diff --git a/Xext/shm.c b/Xext/shm.c index 7660250a2..4e5b74984 100644 --- a/Xext/shm.c +++ b/Xext/shm.c @@ -373,12 +373,15 @@ shm_access(ClientPtr client, SHMPERM_TYPE * perm, int readonly) static int ProcShmAttach(ClientPtr client) { + REQUEST(xShmAttachReq); + REQUEST_SIZE_MATCH(xShmAttachReq); + + if (!client->local) + return BadRequest; + SHMSTAT_TYPE buf; ShmDescPtr shmdesc; - REQUEST(xShmAttachReq); - - REQUEST_SIZE_MATCH(xShmAttachReq); LEGAL_NEW_RESOURCE(stuff->shmseg, client); if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) { client->errorValue = stuff->readOnly; @@ -455,11 +458,14 @@ ShmDetachSegment(void *value, /* must conform to DeleteType */ static int ProcShmDetach(ClientPtr client) { + REQUEST(xShmDetachReq); + REQUEST_SIZE_MATCH(xShmDetachReq); + + if (!client->local) + return BadRequest; + ShmDescPtr shmdesc; - REQUEST(xShmDetachReq); - - REQUEST_SIZE_MATCH(xShmDetachReq); VERIFY_SHMSEG(stuff->shmseg, shmdesc, client); FreeResource(stuff->shmseg, X11_RESTYPE_NONE); return Success; @@ -733,6 +739,9 @@ ProcShmPutImage(ClientPtr client) REQUEST(xShmPutImageReq); REQUEST_SIZE_MATCH(xShmPutImageReq); + if (!client->local) + return BadRequest; + #ifdef PANORAMIX int j, result, orig_x, orig_y; PanoramiXRes *draw, *gc; @@ -782,6 +791,9 @@ ProcShmGetImage(ClientPtr client) REQUEST(xShmGetImageReq); REQUEST_SIZE_MATCH(xShmGetImageReq); + if (!client->local) + return BadRequest; + #ifdef PANORAMIX PanoramiXRes *draw; DrawablePtr *drawables; @@ -929,6 +941,9 @@ ProcShmCreatePixmap(ClientPtr client) REQUEST(xShmCreatePixmapReq); REQUEST_SIZE_MATCH(xShmCreatePixmapReq); + if (!client->local) + return BadRequest; + #ifdef PANORAMIX if (noPanoramiXExtension) return ShmCreatePixmap(client, stuff); @@ -1156,12 +1171,16 @@ ShmBusfaultNotify(void *context) static int ProcShmAttachFd(ClientPtr client) { + REQUEST(xShmAttachFdReq); + REQUEST_SIZE_MATCH(xShmAttachFdReq); + + if (!client->local) + return BadRequest; + int fd; ShmDescPtr shmdesc; - REQUEST(xShmAttachFdReq); struct stat statb; - REQUEST_SIZE_MATCH(xShmAttachFdReq); LEGAL_NEW_RESOURCE(stuff->shmseg, client); if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) { client->errorValue = stuff->readOnly; @@ -1272,9 +1291,14 @@ shm_tmpfile(void) static int ProcShmCreateSegment(ClientPtr client) { + REQUEST(xShmCreateSegmentReq); + REQUEST_SIZE_MATCH(xShmCreateSegmentReq); + + if (!client->local) + return BadRequest; + int fd; ShmDescPtr shmdesc; - REQUEST(xShmCreateSegmentReq); xShmCreateSegmentReply rep = { .type = X_Reply, .nfd = 1, @@ -1282,7 +1306,6 @@ ProcShmCreateSegment(ClientPtr client) .length = 0, }; - REQUEST_SIZE_MATCH(xShmCreateSegmentReq); LEGAL_NEW_RESOURCE(stuff->shmseg, client); if ((stuff->readOnly != xTrue) && (stuff->readOnly != xFalse)) { client->errorValue = stuff->readOnly; @@ -1347,13 +1370,9 @@ ProcShmDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data == X_ShmQueryVersion) - return ProcShmQueryVersion(client); - - if (!client->local) - return BadRequest; - switch (stuff->data) { + case X_ShmQueryVersion: + return ProcShmQueryVersion(client); case X_ShmAttach: return ProcShmAttach(client); case X_ShmDetach: @@ -1482,13 +1501,9 @@ SProcShmDispatch(ClientPtr client) { REQUEST(xReq); - if (stuff->data == X_ShmQueryVersion) - return ProcShmQueryVersion(client); - - if (!client->local) - return BadRequest; - switch (stuff->data) { + case X_ShmQueryVersion: + return ProcShmQueryVersion(client); case X_ShmAttach: return SProcShmAttach(client); case X_ShmDetach: