Module Name: xsrc
Committed By: msaitoh
Date: Mon Dec 22 12:48:25 UTC 2014
Modified Files:
xsrc/external/mit/xorg-server/dist/exa [netbsd-5]: exa_render.c
xsrc/external/mit/xorg-server/dist/render [netbsd-5]: picture.h
Log Message:
Pullup additional patches requested by mrg in ticket #1935:
xsrc/external/mit/xorg-server/dist/exa/exa_render.c 1.2
xsrc/external/mit/xorg-server/dist/render/picture.h 1.2
fixes for CVE CVE-2013-6424:
If t->bottom is close to MIN_INT, removing top can wraparound, so do
the check properly.
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.1.2.1 -r1.1.1.1.2.2 \
xsrc/external/mit/xorg-server/dist/exa/exa_render.c
cvs rdiff -u -r1.1.1.1.2.1 -r1.1.1.1.2.2 \
xsrc/external/mit/xorg-server/dist/render/picture.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: xsrc/external/mit/xorg-server/dist/exa/exa_render.c
diff -u xsrc/external/mit/xorg-server/dist/exa/exa_render.c:1.1.1.1.2.1 xsrc/external/mit/xorg-server/dist/exa/exa_render.c:1.1.1.1.2.2
--- xsrc/external/mit/xorg-server/dist/exa/exa_render.c:1.1.1.1.2.1 Thu Sep 17 03:34:54 2009
+++ xsrc/external/mit/xorg-server/dist/exa/exa_render.c Mon Dec 22 12:48:25 2014
@@ -1074,6 +1074,7 @@ exaTrapezoids (CARD8 op, PicturePtr pSrc
exaPrepareAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
for (; ntrap; ntrap--, traps++)
+ if (xTrapezoidValid(traps))
(*ps->RasterizeTrapezoid) (pPicture, traps,
-bounds.x1, -bounds.y1);
exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
Index: xsrc/external/mit/xorg-server/dist/render/picture.h
diff -u xsrc/external/mit/xorg-server/dist/render/picture.h:1.1.1.1.2.1 xsrc/external/mit/xorg-server/dist/render/picture.h:1.1.1.1.2.2
--- xsrc/external/mit/xorg-server/dist/render/picture.h:1.1.1.1.2.1 Thu Sep 17 03:35:47 2009
+++ xsrc/external/mit/xorg-server/dist/render/picture.h Mon Dec 22 12:48:25 2014
@@ -201,7 +201,7 @@ typedef pixman_fixed_t xFixed;
/* whether 't' is a well defined not obviously empty trapezoid */
#define xTrapezoidValid(t) ((t)->left.p1.y != (t)->left.p2.y && \
(t)->right.p1.y != (t)->right.p2.y && \
- (int) ((t)->bottom - (t)->top) > 0)
+ ((t)->bottom > (t)->top))
/*
* Standard NTSC luminance conversions:
