Re: [PATCH xserver] Xext: dynamically allocate the PanoramiXDepths[j].vids array

[Keith Packard]

Peter Hutterer  writes:

> Control flow is:
>PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
>PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
>and writes those into the previously allocated array.
>
> This caused invalid reads/writes followed by eventually a double-free abort.
>
> Reproduced with xorg-integration-tests server test
> XineramaTest.ScreenCrossing/* (and a bunch of others).
>
> Signed-off-by: Peter Hutterer 

Reviewed-by: Keith Packard 

(I'd complain about the lack of NULL check, but the original code didn't
bother either)

-- 
-keith


signature.asc
Description: PGP signature
___
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: https://lists.x.org/mailman/listinfo/xorg-devel

[PATCH xserver] Xext: dynamically allocate the PanoramiXDepths[j].vids array

[Peter Hutterer]

Control flow is:
   PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
   PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
   and writes those into the previously allocated array.

This caused invalid reads/writes followed by eventually a double-free abort.

Reproduced with xorg-integration-tests server test
XineramaTest.ScreenCrossing/* (and a bunch of others).

Signed-off-by: Peter Hutterer 
---
 Xext/panoramiX.c | 9 -
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
index 844ea49ce..bd9c45b03 100644
--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
@@ -751,11 +751,7 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
PanoramiXNumDepths, sizeof(DepthRec));
 PanoramiXDepths[j].depth = pDepth->depth;
 PanoramiXDepths[j].numVids = 0;
-/* XXX suboptimal, should grow these dynamically */
-if (pDepth->numVids)
-PanoramiXDepths[j].vids = xallocarray(pDepth->numVids, 
sizeof(VisualID));
-else
-PanoramiXDepths[j].vids = NULL;
+PanoramiXDepths[j].vids = NULL;
 }
 
 static void
@@ -796,6 +792,9 @@ PanoramiXMaybeAddVisual(VisualPtr pVisual)
 
 for (k = 0; k < PanoramiXNumDepths; k++) {
 if (PanoramiXDepths[k].depth == pVisual->nplanes) {
+PanoramiXDepths[k].vids = reallocarray(PanoramiXDepths[k].vids,
+   PanoramiXDepths[k].numVids 
+ 1,
+   sizeof(VisualID));
 PanoramiXDepths[k].vids[PanoramiXDepths[k].numVids] = pVisual->vid;
 PanoramiXDepths[k].numVids++;
 break;
-- 
2.17.1

___
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: https://lists.x.org/mailman/listinfo/xorg-devel

wiki editing

[Felix Miata]

https://dri.freedesktop.org/wiki/ToDo/
https://dri.freedesktop.org/wiki/DDX/
Last edit on the latter was Sat 13 Apr 2013 11:15:48 PM UTC
Neither have a "home" page link.

I wanted to update these, but can't figure out how to determine if I even have
an account that can. Selecting "Edit" produces a popup provides only input for
user name and password, nothing about gaining an account or lost password.
-- 
"Wisdom is supreme; therefore get wisdom. Whatever else you
get, get wisdom." Proverbs 4:7 (New Living Translation)

 Team OS/2 ** Reg. Linux User #211409 ** a11y rocks!

Felix Miata  ***  http://fm.no-ip.com/
___
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: https://lists.x.org/mailman/listinfo/xorg-devel