frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update colormap.c with fixes for detected Pointer Overflow CodeQL alerts 

This fixes multiple issues with pointer overflow that were found in my fork. All were limited to colormap.c and have been tested working on my system.
This commit is contained in:
Collin 2025-06-26 19:45:12 -05:00 committed by GitHub
parent 3e1c2d5456
commit 0b4d531026
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
dix/colormap.c
View File

@ -1657,7 +1657,7 @@ AllocDirect(int client, ColormapPtr pmap, int c, int r, int g, int b,
return BadAlloc; return BadAlloc;
/* start out with empty pixels */ /* start out with empty pixels */
for (p = pixels; p < pixels + c; p++) for (p = pixels; (p - pixels) < c; p++)
*p = 0; *p = 0;
ppixRed = calloc(npixR, sizeof(Pixel)); ppixRed = calloc(npixR, sizeof(Pixel));
@ -1713,33 +1713,33 @@ AllocDirect(int client, ColormapPtr pmap, int c, int r, int g, int b,
*pbmask <<= pmap->pVisual->offsetBlue; *pbmask <<= pmap->pVisual->offsetBlue;
ppix = rpix + pmap->numPixelsRed[client]; ppix = rpix + pmap->numPixelsRed[client];
for (pDst = pixels, p = ppixRed; p < ppixRed + npixR; p++) { for (pDst = pixels, p = ppixRed; (size_t)(p - ppixRed) < npixR; p++) {
*ppix++ = *p; *ppix++ = *p;
if (p < ppixRed + c) if ((size_t)(p - ppixRed) < c)
*pDst++ |= *p << pmap->pVisual->offsetRed; *pDst++ |= *p << pmap->pVisual->offsetRed;
} }
pmap->numPixelsRed[client] += npixR; pmap->numPixelsRed[client] += npixR;
pmap->freeRed -= npixR; pmap->freeRed -= npixR;
ppix = gpix + pmap->numPixelsGreen[client]; ppix = gpix + pmap->numPixelsGreen[client];
for (pDst = pixels, p = ppixGreen; p < ppixGreen + npixG; p++) { for (pDst = pixels, p = ppixGreen; (size_t)(p - ppixGreen) < npixG; p++) {
*ppix++ = *p; *ppix++ = *p;
if (p < ppixGreen + c) if ((size_t)(p - ppixGreen) < c)
*pDst++ |= *p << pmap->pVisual->offsetGreen; *pDst++ |= *p << pmap->pVisual->offsetGreen;
} }
pmap->numPixelsGreen[client] += npixG; pmap->numPixelsGreen[client] += npixG;
pmap->freeGreen -= npixG; pmap->freeGreen -= npixG;
ppix = bpix + pmap->numPixelsBlue[client]; ppix = bpix + pmap->numPixelsBlue[client];
for (pDst = pixels, p = ppixBlue; p < ppixBlue + npixB; p++) { for (pDst = pixels, p = ppixBlue; (size_t)(p - ppixBlue) < npixB; p++) {
*ppix++ = *p; *ppix++ = *p;
if (p < ppixBlue + c) if ((size_t)(p - ppixBlue) < c)
*pDst++ |= *p << pmap->pVisual->offsetBlue; *pDst++ |= *p << pmap->pVisual->offsetBlue;
} }
pmap->numPixelsBlue[client] += npixB; pmap->numPixelsBlue[client] += npixB;
pmap->freeBlue -= npixB; pmap->freeBlue -= npixB;
for (pDst = pixels; pDst < pixels + c; pDst++) for (pDst = pixels; (pDst - pixels) < c; pDst++)
*pDst |= ALPHAMASK(pmap->pVisual); *pDst |= ALPHAMASK(pmap->pVisual);
free(ppixBlue); free(ppixBlue);
@ -1771,7 +1771,7 @@ AllocPseudo(int client, ColormapPtr pmap, int c, int r, Bool contig,
ppix = reallocarray(pmap->clientPixelsRed[client], ppix = reallocarray(pmap->clientPixelsRed[client],
pmap->numPixelsRed[client] + npix, sizeof(Pixel)); pmap->numPixelsRed[client] + npix, sizeof(Pixel));
if (!ppix) { if (!ppix) {
for (p = ppixTemp; p < ppixTemp + npix; p++) for (p = ppixTemp; (p - ppixTemp) < npix; p++)
pmap->red[*p].refcnt = 0; pmap->red[*p].refcnt = 0;
free(ppixTemp); free(ppixTemp);
return BadAlloc; return BadAlloc;
@ -1780,9 +1780,9 @@ AllocPseudo(int client, ColormapPtr pmap, int c, int r, Bool contig,
ppix += pmap->numPixelsRed[client]; ppix += pmap->numPixelsRed[client];
*pppixFirst = ppix; *pppixFirst = ppix;
pDst = pixels; pDst = pixels;
for (p = ppixTemp; p < ppixTemp + npix; p++) { for (p = ppixTemp; (p - ppixTemp) < npix; p++) {
*ppix++ = *p; *ppix++ = *p;
if (p < ppixTemp + c) if ((p - ppixTemp) < c)
*pDst++ = *p; *pDst++ = *p;
} }
pmap->numPixelsRed[client] += npix; pmap->numPixelsRed[client] += npix;