Stop taking 64-bit size_t, truncating to 32-bit unsigned int, and then putting into a 64-bit size_t argument to underlying *alloc call.
Also stop casting results, since in C, that just hides missing prototype errors that can cause memory corruption when taking an implicit 32-bit int return value and trying to make a 64-bit pointer out of it. Signed-off-by: Alan Coopersmith <[email protected]> --- src/FSFontInfo.c | 50 ++++++++++++++++++++------------------------------ src/FSFtNames.c | 4 ++-- src/FSGetCats.c | 5 ++--- src/FSListCats.c | 5 ++--- src/FSListExt.c | 4 ++-- src/FSOpenServ.c | 11 +++++------ src/FSQGlyphs.c | 11 +++++------ src/FSQXExt.c | 7 +++---- src/FSQXInfo.c | 5 ++--- src/FSlibInt.c | 5 ++--- 10 files changed, 45 insertions(+), 62 deletions(-) diff --git a/src/FSFontInfo.c b/src/FSFontInfo.c index d9c84b6..fcc91ea 100644 --- a/src/FSFontInfo.c +++ b/src/FSFontInfo.c @@ -134,20 +134,16 @@ FSListFontsWithXInfo( goto badmem; if (fhdr) { - FSXFontInfoHeader **tmp_fhdr = (FSXFontInfoHeader **) - FSrealloc((char *) fhdr, - (unsigned) (sizeof(FSXFontInfoHeader *) * size)); - char **tmp_flist = (char **) FSrealloc((char *) flist, - (unsigned) (sizeof(char *) * size)); - FSPropInfo **tmp_pi = (FSPropInfo **) - FSrealloc((char *) pi, - (unsigned) (sizeof(FSPropInfo *) * size)); - FSPropOffset **tmp_po = (FSPropOffset **) - FSrealloc((char *) po, - (unsigned) (sizeof(FSPropOffset *) * size)); - unsigned char **tmp_pd = (unsigned char **) - FSrealloc((char *) pd, - (unsigned) (sizeof(unsigned char *) * size)); + FSXFontInfoHeader **tmp_fhdr = + FSrealloc(fhdr, sizeof(FSXFontInfoHeader *) * size); + char **tmp_flist = + FSrealloc(flist, sizeof(char *) * size); + FSPropInfo **tmp_pi = + FSrealloc(pi, sizeof(FSPropInfo *) * size); + FSPropOffset **tmp_po = + FSrealloc(po, sizeof(FSPropOffset *) * size); + unsigned char **tmp_pd = + FSrealloc(pd, sizeof(unsigned char *) * size); if (!tmp_fhdr || !tmp_flist || !tmp_pi || !tmp_po || !tmp_pd) { for (j = (i - 1); j >= 0; j--) { @@ -185,29 +181,24 @@ FSListFontsWithXInfo( po = tmp_po; pd = tmp_pd; } else { - if (!(fhdr = (FSXFontInfoHeader **) - FSmalloc((unsigned) (sizeof(FSXFontInfoHeader *) * size)))) + if (!(fhdr = FSmalloc(sizeof(FSXFontInfoHeader *) * size))) goto clearwire; - if (!(flist = (char **) - FSmalloc((unsigned) (sizeof(char *) * size)))) { + if (!(flist = FSmalloc(sizeof(char *) * size))) { FSfree((char *) fhdr); goto clearwire; } - if (!(pi = (FSPropInfo **) - FSmalloc((unsigned) (sizeof(FSPropInfo *) * size)))) { + if (!(pi = FSmalloc(sizeof(FSPropInfo *) * size))) { FSfree((char *) fhdr); FSfree((char *) flist); goto clearwire; } - if (!(po = (FSPropOffset **) - FSmalloc((unsigned) (sizeof(FSPropOffset *) * size)))) { + if (!(po = FSmalloc(sizeof(FSPropOffset *) * size))) { FSfree((char *) fhdr); FSfree((char *) flist); FSfree((char *) pi); goto clearwire; } - if (!