Reduces risk of overflow from converting length field in X replies from words to bytes. (Also seems to be what several calls were already incorrectly passing to _XEatData.)
Signed-off-by: Alan Coopersmith <[email protected]> --- configure.ac | 2 +- hw/dmx/glxProxy/glxcmds.c | 4 ++-- hw/dmx/glxProxy/glxscreens.c | 2 +- hw/dmx/glxProxy/glxsingle.c | 6 +++--- hw/dmx/glxProxy/glxvendor.c | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/configure.ac b/configure.ac index 89a7a9d..206b9c4 100644 --- a/configure.ac +++ b/configure.ac @@ -2003,7 +2003,7 @@ AM_CONDITIONAL(STANDALONE_XPBPROXY, [test "x$STANDALONE_XPBPROXY" = xyes]) dnl DMX DDX PKG_CHECK_MODULES( [DMXMODULES], - [xmuu $LIBXEXT x11 xrender xfixes $LIBXI $DMXPROTO xau $XDMCP_MODULES], + [xmuu $LIBXEXT x11 >= 1.6 xrender xfixes $LIBXI $DMXPROTO xau $XDMCP_MODULES], [PKG_CHECK_MODULES( [XDMXCONFIG_DEP], [xaw7 xmu xt xpm x11], diff --git a/hw/dmx/glxProxy/glxcmds.c b/hw/dmx/glxProxy/glxcmds.c index 0e817ca..8cdb25e 100644 --- a/hw/dmx/glxProxy/glxcmds.c +++ b/hw/dmx/glxProxy/glxcmds.c @@ -2610,7 +2610,7 @@ __glXQueryExtensionsString(__GLXclientState * cl, GLbyte * pc) be_buf = (char *) malloc(numbytes); if (!be_buf) { /* Throw data on the floor */ - _XEatData(dpy, len); + _XEatDataWords(dpy, len); } else { _XReadPad(dpy, (char *) be_buf, numbytes); @@ -2691,7 +2691,7 @@ __glXQueryServerString(__GLXclientState * cl, GLbyte * pc) be_buf = (char *) malloc(numbytes); if (!be_buf) { /* Throw data on the floor */ - _XEatData(dpy, len); + _XEatDataWords(dpy, len); } else { _XReadPad(dpy, (char *) be_buf, numbytes); diff --git a/hw/dmx/glxProxy/glxscreens.c b/hw/dmx/glxProxy/glxscreens.c index 746d94e..138afed 100644 --- a/hw/dmx/glxProxy/glxscreens.c +++ b/hw/dmx/glxProxy/glxscreens.c @@ -154,7 +154,7 @@ CalcServerVersionAndExtensions(void) be_extensions[s] = (char *) malloc(numbytes); if (!be_extensions[s]) { /* Throw data on the floor */ - _XEatData(dpy, length); + _XEatDataWords(dpy, length); } else { _XReadPad(dpy, (char *) be_extensions[s], numbytes); diff --git a/hw/dmx/glxProxy/glxsingle.c b/hw/dmx/glxProxy/glxsingle.c index e60cfeb..abfb880 100644 --- a/hw/dmx/glxProxy/glxsingle.c +++ b/hw/dmx/glxProxy/glxsingle.c @@ -258,7 +258,7 @@ __glXForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc) } else { /* Throw data on the floor */ - _XEatData(dpy, be_buf_size); + _XEatDataWords(dpy, be_reply.length); return BadAlloc; } } @@ -357,7 +357,7 @@ __glXForwardAllWithReply(__GLXclientState * cl, GLbyte * pc) } else { /* Throw data on the floor */ - _XEatData(dpy, be_buf_size); + _XEatDataWords(dpy, be_reply.length); return BadAlloc; } } @@ -993,7 +993,7 @@ __glXDisp_ReadPixels(__GLXclientState * cl, GLbyte * pc) } else { /* Throw data on the floor */ - _XEatData(dpy, be_buf_size); + _XEatDataWords(dpy, be_reply.length); free(buf); return BadAlloc; } diff --git a/hw/dmx/glxProxy/glxvendor.c b/hw/dmx/glxProxy/glxvendor.c index 5777c6a..50d505c 100644 --- a/hw/dmx/glxProxy/glxvendor.c +++ b/hw/dmx/glxProxy/glxvendor.c @@ -246,7 +246,7 @@ __glXVForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc) } else { /* Throw data on the floor */ - _XEatData(dpy, be_buf_size); + _XEatDataWords(dpy, be_reply.length); return BadAlloc; } } @@ -340,7 +340,7 @@ __glXVForwardAllWithReply(__GLXclientState * cl, GLbyte * pc) } else { /* Throw data on the floor */ - _XEatData(dpy, be_buf_size); + _XEatDataWords(dpy, be_reply.length); return BadAlloc; } } -- 1.7.9.2 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
