diff --git a/Xext/vidmode.c b/Xext/vidmode.c index 33a0ac0eb..8b72e5de2 100644 --- a/Xext/vidmode.c +++ b/Xext/vidmode.c @@ -462,12 +462,16 @@ ProcVidModeAddModeLine(ClientPtr client) len = client->req_len - bytes_to_int32(sizeof(xXF86OldVidModeAddModeLineReq)); + if (len != oldstuff->privsize) + return BadLength; } else { REQUEST_AT_LEAST_SIZE(xXF86VidModeAddModeLineReq); len = client->req_len - bytes_to_int32(sizeof(xXF86VidModeAddModeLineReq)); + if (len != stuff->privsize) + return BadLength; } if (ver < 2) { @@ -517,9 +521,6 @@ ProcVidModeAddModeLine(ClientPtr client) stuff->after_vsyncend, stuff->after_vtotal, (unsigned long) stuff->after_flags); - if (len != stuff->privsize) - return BadLength; - if (stuff->screen >= screenInfo.numScreens) return BadValue; pScreen = screenInfo.screens[stuff->screen]; @@ -636,12 +637,28 @@ ProcVidModeDeleteModeLine(ClientPtr client) len = client->req_len - bytes_to_int32(sizeof(xXF86OldVidModeDeleteModeLineReq)); + if (len != oldstuff->privsize) { + DebugF("req_len = %ld, sizeof(Req) = %d, privsize = %ld, " + "len = %d, length = %d\n", + (unsigned long) client->req_len, + (int) sizeof(xXF86VidModeDeleteModeLineReq) >> 2, + (unsigned long) stuff->privsize, len, client->req_len); + return BadLength; + } } else { REQUEST_AT_LEAST_SIZE(xXF86VidModeDeleteModeLineReq); len = client->req_len - bytes_to_int32(sizeof(xXF86VidModeDeleteModeLineReq)); + if (len != stuff->privsize) { + DebugF("req_len = %ld, sizeof(Req) = %d, privsize = %ld, " + "len = %d, length = %d\n", + (unsigned long) client->req_len, + (int) sizeof(xXF86VidModeDeleteModeLineReq) >> 2, + (unsigned long) stuff->privsize, len, client->req_len); + return BadLength; + } } if (ver < 2) { @@ -671,15 +688,6 @@ ProcVidModeDeleteModeLine(ClientPtr client) stuff->vdisplay, stuff->vsyncstart, stuff->vsyncend, stuff->vtotal, (unsigned long) stuff->flags); - if (len != stuff->privsize) { - DebugF("req_len = %ld, sizeof(Req) = %d, privsize = %ld, " - "len = %d, length = %d\n", - (unsigned long) client->req_len, - (int) sizeof(xXF86VidModeDeleteModeLineReq) >> 2, - (unsigned long) stuff->privsize, len, client->req_len); - return BadLength; - } - if (stuff->screen >= screenInfo.numScreens) return BadValue; pScreen = screenInfo.screens[stuff->screen]; @@ -764,12 +772,16 @@ ProcVidModeModModeLine(ClientPtr client) len = client->req_len - bytes_to_int32(sizeof(xXF86OldVidModeModModeLineReq)); + if (len != oldstuff->privsize) + return BadLength; } else { REQUEST_AT_LEAST_SIZE(xXF86VidModeModModeLineReq); len = client->req_len - bytes_to_int32(sizeof(xXF86VidModeModModeLineReq)); + if (len != stuff->privsize) + return BadLength; } if (ver < 2) { @@ -796,9 +808,6 @@ ProcVidModeModModeLine(ClientPtr client) stuff->vdisplay, stuff->vsyncstart, stuff->vsyncend, stuff->vtotal, (unsigned long) stuff->flags); - if (len != stuff->privsize) - return BadLength; - if (stuff->hsyncstart < stuff->hdisplay || stuff->hsyncend < stuff->hsyncstart || stuff->htotal < stuff->hsyncend || @@ -898,12 +907,16 @@ ProcVidModeValidateModeLine(ClientPtr client) REQUEST_AT_LEAST_SIZE(xXF86OldVidModeValidateModeLineReq); len = client->req_len - bytes_to_int32(sizeof(xXF86OldVidModeValidateModeLineReq)); + if (len != oldstuff->privsize) + return BadLength; } else { REQUEST_AT_LEAST_SIZE(xXF86VidModeValidateModeLineReq); len = client->req_len - bytes_to_int32(sizeof(xXF86VidModeValidateModeLineReq)); + if (len != stuff->privsize) + return BadLength; } if (ver < 2) { @@ -1059,12 +1072,16 @@ ProcVidModeSwitchToMode(ClientPtr client) len = client->req_len - bytes_to_int32(sizeof(xXF86OldVidModeSwitchToModeReq)); + if (len != stuff->privsize) + return BadLength; } else { REQUEST_AT_LEAST_SIZE(xXF86VidModeSwitchToModeReq); len = client->req_len - bytes_to_int32(sizeof(xXF86VidModeSwitchToModeReq)); + if (len != stuff->privsize) + return BadLength; } if (ver < 2) { @@ -1095,9 +1112,6 @@ ProcVidModeSwitchToMode(ClientPtr client) stuff->vdisplay, stuff->vsyncstart, stuff->vsyncend, stuff->vtotal, (unsigned long) stuff->flags); - if (len != stuff->privsize) - return BadLength; - if (stuff->screen >= screenInfo.numScreens) return BadValue; pScreen = screenInfo.screens[stuff->screen];