Module Name: xsrc
Committed By: mrg
Date: Mon Dec 22 08:14:10 UTC 2014
Modified Files:
xsrc/external/mit/xorg-server/dist/exa: exa_render.c
xsrc/external/mit/xorg-server/dist/render: picture.h
Log Message:
fixes for CVE CVE-2013-6424:
If t->bottom is close to MIN_INT, removing top can wraparound, so do the check
properly.
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.4 -r1.2 \
xsrc/external/mit/xorg-server/dist/exa/exa_render.c
cvs rdiff -u -r1.1.1.3 -r1.2 \
xsrc/external/mit/xorg-server/dist/render/picture.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: xsrc/external/mit/xorg-server/dist/exa/exa_render.c
diff -u xsrc/external/mit/xorg-server/dist/exa/exa_render.c:1.1.1.4 xsrc/external/mit/xorg-server/dist/exa/exa_render.c:1.2
--- xsrc/external/mit/xorg-server/dist/exa/exa_render.c:1.1.1.4 Tue Nov 23 05:21:03 2010
+++ xsrc/external/mit/xorg-server/dist/exa/exa_render.c Mon Dec 22 08:14:10 2014
@@ -1172,6 +1172,7 @@ exaTrapezoids (CARD8 op, PicturePtr pSrc
exaPrepareAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
for (; ntrap; ntrap--, traps++)
+ if (xTrapezoidValid(traps))
(*ps->RasterizeTrapezoid) (pPicture, traps,
-bounds.x1, -bounds.y1);
exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
Index: xsrc/external/mit/xorg-server/dist/render/picture.h
diff -u xsrc/external/mit/xorg-server/dist/render/picture.h:1.1.1.3 xsrc/external/mit/xorg-server/dist/render/picture.h:1.2
--- xsrc/external/mit/xorg-server/dist/render/picture.h:1.1.1.3 Tue Nov 23 05:22:13 2010
+++ xsrc/external/mit/xorg-server/dist/render/picture.h Mon Dec 22 08:14:10 2014
@@ -210,7 +210,7 @@ typedef pixman_fixed_t xFixed;
/* whether 't' is a well defined not obviously empty trapezoid */
#define xTrapezoidValid(t) ((t)->left.p1.y != (t)->left.p2.y && \
(t)->right.p1.y != (t)->right.p2.y && \
- (int) ((t)->bottom - (t)->top) > 0)
+ ((t)->bottom > (t)->top))
/*
* Standard NTSC luminance conversions:
