Attachment #140149 for bug #204362




#include <X11/extensions/XEVIstr.h>
#include "EVIstruct.h"
#include "modinit.h"
#include "scrnintstr.h"

#if 0
static unsigned char XEVIReqCode = 0;

{
    REQUEST(xEVIGetVisualInfoReq);
    xEVIGetVisualInfoReply rep;
    int i, n, n_conflict, n_info, sz_info, sz_conflict;
    VisualID32 *conflict;
    unsigned int total_visuals = 0;
    xExtendedVisualInfo *eviInfo;
    int status;

    /*
     * do this first, otherwise REQUEST_FIXED_SIZE can overflow.  we assume
     * here that you don't have more than 2^32 visuals over all your screens;
     * this seems like a safe assumption.
     */
    for (i = 0; i < screenInfo.numScreens; i++)
	total_visuals += screenInfo.screens[i]->numVisuals;
    if (stuff->n_visual > total_visuals)
	return BadValue;

    REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
    status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
		&eviInfo, &n_info, &conflict, &n_conflict);

Lines 196-201 int ProcGetReservedColormapEntries( Link Here

(-)xorg-server-1.3.0.0/Xext/cup.c (+3 lines)
196		196
197	REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);	197	REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
198		198
		199	if (stuff->screen >= screenInfo.numScreens)
		200	return BadValue;
		201
199	#ifndef HAVE_SPECIAL_DESKTOP_COLORS	202	#ifndef HAVE_SPECIAL_DESKTOP_COLORS
200	citems[CUP_BLACK_PIXEL].pixel =	203	citems[CUP_BLACK_PIXEL].pixel =
201	screenInfo.screens[stuff->screen]->blackPixel;	204	screenInfo.screens[stuff->screen]->blackPixel;

Lines 35-40 THE USE OR PERFORMANCE OF THIS SOFTWARE. Link Here

(-)xorg-server-1.3.0.0/Xext/sampleEVI.c (-5 / +24 lines)
35	#include <X11/extensions/XEVIstr.h>	35	#include <X11/extensions/XEVIstr.h>
36	#include "EVIstruct.h"	36	#include "EVIstruct.h"
37	#include "scrnintstr.h"	37	#include "scrnintstr.h"
		38
		39	#if HAVE_STDINT_H
		40	#include <stdint.h>
		41	#elif !defined(INT_MAX)
		42	#define INT_MAX 0x7fffffff
		43	#endif
		44
38	static int sampleGetVisualInfo(	45	static int sampleGetVisualInfo(
39	VisualID32 *visual,	46	VisualID32 *visual,
40	int n_visual,	47	int n_visual,
Lines 43-66 static int sampleGetVisualInfo( Link Here
43	VisualID32 **conflict_rn,	50	VisualID32 **conflict_rn,
44	int *n_conflict_rn)	51	int *n_conflict_rn)
45	{	52	{
46	int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;	53	unsigned int max_sz_evi;
47	VisualID32 *temp_conflict;	54	VisualID32 *temp_conflict;
48	xExtendedVisualInfo *evi;	55	xExtendedVisualInfo *evi;
49	int max_visuals = 0, max_sz_conflict, sz_conflict = 0;	56	unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
50	register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;	57	register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
51	evi_rn = evi = (xExtendedVisualInfo )xalloc(max_sz_evi);	58
52	if (!*evi_rn)	59	if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
53	return BadAlloc;	60	return BadAlloc;
		61	max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
		62
54	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {	63	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
55	if (screenInfo.screens[scrI]->numVisuals > max_visuals)	64	if (screenInfo.screens[scrI]->numVisuals > max_visuals)
56	max_visuals = screenInfo.screens[scrI]->numVisuals;	65	max_visuals = screenInfo.screens[scrI]->numVisuals;
57	}	66	}
		67
		68	if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens
		69	* max_visuals))
		70	return BadAlloc;
58	max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;	71	max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
		72
		73	evi_rn = evi = (xExtendedVisualInfo )xalloc(max_sz_evi);
		74	if (!*evi_rn)
		75	return BadAlloc;
		76
59	temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);	77	temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
60	if (!temp_conflict) {	78	if (!temp_conflict) {
61	xfree(*evi_rn);	79	xfree(*evi_rn);
62	return BadAlloc;	80	return BadAlloc;
63	}	81	}
		82
64	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {	83	for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
65	for (visualI = 0; visualI < n_visual; visualI++) {	84	for (visualI = 0; visualI < n_visual; visualI++) {
66	evi[sz_evi].core_visual_id = visual[visualI];	85	evi[sz_evi].core_visual_id = visual[visualI];

