Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
View | Details | Raw Unified | Return to bug 225419 | Differences between
and this patch

Collapse All | Expand All

(-)a/render/render.c (-4 / +12 lines)
Lines 1920-1925 static int ProcRenderCreateLinearGradient (ClientPtr client) Link Here
1920
    LEGAL_NEW_RESOURCE(stuff->pid, client);
1920
    LEGAL_NEW_RESOURCE(stuff->pid, client);
1921
1921
1922
    len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
1922
    len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
1923
    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
1924
	return BadLength;
1923
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
1925
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
1924
        return BadLength;
1926
        return BadLength;
1925
1927
Lines 2493-2510 SProcRenderCreateSolidFill(ClientPtr client) Link Here
2493
    return (*ProcRenderVector[stuff->renderReqType]) (client);
2495
    return (*ProcRenderVector[stuff->renderReqType]) (client);
2494
}
2496
}
2495
2497
2496
static void swapStops(void *stuff, int n)
2498
static void swapStops(void *stuff, int num)
2497
{
2499
{
2498
    int i;
2500
    int i, n;
2499
    CARD32 *stops;
2501
    CARD32 *stops;
2500
    CARD16 *colors;
2502
    CARD16 *colors;
2501
    stops = (CARD32 *)(stuff);
2503
    stops = (CARD32 *)(stuff);
2502
    for (i = 0; i < n; ++i) {
2504
    for (i = 0; i < num; ++i) {
2503
        swapl(stops, n);
2505
        swapl(stops, n);
2504
        ++stops;
2506
        ++stops;
2505
    }
2507
    }
2506
    colors = (CARD16 *)(stops);
2508
    colors = (CARD16 *)(stops);
2507
    for (i = 0; i < 4*n; ++i) {
2509
    for (i = 0; i < 4*num; ++i) {
2508
        swaps(stops, n);
2510
        swaps(stops, n);
2509
        ++stops;
2511
        ++stops;
2510
    }
2512
    }
Lines 2527-2532 SProcRenderCreateLinearGradient (ClientPtr client) Link Here
2527
    swapl(&stuff->nStops, n);
2529
    swapl(&stuff->nStops, n);
2528
2530
2529
    len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
2531
    len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
2532
    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
2533
	return BadLength;
2530
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
2534
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
2531
        return BadLength;
2535
        return BadLength;
2532
2536
Lines 2554-2559 SProcRenderCreateRadialGradient (ClientPtr client) Link Here
2554
    swapl(&stuff->nStops, n);
2558
    swapl(&stuff->nStops, n);
2555
2559
2556
    len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
2560
    len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
2561
    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
2562
	return BadLength;
2557
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
2563
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
2558
        return BadLength;
2564
        return BadLength;
2559
2565
Lines 2578-2583 SProcRenderCreateConicalGradient (ClientPtr client) Link Here
2578
    swapl(&stuff->nStops, n);
2584
    swapl(&stuff->nStops, n);
2579
2585
2580
    len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
2586
    len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
2587
    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
2588
	return BadLength;
2581
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
2589
    if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
2582
        return BadLength;
2590
        return BadLength;
2583
2591

Return to bug 225419