[PATCH 1/3] Various fixes for pseudoramiX.c
Jon TURNEY
jon.turney at dronecode.org.uk
Fri Jun 22 06:56:21 PDT 2012
Various fixes, applied to panoramiX.c in commit 2b266eda, also need applying to pseudoramiX.c:
Fix panoramiX request and reply swapping
Set window and screen values in panoramix replies
Prevent buffer overrun in ProcPanoramiXGetScreenSize
pseudoramiX.c: In function 'ProcPseudoramiXGetState':
pseudoramiX.c:221:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c: In function 'ProcPseudoramiXGetScreenCount':
pseudoramiX.c:250:62: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c: In function 'ProcPseudoramiXGetScreenSize':
pseudoramiX.c:283:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c:284:57: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
I haven't checked if there are any other fixes applied to panoramiX.c since pseudoramiX.c was derived
from it which also should be brought across.
Signed-off-by: Jon TURNEY <jon.turney at dronecode.org.uk>
---
hw/xquartz/pseudoramiX.c | 17 +++++++++++++----
1 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/hw/xquartz/pseudoramiX.c b/hw/xquartz/pseudoramiX.c
index 8bb7f2d..b1b8867 100644
--- a/hw/xquartz/pseudoramiX.c
+++ b/hw/xquartz/pseudoramiX.c
@@ -211,10 +211,11 @@ ProcPseudoramiXGetState(ClientPtr client)
rep.length = 0;
rep.sequenceNumber = client->sequence;
rep.state = !noPseudoramiXExtension;
+ rep.window = stuff->window;
if (client->swapped) {
swaps(&rep.sequenceNumber);
swapl(&rep.length);
- swaps(&rep.state);
+ swapl(&rep.window);
}
WriteToClient(client, sizeof(xPanoramiXGetStateReply), (char *)&rep);
return Success;
@@ -240,10 +241,11 @@ ProcPseudoramiXGetScreenCount(ClientPtr client)
rep.length = 0;
rep.sequenceNumber = client->sequence;
rep.ScreenCount = pseudoramiXNumScreens;
+ rep.window = stuff->window;
if (client->swapped) {
swaps(&rep.sequenceNumber);
swapl(&rep.length);
- swaps(&rep.ScreenCount);
+ swapl(&rep.window);
}
WriteToClient(client, sizeof(xPanoramiXGetScreenCountReply), (char *)&rep);
return Success;
@@ -259,6 +261,9 @@ ProcPseudoramiXGetScreenSize(ClientPtr client)
register int n, rc;
TRACE();
+
+ if (stuff->screen >= pseudoramiXNumScreens)
+ return BadMatch;
REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
@@ -273,11 +278,15 @@ ProcPseudoramiXGetScreenSize(ClientPtr client)
// was screenInfo.screens[stuff->screen]->width;
rep.height = pseudoramiXScreens[stuff->screen].h;
// was screenInfo.screens[stuff->screen]->height;
+ rep.window = stuff->window;
+ rep.screen = stuff->screen;
if (client->swapped) {
swaps(&rep.sequenceNumber);
swapl(&rep.length);
- swaps(&rep.width);
- swaps(&rep.height);
+ swapl(&rep.width);
+ swapl(&rep.height);
+ swapl(&rep.window);
+ swapl(&rep.screen);
}
WriteToClient(client, sizeof(xPanoramiXGetScreenSizeReply), (char *)&rep);
return Success;
--
1.7.9
More information about the xorg-devel
mailing list