Lines 1567-1573 SecurityLoadPropertyAccessList(void) Link Here

(-)xorg-server-1.3.0.0/Xext/security.c (-2 / +2 lines)
1567	return;	1567	return;
1568		1568
1569	#ifndef __UNIXOS2__	1569	#ifndef __UNIXOS2__
1570	f = fopen(SecurityPolicyFile, "r");	1570	f = Fopen(SecurityPolicyFile, "r");
1571	#else	1571	#else
1572	f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");	1572	f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r");
1573	#endif	1573	#endif
Lines 1653-1659 SecurityLoadPropertyAccessList(void) Link Here
1653	}	1653	}
1654	#endif /* PROPDEBUG */	1654	#endif /* PROPDEBUG */
1655		1655
1656	fclose(f);	1656	Fclose(f);
1657	} /* SecurityLoadPropertyAccessList */	1657	} /* SecurityLoadPropertyAccessList */
1658		1658
1659		1659

Lines 723-728 ProcPanoramiXShmCreatePixmap( Link Here

(-)xorg-server-1.3.0.0/Xext/shm.c (-8 / +38 lines)
723	int i, j, result;	723	int i, j, result;
724	ShmDescPtr shmdesc;	724	ShmDescPtr shmdesc;
725	REQUEST(xShmCreatePixmapReq);	725	REQUEST(xShmCreatePixmapReq);
		726	unsigned int width, height, depth;
		727	unsigned long size;
726	PanoramiXRes *newPix;	728	PanoramiXRes *newPix;
727		729
728	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);	730	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
Lines 732-742 ProcPanoramiXShmCreatePixmap( Link Here
732	LEGAL_NEW_RESOURCE(stuff->pid, client);	734	LEGAL_NEW_RESOURCE(stuff->pid, client);
733	VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);	735	VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
734	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);	736	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
735	if (!stuff->width \|\| !stuff->height)	737
		738	width = stuff->width;
		739	height = stuff->height;
		740	depth = stuff->depth;
		741	if (!width \|\| !height \|\| !depth)
736	{	742	{
737	client->errorValue = 0;	743	client->errorValue = 0;
738	return BadValue;	744	return BadValue;
739	}	745	}
		746	if (width > 32767 \|\| height > 32767)
		747	return BadAlloc;
		748	size = PixmapBytePad(width, depth) * height;
		749	if (sizeof(size) == 4) {
		750	if (size < width * height)
		751	return BadAlloc;
		752	/* thankfully, offset is unsigned */
		753	if (stuff->offset + size < size)
		754	return BadAlloc;
		755	}
		756
740	if (stuff->depth != 1)	757	if (stuff->depth != 1)
741	{	758	{
742	pDepth = pDraw->pScreen->allowedDepths;	759	pDepth = pDraw->pScreen->allowedDepths;
Lines 747-755 ProcPanoramiXShmCreatePixmap( Link Here
747	return BadValue;	764	return BadValue;
748	}	765	}
749	CreatePmap:	766	CreatePmap:
750	VERIFY_SHMSIZE(shmdesc, stuff->offset,	767	VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
751	PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
752	client);
753		768
754	if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))	769	if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
755	return BadAlloc;	770	return BadAlloc;
Lines 1047-1052 ProcShmCreatePixmap(client) Link Here
1047	register int i;	1062	register int i;
1048	ShmDescPtr shmdesc;	1063	ShmDescPtr shmdesc;
1049	REQUEST(xShmCreatePixmapReq);	1064	REQUEST(xShmCreatePixmapReq);
		1065	unsigned int width, height, depth;
		1066	unsigned long size;
1050		1067
1051	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);	1068	REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
1052	client->errorValue = stuff->pid;	1069	client->errorValue = stuff->pid;
Lines 1055-1065 ProcShmCreatePixmap(client) Link Here
1055	LEGAL_NEW_RESOURCE(stuff->pid, client);	1072	LEGAL_NEW_RESOURCE(stuff->pid, client);
1056	VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);	1073	VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);
1057	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);	1074	VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
1058	if (!stuff->width \|\| !stuff->height)	1075
		1076	width = stuff->width;
		1077	height = stuff->height;
		1078	depth = stuff->depth;
		1079	if (!width \|\| !height \|\| !depth)
1059	{	1080	{
1060	client->errorValue = 0;	1081	client->errorValue = 0;
1061	return BadValue;	1082	return BadValue;
1062	}	1083	}
		1084	if (width > 32767 \|\| height > 32767)
		1085	return BadAlloc;
		1086	size = PixmapBytePad(width, depth) * height;
		1087	if (sizeof(size) == 4) {
		1088	if (size < width * height)
		1089	return BadAlloc;
		1090	/* thankfully, offset is unsigned */
		1091	if (stuff->offset + size < size)
		1092	return BadAlloc;
		1093	}
		1094
1063	if (stuff->depth != 1)	1095	if (stuff->depth != 1)
1064	{	1096	{
1065	pDepth = pDraw->pScreen->allowedDepths;	1097	pDepth = pDraw->pScreen->allowedDepths;
Lines 1070-1078 ProcShmCreatePixmap(client) Link Here
1070	return BadValue;	1102	return BadValue;
1071	}	1103	}
1072	CreatePmap:	1104	CreatePmap:
1073	VERIFY_SHMSIZE(shmdesc, stuff->offset,	1105	VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
1074	PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
1075	client);
1076	pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(	1106	pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
1077	pDraw->pScreen, stuff->width,	1107	pDraw->pScreen, stuff->width,
1078	stuff->height, stuff->depth,	1108	stuff->height, stuff->depth,




		     xStringFeedbackCtl * f)
{
    register char n;
    register long *p;
    int i, j;
    KeySym *syms, *sup_syms;

    syms = (KeySym *) (f + 1);
    if (client->swapped) {
	swaps(&f->length, n);	/* swapped num_keysyms in calling proc */
	SwapLongs((CARD32 *) syms, f->num_keysyms);
	for (i = 0; i < f->num_keysyms; i++) {
	    swapl(p, n);
	    p++;
	}
    }

    if (f->num_keysyms > s->ctrl.max_symbols) {




SProcXChangeDeviceKeyMapping(register ClientPtr client)
{
    register char n;
    register unsigned int count;
    register int i, count;

    REQUEST(xChangeDeviceKeyMappingReq);
    swaps(&stuff->length, n);
    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
    p = (long *)&stuff[1];
    count = stuff->keyCodes * stuff->keySymsPerKeyCode;
    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), count);
	p++;
    }
    return (ProcXChangeDeviceKeyMapping(client));
}


    int ret;
    unsigned len;
    DeviceIntPtr dev;
    unsigned int count;

    REQUEST(xChangeDeviceKeyMappingReq);
    REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

    count = stuff->keyCodes * stuff->keySymsPerKeyCode;
    REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));

    dev = LookupDeviceIntRec(stuff->deviceid);
    if (dev == NULL) {
	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,




SProcXChangeDeviceDontPropagateList(register ClientPtr client)
{
    register char n;
    register long *p;
    register int i;

    REQUEST(xChangeDeviceDontPropagateListReq);
    swaps(&stuff->length, n);
    REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
    swapl(&stuff->window, n);
    swaps(&stuff->count, n);
    REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
                      stuff->count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
	p++;
    }
    return (ProcXChangeDeviceDontPropagateList(client));
}





SProcXGrabDevice(register ClientPtr client)
{
    register char n;
    register long *p;
    register int i;

