Attachment #140148 for bug #204362




#include <X11/extensions/XEVIstr.h>
#include "EVIstruct.h"
#include "modinit.h"
#include "scrnintstr.h"

#if 0
static unsigned char XEVIReqCode = 0;

{
    REQUEST(xEVIGetVisualInfoReq);
    xEVIGetVisualInfoReply rep;
    int i, n, n_conflict, n_info, sz_info, sz_conflict;
    VisualID32 *conflict;
    unsigned int total_visuals = 0;
    xExtendedVisualInfo *eviInfo;
    int status;

    /*
     * do this first, otherwise REQUEST_FIXED_SIZE can overflow.  we assume
     * here that you don't have more than 2^32 visuals over all your screens;
     * this seems like a safe assumption.
     */
    for (i = 0; i < screenInfo.numScreens; i++)
	total_visuals += screenInfo.screens[i]->numVisuals;
    if (stuff->n_visual > total_visuals)
	return BadValue;

    REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
    status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
		&eviInfo, &n_info, &conflict, &n_conflict);

Lines 196-201 int ProcGetReservedColormapEntries( Link Here

(-)a/Xext/cup.c (+3 lines)
196		196
197	REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);	197	REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
198		198
		199	if (stuff->screen >= screenInfo.numScreens)
		200	return BadValue;
		201
199	#ifndef HAVE_SPECIAL_DESKTOP_COLORS	202	#ifndef HAVE_SPECIAL_DESKTOP_COLORS
200	citems[CUP_BLACK_PIXEL].pixel =	203	citems[CUP_BLACK_PIXEL].pixel =
201	screenInfo.screens[stuff->screen]->blackPixel;	204	screenInfo.screens[stuff->screen]->blackPixel;

Lines 34-39 THE USE OR PERFORMANCE OF THIS SOFTWARE. Link Here

(-)a/Xext/sampleEVI.c (-5 / +24 lines)
34	#include <X11/extensions/XEVIstr.h>	34	#include <X11/extensions/XEVIstr.h>
35	#include "EVIstruct.h"	35	#include "EVIstruct.h"
36	#include "scrnintstr.h"	36	#include "scrnintstr.h"
		37
		38	#if HAVE_STDINT_H
		39	#include <stdint.h>
		40	#elif !defined(INT_MAX)
		41	#define INT_MAX 0x7fffffff
		42	#endif
		43
37	static int sampleGetVisualInfo(	44	static int sampleGetVisualInfo(
38	VisualID32 *visual,	45	VisualID32 *visual,
39	int n_visual,	46	int n_visual,
Lines 42-65 static int sampleGetVisualInfo( Link Here
42	VisualID32 **conflict_rn,	49	VisualID32 **conflict_rn,
43	int *n_conflict_rn)	50	int *n_conflict_rn)
44	{	51	{
45	int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;	52	unsigned int max_sz_evi;
46	VisualID32 *temp_conflict;	53	VisualID32 *temp_conflict;
47	xExtendedVisualInfo *evi;	54	xExtendedVisualInfo *evi;
48	int max_visuals = 0, max_sz_conflict, sz_conflict = 0;	55	unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
49	register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;	56	register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
50	evi_rn = evi = (xExtendedVisualInfo )xalloc(max_sz_evi);	57
51	if (!*evi_rn)	58	if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
52	return BadAlloc;	59	return BadAlloc;
		60	max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
		61
53	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {	62	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
54	if (screenInfo.screens[scrI]->numVisuals > max_visuals)	63	if (screenInfo.screens[scrI]->numVisuals > max_visuals)
55	max_visuals = screenInfo.screens[scrI]->numVisuals;	64	max_visuals = screenInfo.screens[scrI]->numVisuals;
56	}	65	}
		66
		67	if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens
		68	* max_visuals))
		69	return BadAlloc;
57	max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;	70	max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
		71
		72	evi_rn = evi = (xExtendedVisualInfo )xalloc(max_sz_evi);
		73	if (!*evi_rn)
		74	return BadAlloc;
		75
58	temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);	76	temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
59	if (!temp_conflict) {	77	if (!temp_conflict) {
60	xfree(*evi_rn);	78	xfree(*evi_rn);
61	return BadAlloc;	79	return BadAlloc;
62	}	80	}
		81
63	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {	82	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
64	for (visualI = 0; visualI < n_visual; visualI++) {	83	for (visualI = 0; visualI < n_visual; visualI++) {
65	evi[sz_evi].core_visual_id = visual[visualI];	84	evi[sz_evi].core_visual_id = visual[visualI];

Lines 1563-1569 SecurityLoadPropertyAccessList(void) Link Here

(-)a/Xext/security.c (-2 / +2 lines)
1563	if (!SecurityPolicyFile)	1563	if (!SecurityPolicyFile)
1564	return;	1564	return;
1565		1565
1566	f = fopen(SecurityPolicyFile, "r");	1566	f = Fopen(SecurityPolicyFile, "r");
1567	if (!f)	1567	if (!f)
1568	{	1568	{
1569	ErrorF("error opening security policy file %s\n",	1569	ErrorF("error opening security policy file %s\n",
Lines 1646-1652 SecurityLoadPropertyAccessList(void) Link Here
1646	}	1646	}
1647	#endif /* PROPDEBUG */	1647	#endif /* PROPDEBUG */
1648		1648
1649	fclose(f);	1649	Fclose(f);
1650	} /* SecurityLoadPropertyAccessList */	1650	} /* SecurityLoadPropertyAccessList */
1651		1651
1652		1652

Lines 711-716 ProcPanoramiXShmCreatePixmap( Link Here

(-)a/Xext/shm.c (-8 / +38 lines)
711	int i, j, result, rc;	711	int i, j, result, rc;
712	ShmDescPtr shmdesc;	712	ShmDescPtr shmdesc;
713	REQUEST(xShmCreatePixmapReq);	713	REQUEST(xShmCreatePixmapReq);
		714	unsigned int width, height, depth;
		715	unsigned long size;
714	PanoramiXRes *newPix;	716	PanoramiXRes *newPix;
715		717
716	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);	718	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
Lines 724-734 ProcPanoramiXShmCreatePixmap( Link Here
724	return rc;	726	return rc;
725		727
726	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);	728	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
727	if (!stuff->width \|\| !stuff->height)	729
		730	width = stuff->width;
		731	height = stuff->height;
		732	depth = stuff->depth;
		733	if (!width \|\| !height \|\| !depth)
728	{	734	{
729	client->errorValue = 0;	735	client->errorValue = 0;
730	return BadValue;	736	return BadValue;
731	}	737	}
		738	if (width > 32767 \|\| height > 32767)
		739	return BadAlloc;
		740	size = PixmapBytePad(width, depth) * height;
		741	if (sizeof(size) == 4) {
		742	if (size < width * height)
		743	return BadAlloc;
		744	/* thankfully, offset is unsigned */
		745	if (stuff->offset + size < size)
		746	return BadAlloc;
		747	}
		748
732	if (stuff->depth != 1)	749	if (stuff->depth != 1)
733	{	750	{
734	pDepth = pDraw->pScreen->allowedDepths;	751	pDepth = pDraw->pScreen->allowedDepths;
Lines 739-747 ProcPanoramiXShmCreatePixmap( Link Here
739	return BadValue;	756	return BadValue;
740	}	757	}
741	CreatePmap:	758	CreatePmap:
742	VERIFY_SHMSIZE(shmdesc, stuff->offset,	759	VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
743	PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
744	client);
745		760
746	if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))	761	if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
747	return BadAlloc;	762	return BadAlloc;
Lines 1040-1045 ProcShmCreatePixmap(client) Link Here
1040	register int i, rc;	1055	register int i, rc;
1041	ShmDescPtr shmdesc;	1056	ShmDescPtr shmdesc;
1042	REQUEST(xShmCreatePixmapReq);	1057	REQUEST(xShmCreatePixmapReq);
		1058	unsigned int width, height, depth;
		1059	unsigned long size;
1043		1060
1044	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);	1061	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
1045	client->errorValue = stuff->pid;	1062	client->errorValue = stuff->pid;
Lines 1052-1062 ProcShmCreatePixmap(client) Link Here
1052	return rc;	1069	return rc;
1053		1070
1054	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);	1071	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
1055	if (!stuff->width \|\| !stuff->height)	1072
		1073	width = stuff->width;
		1074	height = stuff->height;
		1075	depth = stuff->depth;
		1076	if (!width \|\| !height \|\| !depth)
1056	{	1077	{
1057	client->errorValue = 0;	1078	client->errorValue = 0;
1058	return BadValue;	1079	return BadValue;
1059	}	1080	}
		1081	if (width > 32767 \|\| height > 32767)
		1082	return BadAlloc;
		1083	size = PixmapBytePad(width, depth) * height;
		1084	if (sizeof(size) == 4) {
		1085	if (size < width * height)
		1086	return BadAlloc;
		1087	/* thankfully, offset is unsigned */
		1088	if (stuff->offset + size < size)
		1089	return BadAlloc;
		1090	}
		1091
1060	if (stuff->depth != 1)	1092	if (stuff->depth != 1)
1061	{	1093	{
1062	pDepth = pDraw->pScreen->allowedDepths;	1094	pDepth = pDraw->pScreen->allowedDepths;
Lines 1067-1075 ProcShmCreatePixmap(client) Link Here
1067	return BadValue;	1099	return BadValue;
1068	}	1100	}
1069	CreatePmap:	1101	CreatePmap:
1070	VERIFY_SHMSIZE(shmdesc, stuff->offset,	1102	VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
1071	PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
1072	client);
1073	pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(	1103	pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
1074	pDraw->pScreen, stuff->width,	1104	pDraw->pScreen, stuff->width,
1075	stuff->height, stuff->depth,	1105	stuff->height, stuff->depth,




		     xStringFeedbackCtl * f)
{
    char n;
    long *p;
    int i, j;
    KeySym *syms, *sup_syms;

    syms = (KeySym *) (f + 1);
    if (client->swapped) {
	swaps(&f->length, n);	/* swapped num_keysyms in calling proc */
	SwapLongs((CARD32 *) syms, f->num_keysyms);
	for (i = 0; i < f->num_keysyms; i++) {
	    swapl(p, n);
	    p++;
	}
    }

    if (f->num_keysyms > s->ctrl.max_symbols) {




SProcXChangeDeviceKeyMapping(ClientPtr client)
{
    char n;
    unsigned int count;
    int i, count;

    REQUEST(xChangeDeviceKeyMappingReq);
    swaps(&stuff->length, n);
    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
    p = (long *)&stuff[1];
    count = stuff->keyCodes * stuff->keySymsPerKeyCode;
    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), count);
	p++;
    }
    return (ProcXChangeDeviceKeyMapping(client));
}


    int ret;
    unsigned len;
    DeviceIntPtr dev;
    unsigned int count;

    REQUEST(xChangeDeviceKeyMappingReq);
    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

    count = stuff->keyCodes * stuff->keySymsPerKeyCode;
    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));

    dev = LookupDeviceIntRec(stuff->deviceid);
    if (dev == NULL) {
	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,




SProcXChangeDeviceDontPropagateList(ClientPtr client)
{
    char n;
    long *p;
    int i;

    REQUEST(xChangeDeviceDontPropagateListReq);
    swaps(&stuff->length, n);
    REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
    swapl(&stuff->window, n);
    swaps(&stuff->count, n);
    REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
                      stuff->count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
	p++;
    }
    return (ProcXChangeDeviceDontPropagateList(client));
}





SProcXGrabDevice(ClientPtr client)
{
    char n;
    long *p;
    int i;

