xserver: Branch 'server-1.3-branch' - 2 commits

[Keith Packard]

 Xext/xcmisc.c |   13 +++++++++++--
 os/WaitFor.c  |    9 ++++++---
 2 files changed, 17 insertions(+), 5 deletions(-)

New commits:
diff-tree 44c4bd5df3aae191be9fc836be26f91497d02901 (from 44ea7a3e0d8fa636f4e5dd392caf618120d98413)
Author: Matthieu Herrb <matthieu at roadrock.(none)>
Date:   Tue Apr 3 15:47:18 2007 +0200

    CVE-2007-1003: XC-MISC Extension ProcXCMiscGetXIDList() Memory Corruption
    
    (cherry picked from commit 645d87cf8ef724d4591614f9994cdc4d7549a7a8)

diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c
index f26218e..8c7a86e 100644
--- a/Xext/xcmisc.c
+++ b/Xext/xcmisc.c
@@ -42,6 +42,12 @@ from The Open Group.
 #include <X11/extensions/xcmiscstr.h>
 #include "modinit.h"
 
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
 #if 0
 static unsigned char XCMiscCode;
 #endif
@@ -143,7 +149,10 @@ ProcXCMiscGetXIDList(client)
 
     REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
 
-    pids = (XID *)ALLOCATE_LOCAL(stuff->count * sizeof(XID));
+    if (stuff->count > UINT32_MAX / sizeof(XID))
+	    return BadAlloc;
+
+    pids = (XID *)Xalloc(stuff->count * sizeof(XID));
     if (!pids)
     {
 	return BadAlloc;
@@ -164,7 +173,7 @@ ProcXCMiscGetXIDList(client)
     	client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
 	WriteSwappedDataToClient(client, count * sizeof(XID), pids);
     }
-    DEALLOCATE_LOCAL(pids);
+    Xfree(pids);
     return(client->noClientException);
 }
 
diff-tree 44ea7a3e0d8fa636f4e5dd392caf618120d98413 (from 042ef1f573d6e98756cc98c296bddd1aa9e4c8ca)
Author: Tomas Janousek <tomi at nomi.cz>
Date:   Wed Mar 28 14:46:30 2007 -0400

    Bug #10296: Fix timer rescheduling.
    
    (cherry picked from commit 8c7f56d92d8471ee059c14d322af5f7f555dd5c6)

diff --git a/os/WaitFor.c b/os/WaitFor.c
index ba227a3..d0f9f62 100644
--- a/os/WaitFor.c
+++ b/os/WaitFor.c
@@ -125,7 +125,7 @@ struct _OsTimerRec {
 };
 
 static void DoTimer(OsTimerPtr timer, CARD32 now, OsTimerPtr *prev);
-static void CheckAllTimers(CARD32 now);
+static void CheckAllTimers(void);
 static OsTimerPtr timers = NULL;
 
 /*****************
@@ -204,7 +204,7 @@ WaitForSomething(int *pClientsReady)
 	    timeout = timers->expires - now;
             if (timeout > 0 && timeout > timers->delta + 250) {
                 /* time has rewound.  reset the timers. */
-                CheckAllTimers(now);
+                CheckAllTimers();
             }
 
 	    if (timers) {
@@ -439,11 +439,14 @@ ANYSET(FdMask *src)
 /* If time has rewound, re-run every affected timer.
  * Timers might drop out of the list, so we have to restart every time. */
 static void
-CheckAllTimers(CARD32 now)
+CheckAllTimers(void)
 {
     OsTimerPtr timer;
+    CARD32 now;
 
 start:
+    now = GetTimeInMillis();
+
     for (timer = timers; timer; timer = timer->next) {
         if (timer->expires - now > timer->delta + 250) {
             TimerForce(timer);