    REQUEST(xGrabDeviceReq);
    swaps(&stuff->length, n);

    swapl(&stuff->grabWindow, n);
    swapl(&stuff->time, n);
    swaps(&stuff->event_count, n);

    if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
       return BadLength;
    
    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);

    return (ProcXGrabDevice(client));
}




SProcXGrabDeviceButton(register ClientPtr client)
{
    register char n;
    register long *p;
    register int i;

    REQUEST(xGrabDeviceButtonReq);
    swaps(&stuff->length, n);

    swapl(&stuff->grabWindow, n);
    swaps(&stuff->modifiers, n);
    swaps(&stuff->event_count, n);
    REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
                      stuff->event_count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
	p++;
    }

    return (ProcXGrabDeviceButton(client));
}




SProcXGrabDeviceKey(register ClientPtr client)
{
    register char n;
    register long *p;
    register int i;

    REQUEST(xGrabDeviceKeyReq);
    swaps(&stuff->length, n);

    swapl(&stuff->grabWindow, n);
    swaps(&stuff->modifiers, n);
    swaps(&stuff->event_count, n);
    REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
	swapl(p, n);
	p++;
    }
    return (ProcXGrabDeviceKey(client));
}





SProcXSelectExtensionEvent(register ClientPtr client)
{
    register char n;
    register long *p;
    register int i;

    REQUEST(xSelectExtensionEventReq);
    swaps(&stuff->length, n);
    REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
    swapl(&stuff->window, n);
    swaps(&stuff->count, n);
    REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
                      stuff->count * sizeof(CARD32));
    SwapLongs((CARD32 *) (&stuff[1]), stuff->count);

    }
    return (ProcXSelectExtensionEvent(client));
}


Lines 83-89 int Link Here

(-)xorg-server-1.3.0.0/Xi/sendexev.c (-6 / +8 lines)
83	SProcXSendExtensionEvent(register ClientPtr client)	83	SProcXSendExtensionEvent(register ClientPtr client)
84	{	84	{
85	register char n;	85	register char n;
86	register long *p;	86	register CARD32 *p;
87	register int i;	87	register int i;
88	xEvent eventT;	88	xEvent eventT;
89	xEvent *eventP;	89	xEvent *eventP;
Lines 94-99 SProcXSendExtensionEvent(register Client Link Here
94	REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);	94	REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
95	swapl(&stuff->destination, n);	95	swapl(&stuff->destination, n);
96	swaps(&stuff->count, n);	96	swaps(&stuff->count, n);
		97
		98	if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
		99	(stuff->num_events * (sizeof(xEvent) >> 2)))
		100	return BadLength;
		101
97	eventP = (xEvent *) & stuff[1];	102	eventP = (xEvent *) & stuff[1];
98	for (i = 0; i < stuff->num_events; i++, eventP++) {	103	for (i = 0; i < stuff->num_events; i++, eventP++) {
99	proc = EventSwapVector[eventP->u.u.type & 0177];	104	proc = EventSwapVector[eventP->u.u.type & 0177];
Lines 103-113 SProcXSendExtensionEvent(register Client Link Here
103	*eventP = eventT;	108	*eventP = eventT;
104	}	109	}
105		110
106	p = (long )(((xEvent ) & stuff[1]) + stuff->num_events);	111	p = (CARD32 )(((xEvent ) & stuff[1]) + stuff->num_events);
107	for (i = 0; i < stuff->count; i++) {	112	SwapLongs(p, stuff->count);
108	swapl(p, n);
109	p++;
110	}
111	return (ProcXSendExtensionEvent(client));	113	return (ProcXSendExtensionEvent(client));
112	}	114	}
113		115

Lines 329-334 doOpenFont(ClientPtr client, OFclosurePt Link Here

(-)xorg-server-1.3.0.0/dix/dixfonts.c (+7 lines)
329	err = BadFontName;	329	err = BadFontName;
330	goto bail;	330	goto bail;
331	}	331	}
		332	/* check values for firstCol, lastCol, firstRow, and lastRow */
		333	if (pfont->info.firstCol > pfont->info.lastCol \|\|
		334	pfont->info.firstRow > pfont->info.lastRow \|\|
		335	pfont->info.lastCol - pfont->info.firstCol > 255) {
		336	err = AllocError;
		337	goto bail;
		338	}
332	if (!pfont->fpe)	339	if (!pfont->fpe)
333	pfont->fpe = fpe;	340	pfont->fpe = fpe;
334	pfont->refcnt++;	341	pfont->refcnt++;

