfree(swapInfo);
793	return(error);	801	return(error);
794	}	802	}
795	}	803	}
796		804
797	DEALLOCATE_LOCAL(swapInfo);	805	Xfree(swapInfo);
798	return(Success);	806	return(Success);
799		807
800	} /* ProcDbeSwapBuffers() */	808	} /* ProcDbeSwapBuffers() */
Lines 876-885 ProcDbeGetVisualInfo(ClientPtr client) Link Here
876		884
877	REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);	885	REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);
878		886
		887	if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))
		888	return BadAlloc;
879	/* Make sure any specified drawables are valid. */	889	/* Make sure any specified drawables are valid. */
880	if (stuff->n != 0)	890	if (stuff->n != 0)
881	{	891	{
882	if (!(pDrawables = (DrawablePtr )ALLOCATE_LOCAL(stuff->n	892	if (!(pDrawables = (DrawablePtr )Xalloc(stuff->n
883	sizeof(DrawablePtr))))	893	sizeof(DrawablePtr))))
884	{	894	{
885	return(BadAlloc);	895	return(BadAlloc);
Lines 892-898 ProcDbeGetVisualInfo(ClientPtr client) Link Here
892	if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable(	902	if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable(
893	drawables[i], client, SecurityReadAccess)))	903	drawables[i], client, SecurityReadAccess)))
894	{	904	{
895	DEALLOCATE_LOCAL(pDrawables);	905	Xfree(pDrawables);
896	return(BadDrawable);	906	return(BadDrawable);
897	}	907	}
898	}	908	}
Lines 904-910 ProcDbeGetVisualInfo(ClientPtr client) Link Here
904	{	914	{
905	if (pDrawables)	915	if (pDrawables)
906	{	916	{
907	DEALLOCATE_LOCAL(pDrawables);	917	Xfree(pDrawables);
908	}	918	}
909		919
910	return(BadAlloc);	920	return(BadAlloc);
Lines 931-937 ProcDbeGetVisualInfo(ClientPtr client) Link Here
931	/* Free pDrawables if we needed to allocate it above. */	941	/* Free pDrawables if we needed to allocate it above. */
932	if (pDrawables)	942	if (pDrawables)
933	{	943	{
934	DEALLOCATE_LOCAL(pDrawables);	944	Xfree(pDrawables);
935	}	945	}
936		946
937	return(BadAlloc);	947	return(BadAlloc);
Lines 1012-1018 ProcDbeGetVisualInfo(ClientPtr client) Link Here
1012		1022
1013	if (pDrawables)	1023	if (pDrawables)
1014	{	1024	{
1015	DEALLOCATE_LOCAL(pDrawables);	1025	Xfree(pDrawables);
1016	}	1026	}
1017		1027
1018	return(client->noClientException);	1028	return(client->noClientException);

Lines 47-52 Link Here

(-)a/render/render.c (-3 / +12 lines)
47	#include <X11/Xfuncproto.h>	47	#include <X11/Xfuncproto.h>
48	#include "cursorstr.h"	48	#include "cursorstr.h"
49		49
		50	#if HAVE_STDINT_H
		51	#include <stdint.h>
		52	#elif !defined(UINT32_MAX)
		53	#define UINT32_MAX 0xffffffffU
		54	#endif
		55
50	static int ProcRenderQueryVersion (ClientPtr pClient);	56	static int ProcRenderQueryVersion (ClientPtr pClient);
51	static int ProcRenderQueryPictFormats (ClientPtr pClient);	57	static int ProcRenderQueryPictFormats (ClientPtr pClient);
52	static int ProcRenderQueryPictIndexValues (ClientPtr pClient);	58	static int ProcRenderQueryPictIndexValues (ClientPtr pClient);
Lines 1103-1113 ProcRenderAddGlyphs (ClientPtr client) Link Here
1103	}	1109	}
1104		1110
1105	nglyphs = stuff->nglyphs;	1111	nglyphs = stuff->nglyphs;
		1112	if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))
		1113	return BadAlloc;
		1114
1106	if (nglyphs <= NLOCALGLYPH)	1115	if (nglyphs <= NLOCALGLYPH)
1107	glyphsBase = glyphsLocal;	1116	glyphsBase = glyphsLocal;
1108	else	1117	else
1109	{	1118	{
1110	glyphsBase = (GlyphNewPtr) ALLOCATE_LOCAL (nglyphs * sizeof (GlyphNewRec));	1119	glyphsBase = (GlyphNewPtr) Xalloc (nglyphs * sizeof (GlyphNewRec));
1111	if (!glyphsBase)	1120	if (!glyphsBase)
1112	return BadAlloc;	1121	return BadAlloc;
1113	}	1122	}
Lines 1164-1170 ProcRenderAddGlyphs (ClientPtr client) Link Here
1164	}	1173	}
1165		1174
1166	if (glyphsBase != glyphsLocal)	1175	if (glyphsBase != glyphsLocal)
1167	DEALLOCATE_LOCAL (glyphsBase);	1176	Xfree (glyphsBase);
1168	return client->noClientException;	1177	return client->noClientException;
1169	bail:	1178	bail:
1170	while (glyphs != glyphsBase)	1179	while (glyphs != glyphsBase)
Lines 1173-1179 bail: Link Here
1173	xfree (glyphs->glyph);	1182	xfree (glyphs->glyph);
1174	}	1183	}
1175	if (glyphsBase != glyphsLocal)	1184	if (glyphsBase != glyphsLocal)
1176	DEALLOCATE_LOCAL (glyphsBase);	1185	Xfree (glyphsBase);
1177	return err;	1186	return err;
1178	}	1187	}
1179		1188

Return to bug 157421