frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

VERIFY_PICTURE always returns BadPicture. Don't bother specifying. 

Same goes for VERIFY_ALPHA, VERIFY_XIN_PICTURE, and VERIFY_XIN_ALPHA.

Signed-off-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Jamey Sharp 2010-05-06 11:00:38 -07:00 committed by Keith Packard
parent 35761d5f81
commit c677fc611b
4 changed files with 53 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/dmx/dmxpict.c
View File

@ -622,8 +622,7 @@ static int dmxProcRenderSetPictureTransform(ClientPtr client)
REQUEST(xRenderSetPictureTransformReq); REQUEST(xRenderSetPictureTransformReq);
REQUEST_SIZE_MATCH(xRenderSetPictureTransformReq); REQUEST_SIZE_MATCH(xRenderSetPictureTransformReq);
VERIFY_PICTURE(pPicture, stuff->picture, client, DixWriteAccess, VERIFY_PICTURE(pPicture, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
/* For the following to work with PanoramiX, it assumes that Render /* For the following to work with PanoramiX, it assumes that Render
* wraps the ProcRenderVector after dmxRenderInit has been called. * wraps the ProcRenderVector after dmxRenderInit has been called.
@ -663,8 +662,7 @@ static int dmxProcRenderSetPictureFilter(ClientPtr client)
REQUEST(xRenderSetPictureFilterReq); REQUEST(xRenderSetPictureFilterReq);
REQUEST_AT_LEAST_SIZE(xRenderSetPictureFilterReq); REQUEST_AT_LEAST_SIZE(xRenderSetPictureFilterReq);
VERIFY_PICTURE(pPicture, stuff->picture, client, DixWriteAccess, VERIFY_PICTURE(pPicture, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
/* For the following to work with PanoramiX, it assumes that Render /* For the following to work with PanoramiX, it assumes that Render
* wraps the ProcRenderVector after dmxRenderInit has been called. * wraps the ProcRenderVector after dmxRenderInit has been called.

8
render/picturestr.h
View File

@ -408,18 +408,18 @@ extern _X_EXPORT RESTYPE GlyphSetType;
#define GetPictureWindow(w) ((PicturePtr)dixLookupPrivate(&(w)->devPrivates, PictureWindowPrivateKey)) #define GetPictureWindow(w) ((PicturePtr)dixLookupPrivate(&(w)->devPrivates, PictureWindowPrivateKey))
#define SetPictureWindow(w,p) dixSetPrivate(&(w)->devPrivates, PictureWindowPrivateKey, p) #define SetPictureWindow(w,p) dixSetPrivate(&(w)->devPrivates, PictureWindowPrivateKey, p)
#define VERIFY_PICTURE(pPicture, pid, client, mode, err) {\ #define VERIFY_PICTURE(pPicture, pid, client, mode) {\
int rc = dixLookupResourceByType((pointer)&(pPicture), pid,\ int rc = dixLookupResourceByType((pointer)&(pPicture), pid,\
PictureType, client, mode);\ PictureType, client, mode);\
if (rc != Success)\ if (rc != Success)\
return (rc == BadValue) ? err : rc;\ return (rc == BadValue) ? RenderErrBase + BadPicture : rc;\
} }
#define VERIFY_ALPHA(pPicture, pid, client, mode, err) {\ #define VERIFY_ALPHA(pPicture, pid, client, mode) {\
if (pid == None) \ if (pid == None) \
pPicture = 0; \ pPicture = 0; \
else { \ else { \
VERIFY_PICTURE(pPicture, pid, client, mode, err); \ VERIFY_PICTURE(pPicture, pid, client, mode); \
} \ } \
} \ } \