Lines 640-645 MiscExtPassMessage(int scrnIndex, const Link Here

(-)xorg-server-1.3.0.0/hw/xfree86/common/xf86MiscExt.c (+4 lines)
640		640
641	DEBUG_P("MiscExtPassMessage");	641	DEBUG_P("MiscExtPassMessage");
642		642
		643	/* should check this in the protocol, but xf86NumScreens isn't exported */
		644	if (scrnIndex >= xf86NumScreens)
		645	return BadValue;
		646
643	if (*pScr->HandleMessage == NULL)	647	if (*pScr->HandleMessage == NULL)
644	return BadImplementation;	648	return BadImplementation;
645	return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);	649	return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);

Return to bug 204362

Lines 451-468 ChangeStringFeedback(ClientPtr client, D Link Here

(-)xorg-server-1.3.0.0/Xi/chgfctl.c (-6 / +1 lines)
451	xStringFeedbackCtl * f)	451	xStringFeedbackCtl * f)
452	{	452	{
453	register char n;	453	register char n;
454	register long *p;
455	int i, j;	454	int i, j;
456	KeySym syms, sup_syms;	455	KeySym syms, sup_syms;
457		456
458	syms = (KeySym *) (f + 1);	457	syms = (KeySym *) (f + 1);
459	if (client->swapped) {	458	if (client->swapped) {
460	swaps(&f->length, n); /* swapped num_keysyms in calling proc */	459	swaps(&f->length, n); /* swapped num_keysyms in calling proc */
461	p = (long *)(syms);	460	SwapLongs((CARD32 *) syms, f->num_keysyms);
462	for (i = 0; i < f->num_keysyms; i++) {
463	swapl(p, n);
464	p++;
465	}
466	}	461	}
467		462
468	if (f->num_keysyms > s->ctrl.max_symbols) {	463	if (f->num_keysyms > s->ctrl.max_symbols) {

Lines 34-39 THE USE OR PERFORMANCE OF THIS SOFTWARE. Link Here

(-)xorg-server-1.3.0.0/Xext/EVI.c (-1 / +14 lines)
34	#include <X11/extensions/XEVIstr.h>	34	#include <X11/extensions/XEVIstr.h>
35	#include "EVIstruct.h"	35	#include "EVIstruct.h"
36	#include "modinit.h"	36	#include "modinit.h"
		37	#include "scrnintstr.h"
37		38
38	#if 0	39	#if 0
39	static unsigned char XEVIReqCode = 0;	40	static unsigned char XEVIReqCode = 0;
Lines 87-96 ProcEVIGetVisualInfo(ClientPtr client) Link Here
87	{	88	{
88	REQUEST(xEVIGetVisualInfoReq);	89	REQUEST(xEVIGetVisualInfoReq);
89	xEVIGetVisualInfoReply rep;	90	xEVIGetVisualInfoReply rep;
90	int n, n_conflict, n_info, sz_info, sz_conflict;	91	int i, n, n_conflict, n_info, sz_info, sz_conflict;
91	VisualID32 *conflict;	92	VisualID32 *conflict;
		93	unsigned int total_visuals = 0;
92	xExtendedVisualInfo *eviInfo;	94	xExtendedVisualInfo *eviInfo;
93	int status;	95	int status;
		96
		97	/*
		98	* do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume
		99	* here that you don't have more than 2^32 visuals over all your screens;
		100	* this seems like a safe assumption.
		101	*/
		102	for (i = 0; i < screenInfo.numScreens; i++)
		103	total_visuals += screenInfo.screens[i]->numVisuals;
		104	if (stuff->n_visual > total_visuals)
		105	return BadValue;
		106
94	REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);	107	REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
95	status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,	108	status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
96	&eviInfo, &n_info, &conflict, &n_conflict);	109	&eviInfo, &n_info, &conflict, &n_conflict);

