Lines 1920-1925
static int ProcRenderCreateLinearGradient (ClientPtr client)
Link Here
|
1920 |
LEGAL_NEW_RESOURCE(stuff->pid, client); |
1920 |
LEGAL_NEW_RESOURCE(stuff->pid, client); |
1921 |
|
1921 |
|
1922 |
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); |
1922 |
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); |
|
|
1923 |
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) |
1924 |
return BadLength; |
1923 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
1925 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
1924 |
return BadLength; |
1926 |
return BadLength; |
1925 |
|
1927 |
|
Lines 2493-2510
SProcRenderCreateSolidFill(ClientPtr client)
Link Here
|
2493 |
return (*ProcRenderVector[stuff->renderReqType]) (client); |
2495 |
return (*ProcRenderVector[stuff->renderReqType]) (client); |
2494 |
} |
2496 |
} |
2495 |
|
2497 |
|
2496 |
static void swapStops(void *stuff, int n) |
2498 |
static void swapStops(void *stuff, int num) |
2497 |
{ |
2499 |
{ |
2498 |
int i; |
2500 |
int i, n; |
2499 |
CARD32 *stops; |
2501 |
CARD32 *stops; |
2500 |
CARD16 *colors; |
2502 |
CARD16 *colors; |
2501 |
stops = (CARD32 *)(stuff); |
2503 |
stops = (CARD32 *)(stuff); |
2502 |
for (i = 0; i < n; ++i) { |
2504 |
for (i = 0; i < num; ++i) { |
2503 |
swapl(stops, n); |
2505 |
swapl(stops, n); |
2504 |
++stops; |
2506 |
++stops; |
2505 |
} |
2507 |
} |
2506 |
colors = (CARD16 *)(stops); |
2508 |
colors = (CARD16 *)(stops); |
2507 |
for (i = 0; i < 4*n; ++i) { |
2509 |
for (i = 0; i < 4*num; ++i) { |
2508 |
swaps(stops, n); |
2510 |
swaps(stops, n); |
2509 |
++stops; |
2511 |
++stops; |
2510 |
} |
2512 |
} |
Lines 2527-2532
SProcRenderCreateLinearGradient (ClientPtr client)
Link Here
|
2527 |
swapl(&stuff->nStops, n); |
2529 |
swapl(&stuff->nStops, n); |
2528 |
|
2530 |
|
2529 |
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); |
2531 |
len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq); |
|
|
2532 |
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) |
2533 |
return BadLength; |
2530 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
2534 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
2531 |
return BadLength; |
2535 |
return BadLength; |
2532 |
|
2536 |
|
Lines 2554-2559
SProcRenderCreateRadialGradient (ClientPtr client)
Link Here
|
2554 |
swapl(&stuff->nStops, n); |
2558 |
swapl(&stuff->nStops, n); |
2555 |
|
2559 |
|
2556 |
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); |
2560 |
len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq); |
|
|
2561 |
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) |
2562 |
return BadLength; |
2557 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
2563 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
2558 |
return BadLength; |
2564 |
return BadLength; |
2559 |
|
2565 |
|
Lines 2578-2583
SProcRenderCreateConicalGradient (ClientPtr client)
Link Here
|
2578 |
swapl(&stuff->nStops, n); |
2584 |
swapl(&stuff->nStops, n); |
2579 |
|
2585 |
|
2580 |
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); |
2586 |
len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq); |
|
|
2587 |
if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor))) |
2588 |
return BadLength; |
2581 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
2589 |
if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor))) |
2582 |
return BadLength; |
2590 |
return BadLength; |
2583 |
|
2591 |
|