131
render/render.c
View File

@ -631,8 +631,7 @@ ProcRenderChangePicture (ClientPtr client)
int len; int len;
REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq); REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq);
VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess, VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess);
RenderErrBase + BadPicture);
len = client->req_len - bytes_to_int32(sizeof(xRenderChangePictureReq)); len = client->req_len - bytes_to_int32(sizeof(xRenderChangePictureReq));
if (Ones(stuff->mask) != len) if (Ones(stuff->mask) != len)
@ -651,8 +650,7 @@ ProcRenderSetPictureClipRectangles (ClientPtr client)
int result; int result;
REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq); REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq);
VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess, VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess);
RenderErrBase + BadPicture);
if (!pPicture->pDrawable) if (!pPicture->pDrawable)
return BadDrawable; return BadDrawable;
@ -677,8 +675,7 @@ ProcRenderFreePicture (ClientPtr client)
REQUEST_SIZE_MATCH(xRenderFreePictureReq); REQUEST_SIZE_MATCH(xRenderFreePictureReq);
VERIFY_PICTURE (pPicture, stuff->picture, client, DixDestroyAccess, VERIFY_PICTURE (pPicture, stuff->picture, client, DixDestroyAccess);
RenderErrBase + BadPicture);
FreeResource (stuff->picture, RT_NONE); FreeResource (stuff->picture, RT_NONE);
return(client->noClientException); return(client->noClientException);
} }
@ -709,14 +706,11 @@ ProcRenderComposite (ClientPtr client)
client->errorValue = stuff->op; client->errorValue = stuff->op;
return BadValue; return BadValue;
} }
VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess, VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess);
RenderErrBase + BadPicture);
if (!pDst->pDrawable) if (!pDst->pDrawable)
return BadDrawable; return BadDrawable;
VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess, VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_ALPHA (pMask, stuff->mask, client, DixReadAccess);
VERIFY_ALPHA (pMask, stuff->mask, client, DixReadAccess,
RenderErrBase + BadPicture);
if ((pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen) || if ((pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen) ||
(pMask && pMask->pDrawable && pDst->pDrawable->pScreen != pMask->pDrawable->pScreen)) (pMask && pMask->pDrawable && pDst->pDrawable->pScreen != pMask->pDrawable->pScreen))
return BadMatch; return BadMatch;
@ -755,10 +749,8 @@ ProcRenderTrapezoids (ClientPtr client)
client->errorValue = stuff->op; client->errorValue = stuff->op;
return BadValue; return BadValue;
} }
VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess, VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess);
VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
if (!pDst->pDrawable) if (!pDst->pDrawable)
return BadDrawable; return BadDrawable;
if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen) if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen)
@ -797,10 +789,8 @@ ProcRenderTriangles (ClientPtr client)
client->errorValue = stuff->op; client->errorValue = stuff->op;
return BadValue; return BadValue;
} }
VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess, VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess);
VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
if (!pDst->pDrawable) if (!pDst->pDrawable)
return BadDrawable; return BadDrawable;
if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen) if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen)
@ -839,10 +829,8 @@ ProcRenderTriStrip (ClientPtr client)
client->errorValue = stuff->op; client->errorValue = stuff->op;
return BadValue; return BadValue;
} }
VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess, VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess);
VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
if (!pDst->pDrawable) if (!pDst->pDrawable)
return BadDrawable; return BadDrawable;
if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen) if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen)
@ -881,10 +869,8 @@ ProcRenderTriFan (ClientPtr client)
client->errorValue = stuff->op; client->errorValue = stuff->op;
return BadValue; return BadValue;
} }
VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess, VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess);
VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
if (!pDst->pDrawable) if (!pDst->pDrawable)
return BadDrawable; return BadDrawable;
if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen) if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen)
@ -1301,10 +1287,8 @@ ProcRenderCompositeGlyphs (ClientPtr client)
client->errorValue = stuff->op; client->errorValue = stuff->op;
return BadValue; return BadValue;
} }
VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess, VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess);
VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
if (!pDst->pDrawable) if (!pDst->pDrawable)
return BadDrawable; return BadDrawable;