    REQUEST(xGrabDeviceReq);
    swaps(&stuff->length, n);

    swapl(&stuff->grabWindow, n);
    swapl(&stuff->time, n);
    swaps(&stuff->event_count, n);

    if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
       return BadLength;
    
    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);

    return (ProcXGrabDevice(client));
}




SProcXGrabDeviceButton(ClientPtr client)
{
    char n;
    long *p;
    int i;

    REQUEST(xGrabDeviceButtonReq);
    swaps(&stuff->length, n);

    swapl(&stuff->grabWindow, n);
    swaps(&stuff->modifiers, n);
    swaps(&stuff->event_count, n);
    REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
                      stuff->event_count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
	p++;
    }

    return (ProcXGrabDeviceButton(client));
}




SProcXGrabDeviceKey(ClientPtr client)
{
    char n;
    long *p;
    int i;

    REQUEST(xGrabDeviceKeyReq);
    swaps(&stuff->length, n);

    swapl(&stuff->grabWindow, n);
    swaps(&stuff->modifiers, n);
    swaps(&stuff->event_count, n);
    REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
	swapl(p, n);
	p++;
    }
    return (ProcXGrabDeviceKey(client));
}





SProcXSelectExtensionEvent(ClientPtr client)
{
    char n;
    long *p;
    int i;

    REQUEST(xSelectExtensionEventReq);
    swaps(&stuff->length, n);
    REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
    swapl(&stuff->window, n);
    swaps(&stuff->count, n);
    REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
                      stuff->count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);

    }
    return (ProcXSelectExtensionEvent(client));
}


Lines 83-89 int Link Here

(-)a/Xi/sendexev.c (-6 / +8 lines)
83	SProcXSendExtensionEvent(ClientPtr client)	83	SProcXSendExtensionEvent(ClientPtr client)
84	{	84	{
85	char n;	85	char n;
86	long *p;	86	CARD32 *p;
87	int i;	87	int i;
88	xEvent eventT;	88	xEvent eventT;
89	xEvent *eventP;	89	xEvent *eventP;
Lines 94-99 SProcXSendExtensionEvent(ClientPtr client) Link Here
94	REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);	94	REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
95	swapl(&stuff->destination, n);	95	swapl(&stuff->destination, n);
96	swaps(&stuff->count, n);	96	swaps(&stuff->count, n);
		97
		98	if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
		99	(stuff->num_events * (sizeof(xEvent) >> 2)))
		100	return BadLength;
		101
97	eventP = (xEvent *) & stuff[1];	102	eventP = (xEvent *) & stuff[1];
98	for (i = 0; i < stuff->num_events; i++, eventP++) {	103	for (i = 0; i < stuff->num_events; i++, eventP++) {
99	proc = EventSwapVector[eventP->u.u.type & 0177];	104	proc = EventSwapVector[eventP->u.u.type & 0177];
Lines 103-113 SProcXSendExtensionEvent(ClientPtr client) Link Here
103	*eventP = eventT;	108	*eventP = eventT;
104	}	109	}
105		110
106	p = (long )(((xEvent ) & stuff[1]) + stuff->num_events);	111	p = (CARD32 )(((xEvent ) & stuff[1]) + stuff->num_events);
107	for (i = 0; i < stuff->count; i++) {	112	SwapLongs(p, stuff->count);
108	swapl(p, n);
109	p++;
110	}
111	return (ProcXSendExtensionEvent(client));	113	return (ProcXSendExtensionEvent(client));
112	}	114	}
113		115

Lines 325-330 doOpenFont(ClientPtr client, OFclosurePtr c) Link Here

(-)a/dix/dixfonts.c (+7 lines)
325	err = BadFontName;	325	err = BadFontName;
326	goto bail;	326	goto bail;
327	}	327	}
		328	/* check values for firstCol, lastCol, firstRow, and lastRow */
		329	if (pfont->info.firstCol > pfont->info.lastCol \|\|
		330	pfont->info.firstRow > pfont->info.lastRow \|\|
		331	pfont->info.lastCol - pfont->info.firstCol > 255) {
		332	err = AllocError;
		333	goto bail;
		334	}
328	if (!pfont->fpe)	335	if (!pfont->fpe)
329	pfont->fpe = fpe;	336	pfont->fpe = fpe;
330	pfont->refcnt++;	337	pfont->refcnt++;