(pd = (unsigned char **) - FSmalloc((unsigned) (sizeof(unsigned char *) * size)))) { + if (!(pd = FSmalloc(sizeof(unsigned char *) * size))) { FSfree((char *) fhdr); FSfree((char *) flist); FSfree((char *) pi); @@ -216,14 +207,14 @@ FSListFontsWithXInfo( } } } - fhdr[i] = (FSXFontInfoHeader *) FSmalloc(sizeof(FSXFontInfoHeader)); + fhdr[i] = FSmalloc(sizeof(FSXFontInfoHeader)); if (!fhdr[i]) { goto badmem; } FSUnpack_XFontInfoHeader(&reply, fhdr[i], FSProtocolVersion(svr)); /* alloc space for the name */ - flist[i] = (char *) FSmalloc((unsigned int) (reply.nameLength + 1)); + flist[i] = FSmalloc(reply.nameLength + 1); if (FSProtocolVersion(svr) == 1) { /* get the name */ @@ -236,7 +227,7 @@ FSListFontsWithXInfo( flist[i][reply.nameLength] = '\0'; } - pi[i] = (FSPropInfo *) FSmalloc(sizeof(FSPropInfo)); + pi[i] = FSmalloc(sizeof(FSPropInfo)); if (!pi[i]) { FSfree((char *) fhdr[i]); goto badmem; @@ -250,14 +241,13 @@ FSListFontsWithXInfo( goto badmem; #endif - po[i] = (FSPropOffset *) - FSmalloc(pi[i]->num_offsets * sizeof(FSPropOffset)); + po[i] = FSmalloc(pi[i]->num_offsets * sizeof(FSPropOffset)); if (!po[i]) { FSfree((char *) fhdr[i]); FSfree((char *) pi[i]); goto badmem; } - pd[i] = (unsigned char *) FSmalloc(pi[i]->data_len); + pd[i] = FSmalloc(pi[i]->data_len); if (!pd[i]) { FSfree((char *) fhdr[i]); FSfree((char *) pi[i]); diff --git a/src/FSFtNames.c b/src/FSFtNames.c index 9624205..470c176 100644 --- a/src/FSFtNames.c +++ b/src/FSFtNames.c @@ -85,9 +85,9 @@ FSListFonts( && rep.length <= (SIZE_MAX >> 2) #endif ) { - flist = (char **) FSmalloc((unsigned) rep.nFonts * sizeof(char *)); + flist = FSmalloc(rep.nFonts * sizeof(char *)); rlen = (rep.length << 2) - SIZEOF(fsListFontsReply); - c = (char *) FSmalloc((unsigned) (rlen + 1)); + c = FSmalloc(rlen + 1); if ((!flist) || (!c)) { if (flist) diff --git a/src/FSGetCats.c b/src/FSGetCats.c index 8c5e32b..e009add 100644 --- a/src/FSGetCats.c +++ b/src/FSGetCats.c @@ -79,10 +79,9 @@ FSGetCatalogues( && rep.length <= (SIZE_MAX >> 2) #endif ) { - list = (char **) - FSmalloc((unsigned) (rep.num_catalogues * sizeof(char *))); + list = FSmalloc(rep.num_catalogues * sizeof(char *)); rlen = (rep.length << 2) - SIZEOF(fsGetCataloguesReply); - c = (char *) FSmalloc((unsigned) rlen + 1); + c = FSmalloc(rlen + 1); if ((!list) || (!c)) { if (list) FSfree((char *) list); diff --git a/src/FSListCats.c b/src/FSListCats.c index 3474cda..d27f211 100644 --- a/src/FSListCats.c +++ b/src/FSListCats.c @@ -85,10 +85,9 @@ FSListCatalogues( && rep.length <= (SIZE_MAX>>2) #endif ) { - clist = (char **) - FSmalloc((unsigned) rep.num_catalogues * sizeof(char *)); + clist = FSmalloc(rep.num_catalogues * sizeof(char *)); rlen = (rep.length << 2) - SIZEOF(fsListCataloguesReply); - c = (char *) FSmalloc((unsigned) (rlen + 1)); + c = FSmalloc(rlen + 1); if ((!clist) || (!c)) { if (clist) diff --git a/src/FSListExt.c b/src/FSListExt.c index abe1472..ca4254e 