if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen) if (pSrc->pDrawable && pSrc->pDrawable->pScreen != pDst->pDrawable->pScreen)
@ -1458,8 +1442,7 @@ ProcRenderFillRectangles (ClientPtr client)
client->errorValue = stuff->op; client->errorValue = stuff->op;
return BadValue; return BadValue;
} }
VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess, VERIFY_PICTURE (pDst, stuff->dst, client, DixWriteAccess);
RenderErrBase + BadPicture);
if (!pDst->pDrawable) if (!pDst->pDrawable)
return BadDrawable; return BadDrawable;
@ -1524,8 +1507,7 @@ ProcRenderCreateCursor (ClientPtr client)
REQUEST_SIZE_MATCH (xRenderCreateCursorReq); REQUEST_SIZE_MATCH (xRenderCreateCursorReq);
LEGAL_NEW_RESOURCE(stuff->cid, client); LEGAL_NEW_RESOURCE(stuff->cid, client);
VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess, VERIFY_PICTURE (pSrc, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture);
if (!pSrc->pDrawable) if (!pSrc->pDrawable)
return BadDrawable; return BadDrawable;
pScreen = pSrc->pDrawable->pScreen; pScreen = pSrc->pDrawable->pScreen;
@ -1711,8 +1693,7 @@ ProcRenderSetPictureTransform (ClientPtr client)
int result; int result;
REQUEST_SIZE_MATCH(xRenderSetPictureTransformReq); REQUEST_SIZE_MATCH(xRenderSetPictureTransformReq);
VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess, VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess);
RenderErrBase + BadPicture);
result = SetPictureTransform (pPicture, (PictTransform *) &stuff->transform); result = SetPictureTransform (pPicture, (PictTransform *) &stuff->transform);
if (client->noClientException != Success) if (client->noClientException != Success)
return(client->noClientException); return(client->noClientException);
@ -1841,8 +1822,7 @@ ProcRenderSetPictureFilter (ClientPtr client)
char *name; char *name;
REQUEST_AT_LEAST_SIZE (xRenderSetPictureFilterReq); REQUEST_AT_LEAST_SIZE (xRenderSetPictureFilterReq);
VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess, VERIFY_PICTURE (pPicture, stuff->picture, client, DixSetAttrAccess);
RenderErrBase + BadPicture);
name = (char *) (stuff + 1); name = (char *) (stuff + 1);
params = (xFixed *) (name + pad_to_int32(stuff->nbytes)); params = (xFixed *) (name + pad_to_int32(stuff->nbytes));
nparams = ((xFixed *) stuff + client->req_len) - params; nparams = ((xFixed *) stuff + client->req_len) - params;
@ -1903,8 +1883,7 @@ ProcRenderAddTraps (ClientPtr client)
REQUEST(xRenderAddTrapsReq); REQUEST(xRenderAddTrapsReq);
REQUEST_AT_LEAST_SIZE(xRenderAddTrapsReq); REQUEST_AT_LEAST_SIZE(xRenderAddTrapsReq);
VERIFY_PICTURE (pPicture, stuff->picture, client, DixWriteAccess, VERIFY_PICTURE (pPicture, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
if (!pPicture->pDrawable) if (!pPicture->pDrawable)
return BadDrawable; return BadDrawable;
ntraps = (client->req_len << 2) - sizeof (xRenderAddTrapsReq); ntraps = (client->req_len << 2) - sizeof (xRenderAddTrapsReq);
@ -2659,18 +2638,18 @@ SProcRenderDispatch (ClientPtr client)
#include "panoramiX.h" #include "panoramiX.h"
#include "panoramiXsrv.h" #include "panoramiXsrv.h"
#define VERIFY_XIN_PICTURE(pPicture, pid, client, mode, err) {\ #define VERIFY_XIN_PICTURE(pPicture, pid, client, mode) {\
int rc = dixLookupResourceByType((pointer *)&(pPicture), pid,\ int rc = dixLookupResourceByType((pointer *)&(pPicture), pid,\
XRT_PICTURE, client, mode);\ XRT_PICTURE, client, mode);\
if (rc != Success)\ if (rc != Success)\
return (rc == BadValue) ? err : rc;\ return (rc == BadValue) ? RenderErrBase + BadPicture : rc;\
} }
#define VERIFY_XIN_ALPHA(pPicture, pid, client, mode, err) {\ #define VERIFY_XIN_ALPHA(pPicture, pid, client, mode) {\
if (pid == None) \ if (pid == None) \
pPicture = 0; \ pPicture = 0; \
else { \ else { \
VERIFY_XIN_PICTURE(pPicture, pid, client, mode, err); \ VERIFY_XIN_PICTURE(pPicture, pid, client, mode); \
} \ } \
} \ } \
@ -2730,8 +2709,7 @@ PanoramiXRenderChangePicture (ClientPtr client)
REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq); REQUEST_AT_LEAST_SIZE(xRenderChangePictureReq);
VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess, VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
FOR_NSCREENS_BACKWARD(j) { FOR_NSCREENS_BACKWARD(j) {
stuff->picture = pict->info[j].id; stuff->picture = pict->info[j].id;
@ -2751,8 +2729,7 @@ PanoramiXRenderSetPictureClipRectangles (ClientPtr client)
REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq); REQUEST_AT_LEAST_SIZE(xRenderSetPictureClipRectanglesReq);
VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess, VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
FOR_NSCREENS_BACKWARD(j) { FOR_NSCREENS_BACKWARD(j) {
stuff->picture = pict->info[j].id; stuff->picture = pict->info[j].id;
@ -2772,8 +2749,7 @@ PanoramiXRenderSetPictureTransform (ClientPtr client)
REQUEST_AT_LEAST_SIZE(xRenderSetPictureTransformReq); REQUEST_AT_LEAST_SIZE(xRenderSetPictureTransformReq);
VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess, VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
FOR_NSCREENS_BACKWARD(j) { FOR_NSCREENS_BACKWARD(j) {
stuff->picture = pict->info[j].id; stuff->picture = pict->info[j].id;
@ -2793,8 +2769,7 @@ PanoramiXRenderSetPictureFilter (ClientPtr client)
REQUEST_AT_LEAST_SIZE(xRenderSetPictureFilterReq); REQUEST_AT_LEAST_SIZE(xRenderSetPictureFilterReq);
VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess, VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
FOR_NSCREENS_BACKWARD(j) { FOR_NSCREENS_BACKWARD(j) {
stuff->picture = pict->info[j].id; stuff->picture = pict->info[j].id;
@ -2816,8 +2791,7 @@ PanoramiXRenderFreePicture (ClientPtr client)
client->errorValue = stuff->picture; client->errorValue = stuff->picture;
VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixDestroyAccess, VERIFY_XIN_PICTURE(pict, stuff->picture, client, DixDestroyAccess);
RenderErrBase + BadPicture);
FOR_NSCREENS_BACKWARD(j) { FOR_NSCREENS_BACKWARD(j) {
@ -2842,12 +2816,9 @@ PanoramiXRenderComposite (ClientPtr client)
REQUEST_SIZE_MATCH(xRenderCompositeReq); REQUEST_SIZE_MATCH(xRenderCompositeReq);
VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess, VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_XIN_ALPHA (msk, stuff->mask, client, DixReadAccess);
VERIFY_XIN_ALPHA (msk, stuff->mask, client, DixReadAccess, VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess);
RenderErrBase + BadPicture);
VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
orig = *stuff; orig = *stuff;
@ -2890,10 +2861,8 @@ PanoramiXRenderCompositeGlyphs (ClientPtr client)
INT16 xSrc, ySrc; INT16 xSrc, ySrc;
REQUEST_AT_LEAST_SIZE(xRenderCompositeGlyphsReq); REQUEST_AT_LEAST_SIZE(xRenderCompositeGlyphsReq);
VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess, VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess);
VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
if (client->req_len << 2 >= (sizeof (xRenderCompositeGlyphsReq) + if (client->req_len << 2 >= (sizeof (xRenderCompositeGlyphsReq) +
sizeof (xGlyphElt))) sizeof (xGlyphElt)))
@ -2933,8 +2902,7 @@ PanoramiXRenderFillRectangles (ClientPtr client)
int extra_len; int extra_len;
REQUEST_AT_LEAST_SIZE (xRenderFillRectanglesReq); REQUEST_AT_LEAST_SIZE (xRenderFillRectanglesReq);
VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess, VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess);
RenderErrBase + BadPicture);
extra_len = (client->req_len << 2) - sizeof (xRenderFillRectanglesReq); extra_len = (client->req_len << 2) - sizeof (xRenderFillRectanglesReq);
if (extra_len && if (extra_len &&
(extra = (char *) xalloc (extra_len))) (extra = (char *) xalloc (extra_len)))
@ -2980,10 +2948,8 @@ PanoramiXRenderTrapezoids(ClientPtr client)
REQUEST_AT_LEAST_SIZE (xRenderTrapezoidsReq); REQUEST_AT_LEAST_SIZE (xRenderTrapezoidsReq);
VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess, VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess);
VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
extra_len = (client->req_len << 2) - sizeof (xRenderTrapezoidsReq); extra_len = (client->req_len << 2) - sizeof (xRenderTrapezoidsReq);
@ -3042,10 +3008,8 @@ PanoramiXRenderTriangles(ClientPtr client)
REQUEST_AT_LEAST_SIZE (xRenderTrianglesReq); REQUEST_AT_LEAST_SIZE (xRenderTrianglesReq);
VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess, VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess);
VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
extra_len = (client->req_len << 2) - sizeof (xRenderTrianglesReq); extra_len = (client->req_len << 2) - sizeof (xRenderTrianglesReq);
@ -3100,10 +3064,8 @@ PanoramiXRenderTriStrip(ClientPtr client)
REQUEST_AT_LEAST_SIZE (xRenderTriStripReq); REQUEST_AT_LEAST_SIZE (xRenderTriStripReq);
VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess, VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess);
VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
extra_len = (client->req_len << 2) - sizeof (xRenderTriStripReq); extra_len = (client->req_len << 2) - sizeof (xRenderTriStripReq);
@ -3154,10 +3116,8 @@ PanoramiXRenderTriFan(ClientPtr client)
REQUEST_AT_LEAST_SIZE (xRenderTriFanReq); REQUEST_AT_LEAST_SIZE (xRenderTriFanReq);
VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess, VERIFY_XIN_PICTURE (src, stuff->src, client, DixReadAccess);
RenderErrBase + BadPicture); VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess);
VERIFY_XIN_PICTURE (dst, stuff->dst, client, DixWriteAccess,
RenderErrBase + BadPicture);
extra_len = (client->req_len << 2) - sizeof (xRenderTriFanReq); extra_len = (client->req_len << 2) - sizeof (xRenderTriFanReq);
@ -3208,8 +3168,7 @@ PanoramiXRenderAddTraps (ClientPtr client)
INT16 x_off, y_off; INT16 x_off, y_off;
REQUEST_AT_LEAST_SIZE (xRenderAddTrapsReq); REQUEST_AT_LEAST_SIZE (xRenderAddTrapsReq);
VERIFY_XIN_PICTURE (picture, stuff->picture, client, DixWriteAccess, VERIFY_XIN_PICTURE (picture, stuff->picture, client, DixWriteAccess);
RenderErrBase + BadPicture);
extra_len = (client->req_len << 2) - sizeof (xRenderAddTrapsReq); extra_len = (client->req_len << 2) - sizeof (xRenderAddTrapsReq);
if (extra_len && if (extra_len &&
(extra = (char *) xalloc (extra_len))) (extra = (char *) xalloc (extra_len)))