Lines 568-573 MiscExtPassMessage(int scrnIndex, const char msgtype, const char msgval, Link Here

(-)a/hw/xfree86/common/xf86MiscExt.c (+4 lines)
568		568
569	DEBUG_P("MiscExtPassMessage");	569	DEBUG_P("MiscExtPassMessage");
570		570
		571	/* should check this in the protocol, but xf86NumScreens isn't exported */
		572	if (scrnIndex >= xf86NumScreens)
		573	return BadValue;
		574
571	if (*pScr->HandleMessage == NULL)	575	if (*pScr->HandleMessage == NULL)
572	return BadImplementation;	576	return BadImplementation;
573	return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);	577	return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);

Return to bug 204362

Lines 131-149 int Link Here

(-)a/Xi/selectev.c (-7 / +4 lines)
131	SProcXSelectExtensionEvent(ClientPtr client)	131	SProcXSelectExtensionEvent(ClientPtr client)
132	{	132	{
133	char n;	133	char n;
134	long *p;
135	int i;
136		134
137	REQUEST(xSelectExtensionEventReq);	135	REQUEST(xSelectExtensionEventReq);
138	swaps(&stuff->length, n);	136	swaps(&stuff->length, n);
139	REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);	137	REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
140	swapl(&stuff->window, n);	138	swapl(&stuff->window, n);
141	swaps(&stuff->count, n);	139	swaps(&stuff->count, n);
142	p = (long *)&stuff[1];	140	REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
143	for (i = 0; i < stuff->count; i++) {	141	stuff->count * sizeof(CARD32));
144	swapl(p, n);	142	SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
145	p++;	143
146	}
147	return (ProcXSelectExtensionEvent(client));	144	return (ProcXSelectExtensionEvent(client));
148	}	145	}
149		146

Lines 34-39 THE USE OR PERFORMANCE OF THIS SOFTWARE. Link Here

(-)a/Xext/EVI.c (-1 / +14 lines)
34	#include <X11/extensions/XEVIstr.h>	34	#include <X11/extensions/XEVIstr.h>
35	#include "EVIstruct.h"	35	#include "EVIstruct.h"
36	#include "modinit.h"	36	#include "modinit.h"
		37	#include "scrnintstr.h"
37		38
38	#if 0	39	#if 0
39	static unsigned char XEVIReqCode = 0;	40	static unsigned char XEVIReqCode = 0;
Lines 87-96 ProcEVIGetVisualInfo(ClientPtr client) Link Here
87	{	88	{
88	REQUEST(xEVIGetVisualInfoReq);	89	REQUEST(xEVIGetVisualInfoReq);
89	xEVIGetVisualInfoReply rep;	90	xEVIGetVisualInfoReply rep;
90	int n, n_conflict, n_info, sz_info, sz_conflict;	91	int i, n, n_conflict, n_info, sz_info, sz_conflict;
91	VisualID32 *conflict;	92	VisualID32 *conflict;
		93	unsigned int total_visuals = 0;
92	xExtendedVisualInfo *eviInfo;	94	xExtendedVisualInfo *eviInfo;
93	int status;	95	int status;
		96
		97	/*
		98	* do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume
		99	* here that you don't have more than 2^32 visuals over all your screens;
		100	* this seems like a safe assumption.
		101	*/
		102	for (i = 0; i < screenInfo.numScreens; i++)
		103	total_visuals += screenInfo.screens[i]->numVisuals;
		104	if (stuff->n_visual > total_visuals)
		105	return BadValue;
		106
94	REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);	107	REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
95	status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,	108	status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
96	&eviInfo, &n_info, &conflict, &n_conflict);	109	&eviInfo, &n_info, &conflict, &n_conflict);