Lines 79-96 int Link Here

(-)xorg-server-1.3.0.0/Xi/chgkmap.c (-7 / +7 lines)
79	SProcXChangeDeviceKeyMapping(register ClientPtr client)	79	SProcXChangeDeviceKeyMapping(register ClientPtr client)
80	{	80	{
81	register char n;	81	register char n;
82	register long *p;	82	register unsigned int count;
83	register int i, count;
84		83
85	REQUEST(xChangeDeviceKeyMappingReq);	84	REQUEST(xChangeDeviceKeyMappingReq);
86	swaps(&stuff->length, n);	85	swaps(&stuff->length, n);
87	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);	86	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
88	p = (long *)&stuff[1];
89	count = stuff->keyCodes * stuff->keySymsPerKeyCode;	87	count = stuff->keyCodes * stuff->keySymsPerKeyCode;
90	for (i = 0; i < count; i++) {	88	REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
91	swapl(p, n);	89	SwapLongs((CARD32 *) (&stuff[1]), count);
92	p++;
93	}
94	return (ProcXChangeDeviceKeyMapping(client));	90	return (ProcXChangeDeviceKeyMapping(client));
95	}	91	}
96		92
Lines 106-115 ProcXChangeDeviceKeyMapping(register Cli Link Here
106	int ret;	102	int ret;
107	unsigned len;	103	unsigned len;
108	DeviceIntPtr dev;	104	DeviceIntPtr dev;
		105	unsigned int count;
109		106
110	REQUEST(xChangeDeviceKeyMappingReq);	107	REQUEST(xChangeDeviceKeyMappingReq);
111	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);	108	REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
112		109
		110	count = stuff->keyCodes * stuff->keySymsPerKeyCode;
		111	REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
		112
113	dev = LookupDeviceIntRec(stuff->deviceid);	113	dev = LookupDeviceIntRec(stuff->deviceid);
114	if (dev == NULL) {	114	if (dev == NULL) {
115	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,	115	SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,

Lines 81-99 int Link Here

(-)xorg-server-1.3.0.0/Xi/chgprop.c (-7 / +3 lines)
81	SProcXChangeDeviceDontPropagateList(register ClientPtr client)	81	SProcXChangeDeviceDontPropagateList(register ClientPtr client)
82	{	82	{
83	register char n;	83	register char n;
84	register long *p;
85	register int i;
86		84
87	REQUEST(xChangeDeviceDontPropagateListReq);	85	REQUEST(xChangeDeviceDontPropagateListReq);
88	swaps(&stuff->length, n);	86	swaps(&stuff->length, n);
89	REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);	87	REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
90	swapl(&stuff->window, n);	88	swapl(&stuff->window, n);
91	swaps(&stuff->count, n);	89	swaps(&stuff->count, n);
92	p = (long *)&stuff[1];	90	REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
93	for (i = 0; i < stuff->count; i++) {	91	stuff->count * sizeof(CARD32));
94	swapl(p, n);	92	SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
95	p++;
96	}
97	return (ProcXChangeDeviceDontPropagateList(client));	93	return (ProcXChangeDeviceDontPropagateList(client));
98	}	94	}
99		95

Lines 82-89 int Link Here

(-)xorg-server-1.3.0.0/Xi/grabdev.c (-7 / +5 lines)
82	SProcXGrabDevice(register ClientPtr client)	82	SProcXGrabDevice(register ClientPtr client)
83	{	83	{
84	register char n;	84	register char n;
85	register long *p;
86	register int i;
87		85
88	REQUEST(xGrabDeviceReq);	86	REQUEST(xGrabDeviceReq);
89	swaps(&stuff->length, n);	87	swaps(&stuff->length, n);
Lines 91-101 SProcXGrabDevice(register ClientPtr clie Link Here
91	swapl(&stuff->grabWindow, n);	89	swapl(&stuff->grabWindow, n);
92	swapl(&stuff->time, n);	90	swapl(&stuff->time, n);
93	swaps(&stuff->event_count, n);	91	swaps(&stuff->event_count, n);
94	p = (long *)&stuff[1];	92
95	for (i = 0; i < stuff->event_count; i++) {	93	if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
96	swapl(p, n);	94	return BadLength;
97	p++;	95
98	}	96	SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
99		97
100	return (ProcXGrabDevice(client));	98	return (ProcXGrabDevice(client));
101	}	99	}

