[PATCH:libXaw] Fix xload crashes if the window is wider than 2048 pixels

[Matthieu Herrb]

On Sat, Mar 24, 2018 at 10:45:47PM -0700, Alan Coopersmith wrote:
> https://bugs.freedesktop.org/show_bug.cgi?id=96670
> 
> Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

Reviewed-by: Matthieu Herrb <matthieu at herrb.eu>
> ---
> 
> I wasn't sure if the size of valuedata could be changed without breaking
> the ABI, since it's embedded in the class structure, so I just added
> bounds checks to keep us from exceeding it.   If you need more than 2048
> points of load average data, you probably want a better monitoring tool
> than xload anyway.
> 
>  src/StripChart.c | 16 +++++++++++++---
>  1 file changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/src/StripChart.c b/src/StripChart.c
> index fa7357c..401036b 100644
> --- a/src/StripChart.c
> +++ b/src/StripChart.c
> @@ -57,6 +57,8 @@ SOFTWARE.
>  #include "Private.h"
>  
>  #define MS_PER_SEC 1000
> +#define NUM_VALUEDATA(w) (sizeof((w)->strip_chart.valuedata) / \
> +                          sizeof((w)->strip_chart.valuedata[0]))
>  
>  /*
>   * Class Methods
> @@ -317,7 +319,8 @@ draw_it(XtPointer client_data, XtIntervalId *id)
>  			    w->strip_chart.update * MS_PER_SEC,draw_it,
>  			    client_data);
>  
> -    if (w->strip_chart.interval >= XtWidth(w))
> +    if ((w->strip_chart.interval >= XtWidth(w)) ||
> +        (w->strip_chart.interval >= NUM_VALUEDATA(w)))
>  	MoveChart((StripChartWidget)w, True);
>  
>      /* Get the value, stash the point and draw corresponding line */
> @@ -410,6 +413,9 @@ repaint_window(StripChartWidget w, int left, int width)
>  	if (next < ++width)
>  	    width = next;
>  
> +	if (width > NUM_VALUEDATA(w))
> +	    width = NUM_VALUEDATA(w);
> +
>  	/* Draw data point lines */
>  	for (i = left; i < width; i++) {
>  	    int y = XtHeight(w) - (XtHeight(w) * w->strip_chart.valuedata[i])
> @@ -449,12 +455,16 @@ MoveChart(StripChartWidget w, Bool blit)
>      if (!XtIsRealized((Widget)w))
>  	return;
>  
> +    if (XtWidth(w) > NUM_VALUEDATA(w))
> +	j = (int) NUM_VALUEDATA(w);
> +    else
> +	j = (int) XtWidth(w);
>      if (w->strip_chart.jump_val < 0)
>  	w->strip_chart.jump_val = DEFAULT_JUMP;
>      if (w->strip_chart.jump_val == DEFAULT_JUMP)
> -	j = XtWidth(w) >> 1;
> +	j = j >> 1;
>      else {
> -	j = (int)XtWidth(w) - w->strip_chart.jump_val;
> +	j -= w->strip_chart.jump_val;
>  	if (j < 0)
>  	    j = 0;
>      }
> -- 
> 2.15.0
> 
> _______________________________________________
> xorg-devel at lists.x.org: X.Org development
> Archives: http://lists.x.org/archives/xorg-devel
> Info: https://lists.x.org/mailman/listinfo/xorg-devel

-- 
Matthieu Herrb
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 793 bytes
Desc: not available
URL: <https://lists.x.org/archives/xorg-devel/attachments/20180325/3e91f6e6/attachment-0001.sig>