Lines 327-344 ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev, Link Here

(-)a/Xi/chgfctl.c (-6 / +1 lines)
327	xStringFeedbackCtl * f)	327	xStringFeedbackCtl * f)
328	{	328	{
329	char n;	329	char n;
330	long *p;
331	int i, j;	330	int i, j;
332	KeySym syms, sup_syms;	331	KeySym syms, sup_syms;
333		332
334	syms = (KeySym *) (f + 1);	333	syms = (KeySym *) (f + 1);
335	if (client->swapped) {	334	if (client->swapped) {
336	swaps(&f->length, n); /* swapped num_keysyms in calling proc */	335	swaps(&f->length, n); /* swapped num_keysyms in calling proc */
337	p = (long *)(syms);	336	SwapLongs((CARD32 *) syms, f->num_keysyms);
338	for (i = 0; i < f->num_keysyms; i++) {
339	swapl(p, n);
340	p++;
341	}
342	}	337	}
343		338
344	if (f->num_keysyms > s->ctrl.max_symbols) {	339	if (f->num_keysyms > s->ctrl.max_symbols) {

Lines 79-96 int Link Here

(-)a/Xi/chgkmap.c (-7 / +7 lines)
79	SProcXChangeDeviceKeyMapping(ClientPtr client)	79	SProcXChangeDeviceKeyMapping(ClientPtr client)
80	{	80	{
81	char n;	81	char n;
82	long *p;	82	unsigned int count;
83	int i, count;
84		83
85	REQUEST(xChangeDeviceKeyMappingReq);	84	REQUEST(xChangeDeviceKeyMappingReq);
86	swaps(&stuff->length, n);	85	swaps(&stuff->length, n);
87	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);	86	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
88	p = (long *)&stuff[1];
89	count = stuff->keyCodes * stuff->keySymsPerKeyCode;	87	count = stuff->keyCodes * stuff->keySymsPerKeyCode;
90	for (i = 0; i < count; i++) {	88	REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
91	swapl(p, n);	89	SwapLongs((CARD32 *) (&stuff[1]), count);
92	p++;
93	}
94	return (ProcXChangeDeviceKeyMapping(client));	90	return (ProcXChangeDeviceKeyMapping(client));
95	}	91	}
96		92
Lines 106-115 ProcXChangeDeviceKeyMapping(ClientPtr client) Link Here
106	int ret;	102	int ret;
107	unsigned len;	103	unsigned len;
108	DeviceIntPtr dev;	104	DeviceIntPtr dev;
		105	unsigned int count;
109		106
110	REQUEST(xChangeDeviceKeyMappingReq);	107	REQUEST(xChangeDeviceKeyMappingReq);
111	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);	108	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
112		109
		110	count = stuff->keyCodes * stuff->keySymsPerKeyCode;
		111	REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
		112
113	dev = LookupDeviceIntRec(stuff->deviceid);	113	dev = LookupDeviceIntRec(stuff->deviceid);
114	if (dev == NULL) {	114	if (dev == NULL) {
115	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,	115	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,

Lines 81-99 int Link Here

(-)a/Xi/chgprop.c (-7 / +3 lines)
81	SProcXChangeDeviceDontPropagateList(ClientPtr client)	81	SProcXChangeDeviceDontPropagateList(ClientPtr client)
82	{	82	{
83	char n;	83	char n;
84	long *p;
85	int i;
86		84
87	REQUEST(xChangeDeviceDontPropagateListReq);	85	REQUEST(xChangeDeviceDontPropagateListReq);
88	swaps(&stuff->length, n);	86	swaps(&stuff->length, n);
89	REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);	87	REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
90	swapl(&stuff->window, n);	88	swapl(&stuff->window, n);
91	swaps(&stuff->count, n);	89	swaps(&stuff->count, n);
92	p = (long *)&stuff[1];	90	REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
93	for (i = 0; i < stuff->count; i++) {	91	stuff->count * sizeof(CARD32));
94	swapl(p, n);	92	SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
95	p++;
96	}
97	return (ProcXChangeDeviceDontPropagateList(client));	93	return (ProcXChangeDeviceDontPropagateList(client));
98	}	94	}
99		95

