From 067931ccce592e319baffa26d4f7380d8d924537 Mon Sep 17 00:00:00 2001
From: Jon TURNEY <jon.turney@dronecode.org.uk>
Date: Mon, 23 Jul 2012 12:16:36 +0100
Subject: [PATCH] hw/xquartz: Various fixes for pseudoramiX.c

Various fixes, applied to panoramiX.c in commit 2b266eda, also need applying to pseudoramiX.c:
 Fix panoramiX request and reply swapping
 Set window and screen values in panoramix replies
 Prevent buffer overrun in ProcPanoramiXGetScreenSize

These fixes seem to be necessary in order to compile pseudoramiX.c with gcc

pseudoramiX.c: In function 'ProcPseudoramiXGetState':
pseudoramiX.c:221:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c: In function 'ProcPseudoramiXGetScreenCount':
pseudoramiX.c:250:62: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c: In function 'ProcPseudoramiXGetScreenSize':
pseudoramiX.c:283:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
pseudoramiX.c:284:57: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
---
 hw/xquartz/pseudoramiX.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/xquartz/pseudoramiX.c b/hw/xquartz/pseudoramiX.c
index c650dd723..ccff64f1c 100644
--- a/hw/xquartz/pseudoramiX.c
+++ b/hw/xquartz/pseudoramiX.c
@@ -212,10 +212,11 @@ ProcPseudoramiXGetState(ClientPtr client)
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
     rep.state = !noPseudoramiXExtension;
+    rep.window = stuff->window;
     if (client->swapped) {
         swaps(&rep.sequenceNumber);
         swapl(&rep.length);
-        swaps(&rep.state);
+        swapl(&rep.window);
     }
     WriteToClient(client, sizeof(xPanoramiXGetStateReply),&rep);
     return Success;
@@ -241,10 +242,11 @@ ProcPseudoramiXGetScreenCount(ClientPtr client)
     rep.length = 0;
     rep.sequenceNumber = client->sequence;
     rep.ScreenCount = pseudoramiXNumScreens;
+    rep.window = stuff->window;
     if (client->swapped) {
         swaps(&rep.sequenceNumber);
         swapl(&rep.length);
-        swaps(&rep.ScreenCount);
+        swapl(&rep.window);
     }
     WriteToClient(client, sizeof(xPanoramiXGetScreenCountReply),&rep);
     return Success;
@@ -261,6 +263,9 @@ ProcPseudoramiXGetScreenSize(ClientPtr client)
 
     TRACE();
 
+    if (stuff->screen >= pseudoramiXNumScreens)
+      return BadMatch;
+
     REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
     rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
     if (rc != Success)
@@ -274,11 +279,15 @@ ProcPseudoramiXGetScreenSize(ClientPtr client)
     // was screenInfo.screens[stuff->screen]->width;
     rep.height = pseudoramiXScreens[stuff->screen].h;
     // was screenInfo.screens[stuff->screen]->height;
+    rep.window = stuff->window;
+    rep.screen = stuff->screen;
     if (client->swapped) {
         swaps(&rep.sequenceNumber);
         swapl(&rep.length);
-        swaps(&rep.width);
-        swaps(&rep.height);
+        swapl(&rep.width);
+        swapl(&rep.height);
+        swapl(&rep.window);
+        swapl(&rep.screen);
     }
     WriteToClient(client, sizeof(xPanoramiXGetScreenSizeReply),&rep);
     return Success;