diff --git a/Xext/panoramiXprocs.c b/Xext/panoramiXprocs.c index 77a2384c4..2bf94a998 100644 --- a/Xext/panoramiXprocs.c +++ b/Xext/panoramiXprocs.c @@ -1069,6 +1069,7 @@ int PanoramiXCopyArea(ClientPtr client) DrawablePtr pDst = NULL, pSrc = NULL; GCPtr pGC = NULL; RegionPtr pRgn[MAXSCREENS]; + int rc; FOR_NSCREENS_BACKWARD(j) { stuff->dstDrawable = dst->info[j].id; @@ -1085,8 +1086,11 @@ int PanoramiXCopyArea(ClientPtr client) VALIDATE_DRAWABLE_AND_GC(stuff->dstDrawable, pDst, pGC, client); if (stuff->dstDrawable != stuff->srcDrawable) { - SECURITY_VERIFY_DRAWABLE(pSrc, stuff->srcDrawable, client, - DixReadAccess); + rc = dixLookupDrawable(&pSrc, stuff->srcDrawable, client, 0, + DixReadAccess); + if (rc != Success) + return rc; + if ((pDst->pScreen != pSrc->pScreen) || (pDst->depth != pSrc->depth)) { client->errorValue = stuff->dstDrawable; @@ -1137,7 +1141,7 @@ int PanoramiXCopyArea(ClientPtr client) int PanoramiXCopyPlane(ClientPtr client) { - int j, srcx, srcy, dstx, dsty; + int j, srcx, srcy, dstx, dsty, rc; PanoramiXRes *gc, *src, *dst; Bool srcIsRoot = FALSE; Bool dstIsRoot = FALSE; @@ -1191,8 +1195,11 @@ int PanoramiXCopyPlane(ClientPtr client) VALIDATE_DRAWABLE_AND_GC(stuff->dstDrawable, pdstDraw, pGC, client); if (stuff->dstDrawable != stuff->srcDrawable) { - SECURITY_VERIFY_DRAWABLE(psrcDraw, stuff->srcDrawable, client, - DixReadAccess); + rc = dixLookupDrawable(&psrcDraw, stuff->srcDrawable, client, 0, + DixReadAccess); + if (rc != Success) + return rc; + if (pdstDraw->pScreen != psrcDraw->pScreen) { client->errorValue = stuff->dstDrawable; return (BadMatch); diff --git a/damageext/damageext.c b/damageext/damageext.c index c8f28e953..6083693a4 100755 --- a/damageext/damageext.c +++ b/damageext/damageext.c @@ -173,13 +173,17 @@ ProcDamageCreate (ClientPtr client) DamageExtPtr pDamageExt; DamageReportLevel level; RegionPtr pRegion; + int rc; REQUEST(xDamageCreateReq); REQUEST_SIZE_MATCH(xDamageCreateReq); LEGAL_NEW_RESOURCE(stuff->damage, client); - SECURITY_VERIFY_DRAWABLE (pDrawable, stuff->drawable, client, - DixReadAccess); + rc = dixLookupDrawable(&pDrawable, stuff->drawable, client, 0, + DixReadAccess); + if (rc != Success) + return rc; + switch (stuff->level) { case XDamageReportRawRectangles: level = DamageReportRawRegion; diff --git a/dix/dispatch.c b/dix/dispatch.c index a3de07fed..8134cd5a5 100644 --- a/dix/dispatch.c +++ b/dix/dispatch.c @@ -1597,17 +1597,19 @@ ProcFreePixmap(register ClientPtr client) int ProcCreateGC(register ClientPtr client) { - int error; + int error, rc; GC *pGC; - register DrawablePtr pDraw; + DrawablePtr pDraw; unsigned len; REQUEST(xCreateGCReq); REQUEST_AT_LEAST_SIZE(xCreateGCReq); client->errorValue = stuff->gc; LEGAL_NEW_RESOURCE(stuff->gc, client); - SECURITY_VERIFY_DRAWABLE (pDraw, stuff->drawable, client, - DixReadAccess); + rc = dixLookupDrawable(&pDraw, stuff->drawable, client, 0, DixReadAccess); + if (rc != Success) + return rc; + len = client->req_len - (sizeof(xCreateGCReq) >> 2); if (len != Ones(stuff->mask)) return BadLength; @@ -1766,18 +1768,21 @@ int ProcCopyArea(register ClientPtr client) { register DrawablePtr pDst; - register DrawablePtr pSrc; + DrawablePtr pSrc; register GC *pGC; REQUEST(xCopyAreaReq); RegionPtr pRgn; + int rc; REQUEST_SIZE_MATCH(xCopyAreaReq); VALIDATE_DRAWABLE_AND_GC(stuff->dstDrawable, pDst, pGC, client); if (stuff->dstDrawable != stuff->srcDrawable) { - SECURITY_VERIFY_DRAWABLE(pSrc, stuff->srcDrawable, client, + rc = dixLookupDrawable(&pSrc, stuff->srcDrawable, client, 0, DixReadAccess); + if (rc != Success) + return rc; if ((pDst->pScreen != pSrc->pScreen) || (pDst->depth != pSrc->depth)) { client->errorValue = stuff->dstDrawable; @@ -1806,18 +1811,22 @@ ProcCopyArea(register ClientPtr client) int ProcCopyPlane(register ClientPtr client) { - register DrawablePtr psrcDraw, pdstDraw; + DrawablePtr psrcDraw, pdstDraw; register GC *pGC; REQUEST(xCopyPlaneReq); RegionPtr pRgn; + int rc; REQUEST_SIZE_MATCH(xCopyPlaneReq); VALIDATE_DRAWABLE_AND_GC(stuff->dstDrawable, pdstDraw, pGC, client); if (stuff->dstDrawable != stuff->srcDrawable) { - SECURITY_VERIFY_DRAWABLE(psrcDraw, stuff->srcDrawable, client, - DixReadAccess); + rc = dixLookupDrawable(&psrcDraw, stuff->srcDrawable, client, 0, + DixReadAccess); + if (rc != Success) + return rc; + if (pdstDraw->pScreen != psrcDraw->pScreen) { client->errorValue = stuff->dstDrawable; @@ -2142,8 +2151,8 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable, int x, int y, int width, int height, Mask planemask, xGetImageReply **im_return) { - register DrawablePtr pDraw; - int nlines, linesPerBuf; + DrawablePtr pDraw; + int nlines, linesPerBuf, rc; register int linesDone; long widthBytesLine, length; Mask plane = 0; @@ -2156,7 +2165,10 @@ DoGetImage(register ClientPtr client, int format, Drawable drawable, client->errorValue = format; return(BadValue); } - SECURITY_VERIFY_DRAWABLE(pDraw, drawable, client, DixReadAccess); + rc = dixLookupDrawable(&pDraw, drawable, client, 0, DixReadAccess); + if (rc != Success) + return rc; + if(pDraw->type == DRAWABLE_WINDOW) { if( /* check for being viewable */ diff --git a/randr/rrscreen.c b/randr/rrscreen.c index b4004a31f..3b9263bc4 100644 --- a/randr/rrscreen.c +++ b/randr/rrscreen.c @@ -703,7 +703,7 @@ ProcRRSetScreenConfig (ClientPtr client) REQUEST(xRRSetScreenConfigReq); xRRSetScreenConfigReply rep; DrawablePtr pDraw; - int n; + int n, rc; ScreenPtr pScreen; rrScrPrivPtr pScrPriv; TimeStamp configTime; @@ -730,8 +730,9 @@ ProcRRSetScreenConfig (ClientPtr client) has_rate = FALSE; } - SECURITY_VERIFY_DRAWABLE(pDraw, stuff->drawable, client, - DixWriteAccess); + rc = dixLookupDrawable(&pDraw, stuff->drawable, client, 0, DixWriteAccess); + if (rc != Success) + return rc; pScreen = pDraw->pScreen; diff --git a/render/render.c b/render/render.c index 51a3fa69a..126d08daf 100644 --- a/render/render.c +++ b/render/render.c @@ -614,15 +614,17 @@ ProcRenderCreatePicture (ClientPtr client) PicturePtr pPicture; DrawablePtr pDrawable; PictFormatPtr pFormat; - int len; - int error; + int len, error, rc; REQUEST(xRenderCreatePictureReq); REQUEST_AT_LEAST_SIZE(xRenderCreatePictureReq); LEGAL_NEW_RESOURCE(stuff->pid, client); - SECURITY_VERIFY_DRAWABLE(pDrawable, stuff->drawable, client, - DixWriteAccess); + rc = dixLookupDrawable(&pDrawable, stuff->drawable, client, 0, + DixWriteAccess); + if (rc != Success) + return rc; + pFormat = (PictFormatPtr) SecurityLookupIDByType (client, stuff->format, PictFormatType, @@ -1687,14 +1689,15 @@ ProcRenderQueryFilters (ClientPtr client) int nnames; ScreenPtr pScreen; PictureScreenPtr ps; - int i, j; - int len; - int total_bytes; + int i, j, len, total_bytes, rc; INT16 *aliases; char *names; REQUEST_SIZE_MATCH(xRenderQueryFiltersReq); - SECURITY_VERIFY_DRAWABLE(pDrawable, stuff->drawable, client, DixReadAccess); + rc = dixLookupDrawable(&pDrawable, stuff->drawable, client, 0, + DixReadAccess); + if (rc != Success) + return rc; pScreen = pDrawable->pScreen; nbytesName = 0;