6
xfixes/region.c
View File

@ -270,8 +270,7 @@ ProcXFixesCreateRegionFromPicture (ClientPtr client)
REQUEST_SIZE_MATCH (xXFixesCreateRegionFromPictureReq); REQUEST_SIZE_MATCH (xXFixesCreateRegionFromPictureReq);
LEGAL_NEW_RESOURCE (stuff->region, client); LEGAL_NEW_RESOURCE (stuff->region, client);
VERIFY_PICTURE(pPicture, stuff->picture, client, DixGetAttrAccess, VERIFY_PICTURE(pPicture, stuff->picture, client, DixGetAttrAccess);
RenderErrBase + BadPicture);
switch (pPicture->clientClipType) { switch (pPicture->clientClipType) {
case CT_PIXMAP: case CT_PIXMAP:
@ -770,8 +769,7 @@ ProcXFixesSetPictureClipRegion (ClientPtr client)
REQUEST(xXFixesSetPictureClipRegionReq); REQUEST(xXFixesSetPictureClipRegionReq);
REQUEST_SIZE_MATCH (xXFixesSetPictureClipRegionReq); REQUEST_SIZE_MATCH (xXFixesSetPictureClipRegionReq);
VERIFY_PICTURE(pPicture, stuff->picture, client, DixSetAttrAccess, VERIFY_PICTURE(pPicture, stuff->picture, client, DixSetAttrAccess);
RenderErrBase + BadPicture);
pScreen = pPicture->pDrawable->pScreen; pScreen = pPicture->pDrawable->pScreen;
ps = GetPictureScreen (pScreen); ps = GetPictureScreen (pScreen);
VERIFY_REGION_OR_NONE(pRegion, stuff->region, client, DixReadAccess); VERIFY_REGION_OR_NONE(pRegion, stuff->region, client, DixReadAccess);