Lines 82-89 int Link Here

(-)a/Xi/grabdev.c (-7 / +5 lines)
82	SProcXGrabDevice(ClientPtr client)	82	SProcXGrabDevice(ClientPtr client)
83	{	83	{
84	char n;	84	char n;
85	long *p;
86	int i;
87		85
88	REQUEST(xGrabDeviceReq);	86	REQUEST(xGrabDeviceReq);
89	swaps(&stuff->length, n);	87	swaps(&stuff->length, n);
Lines 91-101 SProcXGrabDevice(ClientPtr client) Link Here
91	swapl(&stuff->grabWindow, n);	89	swapl(&stuff->grabWindow, n);
92	swapl(&stuff->time, n);	90	swapl(&stuff->time, n);
93	swaps(&stuff->event_count, n);	91	swaps(&stuff->event_count, n);
94	p = (long *)&stuff[1];	92
95	for (i = 0; i < stuff->event_count; i++) {	93	if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
96	swapl(p, n);	94	return BadLength;
97	p++;	95
98	}	96	SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
99		97
100	return (ProcXGrabDevice(client));	98	return (ProcXGrabDevice(client));
101	}	99	}

Lines 80-87 int Link Here

(-)a/Xi/grabdevb.c (-7 / +3 lines)
80	SProcXGrabDeviceButton(ClientPtr client)	80	SProcXGrabDeviceButton(ClientPtr client)
81	{	81	{
82	char n;	82	char n;
83	long *p;
84	int i;
85		83
86	REQUEST(xGrabDeviceButtonReq);	84	REQUEST(xGrabDeviceButtonReq);
87	swaps(&stuff->length, n);	85	swaps(&stuff->length, n);
Lines 89-99 SProcXGrabDeviceButton(ClientPtr client) Link Here
89	swapl(&stuff->grabWindow, n);	87	swapl(&stuff->grabWindow, n);
90	swaps(&stuff->modifiers, n);	88	swaps(&stuff->modifiers, n);
91	swaps(&stuff->event_count, n);	89	swaps(&stuff->event_count, n);
92	p = (long *)&stuff[1];	90	REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
93	for (i = 0; i < stuff->event_count; i++) {	91	stuff->event_count * sizeof(CARD32));
94	swapl(p, n);	92	SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
95	p++;
96	}
97		93
98	return (ProcXGrabDeviceButton(client));	94	return (ProcXGrabDeviceButton(client));
99	}	95	}

Lines 80-87 int Link Here

(-)a/Xi/grabdevk.c (-7 / +2 lines)
80	SProcXGrabDeviceKey(ClientPtr client)	80	SProcXGrabDeviceKey(ClientPtr client)
81	{	81	{
82	char n;	82	char n;
83	long *p;
84	int i;
85		83
86	REQUEST(xGrabDeviceKeyReq);	84	REQUEST(xGrabDeviceKeyReq);
87	swaps(&stuff->length, n);	85	swaps(&stuff->length, n);
Lines 89-99 SProcXGrabDeviceKey(ClientPtr client) Link Here
89	swapl(&stuff->grabWindow, n);	87	swapl(&stuff->grabWindow, n);
90	swaps(&stuff->modifiers, n);	88	swaps(&stuff->modifiers, n);
91	swaps(&stuff->event_count, n);	89	swaps(&stuff->event_count, n);
92	p = (long *)&stuff[1];	90	REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
93	for (i = 0; i < stuff->event_count; i++) {	91	SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
94	swapl(p, n);
95	p++;
96	}
97	return (ProcXGrabDeviceKey(client));	92	return (ProcXGrabDeviceKey(client));
98	}	93	}
99		94