From e479496802e0c6003d4fb141c8232d7b4376af1a Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Mon, 24 Feb 2025 12:54:30 +0100
Subject: [PATCH] panoramix: protect against allocaton failure

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
---
 Xext/panoramiXprocs.c | 42 +++++++++++++++++++++++++-----------------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/Xext/panoramiXprocs.c b/Xext/panoramiXprocs.c
index 2cff60990..3119a0be1 100644
--- a/Xext/panoramiXprocs.c
+++ b/Xext/panoramiXprocs.c
@@ -1387,7 +1387,6 @@ PanoramiXPolyPoint(ClientPtr client)
 {
     PanoramiXRes *gc, *draw;
     int result, npoint, j;
-    xPoint *origPts;
     Bool isRoot;
 
     REQUEST(xPolyPointReq);
@@ -1410,7 +1409,10 @@ PanoramiXPolyPoint(ClientPtr client)
     isRoot = (draw->type == XRT_WINDOW) && draw->u.win.root;
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyPointReq));
     if (npoint > 0) {
-        origPts = calloc(npoint, sizeof(xPoint));
+        xPoint *origPts = calloc(npoint, sizeof(xPoint));
+        if (!origPts)
+            return BadAlloc;
+
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1452,7 +1454,6 @@ PanoramiXPolyLine(ClientPtr client)
 {
     PanoramiXRes *gc, *draw;
     int result, npoint, j;
-    xPoint *origPts;
     Bool isRoot;
 
     REQUEST(xPolyLineReq);
@@ -1475,7 +1476,9 @@ PanoramiXPolyLine(ClientPtr client)
     isRoot = IS_ROOT_DRAWABLE(draw);
     npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyLineReq));
     if (npoint > 0) {
-        origPts = calloc(npoint, sizeof(xPoint));
+        xPoint *origPts = calloc(npoint, sizeof(xPoint));
+        if (!origPts)
+            return BadAlloc;
         memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1517,7 +1520,6 @@ PanoramiXPolySegment(ClientPtr client)
 {
     int result, nsegs, i, j;
     PanoramiXRes *gc, *draw;
-    xSegment *origSegs;
     Bool isRoot;
 
     REQUEST(xPolySegmentReq);
@@ -1544,7 +1546,9 @@ PanoramiXPolySegment(ClientPtr client)
         return BadLength;
     nsegs >>= 3;
     if (nsegs > 0) {
-        origSegs = calloc(nsegs, sizeof(xSegment));
+        xSegment *origSegs = calloc(nsegs, sizeof(xSegment));
+        if (!origSegs)
+            return BadAlloc;
         memcpy((char *) origSegs, (char *) &stuff[1], nsegs * sizeof(xSegment));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1586,7 +1590,6 @@ PanoramiXPolyRectangle(ClientPtr client)
     int result, nrects, i, j;
     PanoramiXRes *gc, *draw;
     Bool isRoot;
-    xRectangle *origRecs;
 
     REQUEST(xPolyRectangleReq);
 
@@ -1612,7 +1615,9 @@ PanoramiXPolyRectangle(ClientPtr client)
         return BadLength;
     nrects >>= 3;
     if (nrects > 0) {
-        origRecs = calloc(nrects, sizeof(xRectangle));
+        xRectangle *origRecs = calloc(nrects, sizeof(xRectangle));
+        if (!origRecs)
+            return BadAlloc;
         memcpy((char *) origRecs, (char *) &stuff[1],
                nrects * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1653,7 +1658,6 @@ PanoramiXPolyArc(ClientPtr client)
     int result, narcs, i, j;
     PanoramiXRes *gc, *draw;
     Bool isRoot;
-    xArc *origArcs;
 
     REQUEST(xPolyArcReq);
 
@@ -1679,7 +1683,9 @@ PanoramiXPolyArc(ClientPtr client)
         return BadLength;
     narcs /= sizeof(xArc);
     if (narcs > 0) {
-        origArcs = calloc(narcs, sizeof(xArc));
+        xArc *origArcs = calloc(narcs, sizeof(xArc));
+        if (!origArcs)
+            return BadAlloc;
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {
 
@@ -1718,7 +1724,6 @@ PanoramiXFillPoly(ClientPtr client)
     int result, count, j;
     PanoramiXRes *gc, *draw;
     Bool isRoot;
-    DDXPointPtr locPts;
 
     REQUEST(xFillPolyReq);
 
@@ -1741,7 +1746,9 @@ PanoramiXFillPoly(ClientPtr client)
 
     count = bytes_to_int32((client->req_len << 2) - sizeof(xFillPolyReq));
     if (count > 0) {
-        locPts = calloc(count, sizeof(DDXPointRec));
+        DDXPointPtr locPts = calloc(count, sizeof(DDXPointRec));
+        if (!locPts)
+            return BadAlloc;
         memcpy((char *) locPts, (char *) &stuff[1],
                count * sizeof(DDXPointRec));
         FOR_NSCREENS_FORWARD(j) {
@@ -1784,8 +1791,6 @@ PanoramiXPolyFillRectangle(ClientPtr client)
     int result, things, i, j;
     PanoramiXRes *gc, *draw;
     Bool isRoot;
-    xRectangle *origRects;
-
     REQUEST(xPolyFillRectangleReq);
 
     REQUEST_AT_LEAST_SIZE(xPolyFillRectangleReq);
@@ -1810,7 +1815,9 @@ PanoramiXPolyFillRectangle(ClientPtr client)
         return BadLength;
     things >>= 3;
     if (things > 0) {
-        origRects = calloc(things, sizeof(xRectangle));
+        xRectangle *origRects = calloc(things, sizeof(xRectangle));
+        if (!origRects)
+            return BadAlloc;
         memcpy((char *) origRects, (char *) &stuff[1],
                things * sizeof(xRectangle));
         FOR_NSCREENS_FORWARD(j) {
@@ -1851,7 +1858,6 @@ PanoramiXPolyFillArc(ClientPtr client)
     PanoramiXRes *gc, *draw;
     Bool isRoot;
     int result, narcs, i, j;
-    xArc *origArcs;
 
     REQUEST(xPolyFillArcReq);
 
@@ -1877,7 +1883,9 @@ PanoramiXPolyFillArc(ClientPtr client)
         return BadLength;
     narcs /= sizeof(xArc);
     if (narcs > 0) {
-        origArcs = calloc(narcs, sizeof(xArc));
+        xArc *origArcs = calloc(narcs, sizeof(xArc));
+        if (!origArcs)
+            return BadAlloc;
         memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
         FOR_NSCREENS_FORWARD(j) {