Attachment #155985 for bug #225419




    register char 	n;
    CARD32 *values;
    unsigned long nvalues;
    int values_offset;

    swaps(&stuff->length, n);
    REQUEST_AT_LEAST_SIZE(xSecurityGenerateAuthorizationReq);
    swaps(&stuff->nbytesAuthProto, n);
    swaps(&stuff->nbytesAuthData, n);
    swapl(&stuff->valueMask, n);
    values_offset = ((stuff->nbytesAuthProto + (unsigned)3) >> 2) +
		    ((stuff->nbytesAuthData + (unsigned)3) >> 2);
    if (values_offset > 
	stuff->length - (sz_xSecurityGenerateAuthorizationReq >> 2))
	return BadLength;
    values = (CARD32 *)(&stuff[1]) + values_offset;
    nvalues = (((CARD32 *)stuff) + stuff->length) - values;
    SwapLongs(values, nvalues);
    return ProcSecurityGenerateAuthorization(client);

Lines 2656-2662 SProcRecordQueryVersion(ClientPtr client) Link Here

(-)a/record/record.c (-3 / +13 lines)
2656	} /* SProcRecordQueryVersion */	2656	} /* SProcRecordQueryVersion */
2657		2657
2658		2658
2659	static void	2659	static int
2660	SwapCreateRegister(xRecordRegisterClientsReq *stuff)	2660	SwapCreateRegister(xRecordRegisterClientsReq *stuff)
2661	{	2661	{
2662	register char n;	2662	register char n;
Lines 2667-2677 SwapCreateRegister(xRecordRegisterClientsReq *stuff) Link Here
2667	swapl(&stuff->nClients, n);	2667	swapl(&stuff->nClients, n);
2668	swapl(&stuff->nRanges, n);	2668	swapl(&stuff->nRanges, n);
2669	pClientID = (XID *)&stuff[1];	2669	pClientID = (XID *)&stuff[1];
		2670	if (stuff->nClients > stuff->length - (sz_xRecordRegisterClientsReq >> 2))
		2671	return BadLength;
2670	for (i = 0; i < stuff->nClients; i++, pClientID++)	2672	for (i = 0; i < stuff->nClients; i++, pClientID++)
2671	{	2673	{
2672	swapl(pClientID, n);	2674	swapl(pClientID, n);
2673	}	2675	}
		2676	if (stuff->nRanges > stuff->length - (sz_xRecordRegisterClientsReq >> 2)
		2677	- stuff->nClients)
		2678	return BadLength;
2674	RecordSwapRanges((xRecordRange *)pClientID, stuff->nRanges);	2679	RecordSwapRanges((xRecordRange *)pClientID, stuff->nRanges);
		2680	return Success;
2675	} /* SwapCreateRegister */	2681	} /* SwapCreateRegister */
2676		2682
2677		2683
Lines 2679-2689 static int Link Here
2679	SProcRecordCreateContext(ClientPtr client)	2685	SProcRecordCreateContext(ClientPtr client)
2680	{	2686	{
2681	REQUEST(xRecordCreateContextReq);	2687	REQUEST(xRecordCreateContextReq);
		2688	int status;
2682	register char n;	2689	register char n;
2683		2690
2684	swaps(&stuff->length, n);	2691	swaps(&stuff->length, n);
2685	REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq);	2692	REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq);
2686	SwapCreateRegister((pointer)stuff);	2693	if ((status = SwapCreateRegister((pointer)stuff)) != Success)
		2694	return status;
2687	return ProcRecordCreateContext(client);	2695	return ProcRecordCreateContext(client);
2688	} /* SProcRecordCreateContext */	2696	} /* SProcRecordCreateContext */
2689		2697
Lines 2692-2702 static int Link Here
2692	SProcRecordRegisterClients(ClientPtr client)	2700	SProcRecordRegisterClients(ClientPtr client)
2693	{	2701	{
2694	REQUEST(xRecordRegisterClientsReq);	2702	REQUEST(xRecordRegisterClientsReq);
		2703	int status;
2695	register char n;	2704	register char n;
2696		2705
2697	swaps(&stuff->length, n);	2706	swaps(&stuff->length, n);
2698	REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq);	2707	REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq);
2699	SwapCreateRegister((pointer)stuff);	2708	if ((status = SwapCreateRegister((pointer)stuff)) != Success)
		2709	return status;
2700	return ProcRecordRegisterClients(client);	2710	return ProcRecordRegisterClients(client);
2701	} /* SProcRecordRegisterClients */	2711	} /* SProcRecordRegisterClients */
2702		2712

Return to bug 225419

Lines 651-665 SProcSecurityGenerateAuthorization( Link Here

(-)a/Xext/security.c (-3 / +7 lines)
651	register char n;	651	register char n;
652	CARD32 *values;	652	CARD32 *values;
653	unsigned long nvalues;	653	unsigned long nvalues;
		654	int values_offset;
654		655
655	swaps(&stuff->length, n);	656	swaps(&stuff->length, n);
656	REQUEST_AT_LEAST_SIZE(xSecurityGenerateAuthorizationReq);	657	REQUEST_AT_LEAST_SIZE(xSecurityGenerateAuthorizationReq);
657	swaps(&stuff->nbytesAuthProto, n);	658	swaps(&stuff->nbytesAuthProto, n);
658	swaps(&stuff->nbytesAuthData, n);	659	swaps(&stuff->nbytesAuthData, n);
659	swapl(&stuff->valueMask, n);	660	swapl(&stuff->valueMask, n);
660	values = (CARD32 *)(&stuff[1]) +	661	values_offset = ((stuff->nbytesAuthProto + (unsigned)3) >> 2) +
661	((stuff->nbytesAuthProto + (unsigned)3) >> 2) +	662	((stuff->nbytesAuthData + (unsigned)3) >> 2);
662	((stuff->nbytesAuthData + (unsigned)3) >> 2);	663	if (values_offset >
		664	stuff->length - (sz_xSecurityGenerateAuthorizationReq >> 2))
		665	return BadLength;
		666	values = (CARD32 *)(&stuff[1]) + values_offset;
663	nvalues = (((CARD32 *)stuff) + stuff->length) - values;	667	nvalues = (((CARD32 *)stuff) + stuff->length) - values;
664	SwapLongs(values, nvalues);	668	SwapLongs(values, nvalues);
665	return ProcSecurityGenerateAuthorization(client);	669	return ProcSecurityGenerateAuthorization(client);