frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix panoramiX request and reply swapping 

Fix panoramiX request and reply swapping
 Set window and screen values in panoramix replies
 Prevent buffer overrun in ProcPanoramiXGetScreenSize
This commit is contained in:
Peter Harris 2007-12-20 15:58:01 -05:00 committed by Julien Cristau
parent 03ab8f11d2
commit 2b266eda6e
2 changed files with 27 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Xext/panoramiX.c
View File

@ -932,10 +932,11 @@ ProcPanoramiXGetState(ClientPtr client)
rep.length = 0; rep.length = 0;
rep.sequenceNumber = client->sequence; rep.sequenceNumber = client->sequence;
rep.state = !noPanoramiXExtension; rep.state = !noPanoramiXExtension;
rep.window = stuff->window;
if (client->swapped) { if (client->swapped) {
swaps (&rep.sequenceNumber, n); swaps (&rep.sequenceNumber, n);
swapl (&rep.length, n); swapl (&rep.length, n);
swaps (&rep.state, n); swapl (&rep.window, n);
} }
WriteToClient (client, sizeof (xPanoramiXGetStateReply), (char *) &rep); WriteToClient (client, sizeof (xPanoramiXGetStateReply), (char *) &rep);
return client->noClientException; return client->noClientException;
@ -959,10 +960,11 @@ ProcPanoramiXGetScreenCount(ClientPtr client)
rep.length = 0; rep.length = 0;
rep.sequenceNumber = client->sequence; rep.sequenceNumber = client->sequence;
rep.ScreenCount = PanoramiXNumScreens; rep.ScreenCount = PanoramiXNumScreens;
rep.window = stuff->window;
if (client->swapped) { if (client->swapped) {
swaps (&rep.sequenceNumber, n); swaps (&rep.sequenceNumber, n);
swapl (&rep.length, n); swapl (&rep.length, n);
swaps (&rep.ScreenCount, n); swapl (&rep.window, n);
} }
WriteToClient (client, sizeof (xPanoramiXGetScreenCountReply), (char *) &rep); WriteToClient (client, sizeof (xPanoramiXGetScreenCountReply), (char *) &rep);
return client->noClientException; return client->noClientException;
@ -976,6 +978,9 @@ ProcPanoramiXGetScreenSize(ClientPtr client)
xPanoramiXGetScreenSizeReply rep; xPanoramiXGetScreenSizeReply rep;
int n, rc; int n, rc;
if (stuff->screen >= PanoramiXNumScreens)
return BadMatch;
REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq); REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess); rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess);
if (rc != Success) if (rc != Success)
@ -987,11 +992,15 @@ ProcPanoramiXGetScreenSize(ClientPtr client)
/* screen dimensions */ /* screen dimensions */
rep.width = panoramiXdataPtr[stuff->screen].width; rep.width = panoramiXdataPtr[stuff->screen].width;
rep.height = panoramiXdataPtr[stuff->screen].height; rep.height = panoramiXdataPtr[stuff->screen].height;
rep.window = stuff->window;
rep.screen = stuff->screen;
if (client->swapped) { if (client->swapped) {
swaps (&rep.sequenceNumber, n); swaps (&rep.sequenceNumber, n);
swapl (&rep.length, n); swapl (&rep.length, n);
swaps (&rep.width, n); swapl (&rep.width, n);
swaps (&rep.height, n); swapl (&rep.height, n);
swapl (&rep.window, n);
swapl (&rep.screen, n);
} }
WriteToClient (client, sizeof (xPanoramiXGetScreenSizeReply), (char *) &rep); WriteToClient (client, sizeof (xPanoramiXGetScreenSizeReply), (char *) &rep);
return client->noClientException; return client->noClientException;