Lines 80-87 int Link Here

(-)xorg-server-1.3.0.0/Xi/grabdevb.c (-7 / +3 lines)
80	SProcXGrabDeviceButton(register ClientPtr client)	80	SProcXGrabDeviceButton(register ClientPtr client)
81	{	81	{
82	register char n;	82	register char n;
83	register long *p;
84	register int i;
85		83
86	REQUEST(xGrabDeviceButtonReq);	84	REQUEST(xGrabDeviceButtonReq);
87	swaps(&stuff->length, n);	85	swaps(&stuff->length, n);
Lines 89-99 SProcXGrabDeviceButton(register ClientPt Link Here
89	swapl(&stuff->grabWindow, n);	87	swapl(&stuff->grabWindow, n);
90	swaps(&stuff->modifiers, n);	88	swaps(&stuff->modifiers, n);
91	swaps(&stuff->event_count, n);	89	swaps(&stuff->event_count, n);
92	p = (long *)&stuff[1];	90	REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
93	for (i = 0; i < stuff->event_count; i++) {	91	stuff->event_count * sizeof(CARD32));
94	swapl(p, n);	92	SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
95	p++;
96	}
97		93
98	return (ProcXGrabDeviceButton(client));	94	return (ProcXGrabDeviceButton(client));
99	}	95	}

Lines 80-87 int Link Here

(-)xorg-server-1.3.0.0/Xi/grabdevk.c (-7 / +2 lines)
80	SProcXGrabDeviceKey(register ClientPtr client)	80	SProcXGrabDeviceKey(register ClientPtr client)
81	{	81	{
82	register char n;	82	register char n;
83	register long *p;
84	register int i;
85		83
86	REQUEST(xGrabDeviceKeyReq);	84	REQUEST(xGrabDeviceKeyReq);
87	swaps(&stuff->length, n);	85	swaps(&stuff->length, n);
Lines 89-99 SProcXGrabDeviceKey(register ClientPtr c Link Here
89	swapl(&stuff->grabWindow, n);	87	swapl(&stuff->grabWindow, n);
90	swaps(&stuff->modifiers, n);	88	swaps(&stuff->modifiers, n);
91	swaps(&stuff->event_count, n);	89	swaps(&stuff->event_count, n);
92	p = (long *)&stuff[1];	90	REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
93	for (i = 0; i < stuff->event_count; i++) {	91	SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
94	swapl(p, n);
95	p++;
96	}
97	return (ProcXGrabDeviceKey(client));	92	return (ProcXGrabDeviceKey(client));
98	}	93	}
99		94

Lines 84-102 int Link Here

(-)xorg-server-1.3.0.0/Xi/selectev.c (-7 / +4 lines)
84	SProcXSelectExtensionEvent(register ClientPtr client)	84	SProcXSelectExtensionEvent(register ClientPtr client)
85	{	85	{
86	register char n;	86	register char n;
87	register long *p;
88	register int i;
89		87
90	REQUEST(xSelectExtensionEventReq);	88	REQUEST(xSelectExtensionEventReq);
91	swaps(&stuff->length, n);	89	swaps(&stuff->length, n);
92	REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);	90	REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
93	swapl(&stuff->window, n);	91	swapl(&stuff->window, n);
94	swaps(&stuff->count, n);	92	swaps(&stuff->count, n);
95	p = (long *)&stuff[1];	93	REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
96	for (i = 0; i < stuff->count; i++) {	94	stuff->count * sizeof(CARD32));
97	swapl(p, n);	95	SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
98	p++;	96
99	}
100	return (ProcXSelectExtensionEvent(client));	97	return (ProcXSelectExtensionEvent(client));
101	}	98	}
102		99