frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

XQuartz: Validate length in appledri before swapping 

Avoids potential memory corruption from bad requests

Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
This commit is contained in:
Jeremy Huddleston Sequoia 2014-01-01 10:47:52 -08:00
parent b3572c0d1a
commit a03f096a85
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/xquartz/xpr/appledri.c
View File

@ -406,6 +406,7 @@ SProcAppleDRIQueryDirectRenderingCapable(register ClientPtr client)
{ {
REQUEST(xAppleDRIQueryDirectRenderingCapableReq); REQUEST(xAppleDRIQueryDirectRenderingCapableReq);
swaps(&stuff->length); swaps(&stuff->length);
REQUEST_SIZE_MATCH(xAppleDRIQueryDirectRenderingCapableReq);
swapl(&stuff->screen); swapl(&stuff->screen);
return ProcAppleDRIQueryDirectRenderingCapable(client); return ProcAppleDRIQueryDirectRenderingCapable(client);
} }
@ -415,6 +416,7 @@ SProcAppleDRIAuthConnection(register ClientPtr client)
{ {
REQUEST(xAppleDRIAuthConnectionReq); REQUEST(xAppleDRIAuthConnectionReq);
swaps(&stuff->length); swaps(&stuff->length);
REQUEST_SIZE_MATCH(xAppleDRIAuthConnectionReq);
swapl(&stuff->screen); swapl(&stuff->screen);
swapl(&stuff->magic); swapl(&stuff->magic);
return ProcAppleDRIAuthConnection(client); return ProcAppleDRIAuthConnection(client);
@ -425,6 +427,7 @@ SProcAppleDRICreateSurface(register ClientPtr client)
{ {
REQUEST(xAppleDRICreateSurfaceReq); REQUEST(xAppleDRICreateSurfaceReq);
swaps(&stuff->length); swaps(&stuff->length);
REQUEST_SIZE_MATCH(xAppleDRICreateSurfaceReq);
swapl(&stuff->screen); swapl(&stuff->screen);
swapl(&stuff->drawable); swapl(&stuff->drawable);
swapl(&stuff->client_id); swapl(&stuff->client_id);
@ -436,6 +439,7 @@ SProcAppleDRIDestroySurface(register ClientPtr client)
{ {
REQUEST(xAppleDRIDestroySurfaceReq); REQUEST(xAppleDRIDestroySurfaceReq);
swaps(&stuff->length); swaps(&stuff->length);
REQUEST_SIZE_MATCH(xAppleDRIDestroySurfaceReq);
swapl(&stuff->screen); swapl(&stuff->screen);
swapl(&stuff->drawable); swapl(&stuff->drawable);
return ProcAppleDRIDestroySurface(client); return ProcAppleDRIDestroySurface(client);
@ -446,6 +450,7 @@ SProcAppleDRICreatePixmap(register ClientPtr client)
{ {
REQUEST(xAppleDRICreatePixmapReq); REQUEST(xAppleDRICreatePixmapReq);
swaps(&stuff->length); swaps(&stuff->length);
REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq);
swapl(&stuff->screen); swapl(&stuff->screen);
swapl(&stuff->drawable); swapl(&stuff->drawable);
return ProcAppleDRICreatePixmap(client); return ProcAppleDRICreatePixmap(client);
@ -456,6 +461,7 @@ SProcAppleDRIDestroyPixmap(register ClientPtr client)
{ {
REQUEST(xAppleDRIDestroyPixmapReq); REQUEST(xAppleDRIDestroyPixmapReq);
swaps(&stuff->length); swaps(&stuff->length);
REQUEST_SIZE_MATCH(xAppleDRIDestroyPixmapReq);
swapl(&stuff->drawable); swapl(&stuff->drawable);
return ProcAppleDRIDestroyPixmap(client); return ProcAppleDRIDestroyPixmap(client);
} }