18
randr/rrxinerama.c
View File

@ -138,10 +138,11 @@ ProcRRXineramaGetState(ClientPtr client)
rep.length = 0; rep.length = 0;
rep.sequenceNumber = client->sequence; rep.sequenceNumber = client->sequence;
rep.state = active; rep.state = active;
rep.window = stuff->window;
if(client->swapped) { if(client->swapped) {
swaps (&rep.sequenceNumber, n); swaps (&rep.sequenceNumber, n);
swapl (&rep.length, n); swapl (&rep.length, n);
swaps (&rep.state, n); swapl (&rep.window, n);
} }
WriteToClient(client, sizeof(xPanoramiXGetStateReply), (char *)&rep); WriteToClient(client, sizeof(xPanoramiXGetStateReply), (char *)&rep);
return client->noClientException; return client->noClientException;
@ -192,10 +193,11 @@ ProcRRXineramaGetScreenCount(ClientPtr client)
rep.length = 0; rep.length = 0;
rep.sequenceNumber = client->sequence; rep.sequenceNumber = client->sequence;
rep.ScreenCount = RRXineramaScreenCount (pWin->drawable.pScreen); rep.ScreenCount = RRXineramaScreenCount (pWin->drawable.pScreen);
rep.window = stuff->window;
if(client->swapped) { if(client->swapped) {
swaps(&rep.sequenceNumber, n); swaps(&rep.sequenceNumber, n);
swapl(&rep.length, n); swapl(&rep.length, n);
swaps(&rep.ScreenCount, n); swapl(&rep.window, n);
} }
WriteToClient(client, sizeof(xPanoramiXGetScreenCountReply), (char *)&rep); WriteToClient(client, sizeof(xPanoramiXGetScreenCountReply), (char *)&rep);
return client->noClientException; return client->noClientException;
@ -223,11 +225,15 @@ ProcRRXineramaGetScreenSize(ClientPtr client)
rep.sequenceNumber = client->sequence; rep.sequenceNumber = client->sequence;
rep.width = pRoot->drawable.width; rep.width = pRoot->drawable.width;
rep.height = pRoot->drawable.height; rep.height = pRoot->drawable.height;
rep.window = stuff->window;
rep.screen = stuff->screen;
if(client->swapped) { if(client->swapped) {
swaps(&rep.sequenceNumber, n); swaps(&rep.sequenceNumber, n);
swapl(&rep.length, n); swapl(&rep.length, n);
swaps(&rep.width, n); swapl(&rep.width, n);
swaps(&rep.height, n); swapl(&rep.height, n);
swapl(&rep.window, n);
swapl(&rep.screen, n);
} }
WriteToClient(client, sizeof(xPanoramiXGetScreenSizeReply), (char *)&rep); WriteToClient(client, sizeof(xPanoramiXGetScreenSizeReply), (char *)&rep);
return client->noClientException; return client->noClientException;
@ -351,6 +357,7 @@ SProcRRXineramaGetState(ClientPtr client)
register int n; register int n;
swaps (&stuff->length, n); swaps (&stuff->length, n);
REQUEST_SIZE_MATCH(xPanoramiXGetStateReq); REQUEST_SIZE_MATCH(xPanoramiXGetStateReq);
swapl (&stuff->window, n);
return ProcRRXineramaGetState(client); return ProcRRXineramaGetState(client);
} }
@ -361,6 +368,7 @@ SProcRRXineramaGetScreenCount(ClientPtr client)
register int n; register int n;
swaps (&stuff->length, n); swaps (&stuff->length, n);
REQUEST_SIZE_MATCH(xPanoramiXGetScreenCountReq); REQUEST_SIZE_MATCH(xPanoramiXGetScreenCountReq);
swapl (&stuff->window, n);
return ProcRRXineramaGetScreenCount(client); return ProcRRXineramaGetScreenCount(client);
} }
@ -371,6 +379,8 @@ SProcRRXineramaGetScreenSize(ClientPtr client)
register int n; register int n;
swaps (&stuff->length, n); swaps (&stuff->length, n);
REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq); REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq);
swapl (&stuff->window, n);
swapl (&stuff->screen, n);
return ProcRRXineramaGetScreenSize(client); return ProcRRXineramaGetScreenSize(client);
} }