100644 --- a/src/FSListExt.c +++ b/src/FSListExt.c @@ -79,9 +79,9 @@ FSListExtensions( && rep.length <= (SIZE_MAX>>2) #endif ) { - list = (char **) FSmalloc((unsigned)(rep.nExtensions * sizeof(char *))); + list = FSmalloc(rep.nExtensions * sizeof(char *)); rlen = (rep.length << 2) - SIZEOF(fsListExtensionsReply); - c = (char *) FSmalloc((unsigned) rlen + 1); + c = FSmalloc(rlen + 1); if ((!list) || (!c)) { if (list) FSfree((char *) list); diff --git a/src/FSOpenServ.c b/src/FSOpenServ.c index 32f7d25..06750e9 100644 --- a/src/FSOpenServ.c +++ b/src/FSOpenServ.c @@ -124,7 +124,7 @@ FSOpenServer(const char *server) } } - if ((svr = (FSServer *) FScalloc(1, sizeof(FSServer))) == NULL) { + if ((svr = FScalloc(1, sizeof(FSServer))) == NULL) { errno = ENOMEM; return (FSServer *) NULL; } @@ -159,7 +159,7 @@ FSOpenServer(const char *server) setuplength = prefix.alternate_len << 2; if (setuplength > (SIZE_MAX>>2) || (alt_data = (char *) - (setup = FSmalloc((unsigned) setuplength))) == NULL) { + (setup = FSmalloc(setuplength))) == NULL) { goto fail; } _FSRead(svr, (char *) alt_data, setuplength); @@ -179,7 +179,7 @@ FSOpenServer(const char *server) for (i = 0; i < prefix.num_alternates; i++) { alts[i].subset = (Bool) *ad++; altlen = (int) *ad++; - alts[i].name = (char *) FSmalloc(altlen + 1); + alts[i].name = FSmalloc(altlen + 1); if (!alts[i].name) { while (--i) { FSfree((char *) alts[i].name); @@ -199,7 +199,7 @@ FSOpenServer(const char *server) setuplength = prefix.auth_len << 2; if (setuplength > (SIZE_MAX>>2) || (auth_data = (char *) - (setup = FSmalloc((unsigned) setuplength))) == NULL) { + (setup = FSmalloc(setuplength))) == NULL) { goto fail; } _FSRead(svr, (char *) auth_data, setuplength); @@ -212,8 +212,7 @@ FSOpenServer(const char *server) /* get rest */ _FSRead(svr, (char *) &conn, (long) SIZEOF(fsConnSetupAccept)); - if ((vendor_string = (char *) - FSmalloc((unsigned) conn.vendor_len + 1)) == NULL) { + if ((vendor_string = FSmalloc(conn.vendor_len + 1)) == NULL) { goto fail; } _FSReadPad(svr, (char *) vendor_string, conn.vendor_len); diff --git a/src/FSQGlyphs.c b/src/FSQGlyphs.c index bf3c3b2..9fbe2f4 100644 --- a/src/FSQGlyphs.c +++ b/src/FSQGlyphs.c @@ -91,7 +91,7 @@ FSQueryXBitmaps8( return FSBadAlloc; #endif - offs = (FSOffset *) FSmalloc(sizeof(FSOffset) * reply.num_chars); + offs = FSmalloc(sizeof(FSOffset) * reply.num_chars); *offsets = offs; if (!offs) return FSBadAlloc; @@ -104,7 +104,7 @@ FSQueryXBitmaps8( #endif left = (reply.length << 2) - SIZEOF(fsQueryXBitmaps8Reply) - (SIZEOF(fsOffset32) * reply.num_chars); - gd = (unsigned char *) FSmalloc(left); + gd = FSmalloc(left); *glyphdata = gd; if (!gd) { FSfree((char *) offs); @@ -154,8 +154,7 @@ FSQueryXBitmaps16( if (str_len > SIZE_MAX/SIZEOF(fsChar2b_version1)) return FSBadAlloc; - swapped_str = (fsChar2b_version1 *) - FSmalloc(SIZEOF(fsChar2b_version1) * str_len); + swapped_str = FSmalloc(SIZEOF(fsChar2b_version1) * str_len); if (!swapped_str) return FSBadAlloc; for (i = 0; i < str_len; i++) { @@ -177,7 +176,7 @@ FSQueryXBitmaps16( if(reply.num_chars > SIZE_MAX/sizeof(FSOffset)) return FSBadAlloc; #endif - offs = (FSOffset *) FSmalloc(sizeof(FSOffset) * reply.num_chars); + offs = FSmalloc(sizeof(FSOffset) * reply.num_chars); *offsets = offs; if (!offs) return FSBadAlloc; @@ -190,7 +189,7 @@ FSQueryXBitmaps16( #endif left = (reply.length << 2) - SIZEOF(fsQueryXBitmaps16Reply) - (SIZEOF(fsOffset32) * reply.num_chars); - gd = (unsigned char *) FSmalloc(left); + gd = FSmalloc(left); *glyphdata = gd; if (!gd) { FSfree((char *) offs); diff --git a/src/FSQXExt.c b/src/FSQXExt.c index 9716f9d..e730df5 100644 --- a/src/FSQXExt.c +++ b/src/FSQXExt.c @@ -98,7 +98,7 @@ FSQueryXExtents8( return FSBadAlloc; #endif - ext = (FSXCharInfo *) FSmalloc(sizeof(FSXCharInfo) * reply.num_extents); + ext = FSmalloc(sizeof(FSXCharInfo) * reply.num_extents); *extents = ext; if (!ext) return FSBadAlloc; @@ -135,8 +135,7 @@ FSQueryXExtents16( { fsChar2b_version1 *swapped_str; - swapped_str = (fsChar2b_version1 *) - FSmalloc(SIZEOF(fsChar2b_version1) * str_len); + swapped_str = FSmalloc(SIZEOF(fsChar2b_version1) * str_len); if (!swapped_str) return FSBadAlloc; for (i = 0; i < str_len; i++) { @@ -159,7 +158,7 @@ FSQueryXExtents16( return FSBadAlloc; #endif - ext = (FSXCharInfo *) FSmalloc(sizeof(FSXCharInfo) * reply.num_extents); + ext = FSmalloc(sizeof(FSXCharInfo) * reply.num_extents); *extents = ext; if (!ext) return FSBadAlloc; diff --git a/src/FSQXInfo.c b/src/FSQXInfo.c index 4be9bce..3e3a564 100644 --- a/src/FSQXInfo.c +++ b/src/FSQXInfo.c @@ -98,11 +98,10 @@ FSQueryXInfo( #endif /* prepare for prop data */ - offset_data = (FSPropOffset *) - FSmalloc(props->num_offsets * sizeof(FSPropOffset)); + offset_data = FSmalloc(props->num_offsets * sizeof(FSPropOffset)); if (!offset_data) return FSBadAlloc; - pdata = (unsigned char *) FSmalloc(props->data_len); + pdata = FSmalloc(props->data_len); if (!pdata) { FSfree((char *) offset_data); return FSBadAlloc; diff --git a/src/FSlibInt.c b/src/FSlibInt.c index a04d3cd..0c24f89 100644 --- a/src/FSlibInt.c +++ b/src/FSlibInt.c @@ -846,8 +846,7 @@ _FSEnq( if ((qelt = _FSqfree) != NULL) { /* If _FSqfree is non-NULL do this, else malloc a new one. */ _FSqfree = qelt->next; - } else if ((qelt = - (_FSQEvent *) FSmalloc((unsigned) sizeof(_FSQEvent))) == NULL) { + } else if ((qelt = FSmalloc(sizeof(_FSQEvent))) == NULL) { /* Malloc call failed! */ ESET(ENOMEM); (*_FSIOErrorFunction) (svr); @@ -1105,7 +1104,7 @@ _FSAllocScratch( if (svr->scratch_buffer != NULL) FSfree(svr->scratch_buffer); return (svr->scratch_length = nbytes, - svr->scratch_buffer = FSmalloc((unsigned) nbytes)); + svr->scratch_buffer = FSmalloc(nbytes)); } return (svr->scratch_buffer); } -- 1.7.9.2 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
