frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

panoramix: protect against allocaton failure 

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult 2025-02-24 12:54:30 +01:00
parent 62ac324b10
commit e479496802
1 changed files with 25 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
Xext/panoramiXprocs.c
View File

@ -1387,7 +1387,6 @@ PanoramiXPolyPoint(ClientPtr client)
{ {
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
int result, npoint, j; int result, npoint, j;
xPoint *origPts;
Bool isRoot; Bool isRoot;
REQUEST(xPolyPointReq); REQUEST(xPolyPointReq);
@ -1410,7 +1409,10 @@ PanoramiXPolyPoint(ClientPtr client)
isRoot = (draw->type == XRT_WINDOW) && draw->u.win.root; isRoot = (draw->type == XRT_WINDOW) && draw->u.win.root;
npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyPointReq)); npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyPointReq));
if (npoint > 0) { if (npoint > 0) {
origPts = calloc(npoint, sizeof(xPoint)); xPoint *origPts = calloc(npoint, sizeof(xPoint));
if (!origPts)
return BadAlloc;
memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint)); memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {
@ -1452,7 +1454,6 @@ PanoramiXPolyLine(ClientPtr client)
{ {
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
int result, npoint, j; int result, npoint, j;
xPoint *origPts;
Bool isRoot; Bool isRoot;
REQUEST(xPolyLineReq); REQUEST(xPolyLineReq);
@ -1475,7 +1476,9 @@ PanoramiXPolyLine(ClientPtr client)
isRoot = IS_ROOT_DRAWABLE(draw); isRoot = IS_ROOT_DRAWABLE(draw);
npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyLineReq)); npoint = bytes_to_int32((client->req_len << 2) - sizeof(xPolyLineReq));
if (npoint > 0) { if (npoint > 0) {
origPts = calloc(npoint, sizeof(xPoint)); xPoint *origPts = calloc(npoint, sizeof(xPoint));
if (!origPts)
return BadAlloc;
memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint)); memcpy((char *) origPts, (char *) &stuff[1], npoint * sizeof(xPoint));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {
@ -1517,7 +1520,6 @@ PanoramiXPolySegment(ClientPtr client)
{ {
int result, nsegs, i, j; int result, nsegs, i, j;
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
xSegment *origSegs;
Bool isRoot; Bool isRoot;
REQUEST(xPolySegmentReq); REQUEST(xPolySegmentReq);
@ -1544,7 +1546,9 @@ PanoramiXPolySegment(ClientPtr client)
return BadLength; return BadLength;
nsegs >>= 3; nsegs >>= 3;
if (nsegs > 0) { if (nsegs > 0) {
origSegs = calloc(nsegs, sizeof(xSegment)); xSegment *origSegs = calloc(nsegs, sizeof(xSegment));
if (!origSegs)
return BadAlloc;
memcpy((char *) origSegs, (char *) &stuff[1], nsegs * sizeof(xSegment)); memcpy((char *) origSegs, (char *) &stuff[1], nsegs * sizeof(xSegment));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {
@ -1586,7 +1590,6 @@ PanoramiXPolyRectangle(ClientPtr client)
int result, nrects, i, j; int result, nrects, i, j;
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
Bool isRoot; Bool isRoot;
xRectangle *origRecs;
REQUEST(xPolyRectangleReq); REQUEST(xPolyRectangleReq);
@ -1612,7 +1615,9 @@ PanoramiXPolyRectangle(ClientPtr client)
return BadLength; return BadLength;
nrects >>= 3; nrects >>= 3;
if (nrects > 0) { if (nrects > 0) {
origRecs = calloc(nrects, sizeof(xRectangle)); xRectangle *origRecs = calloc(nrects, sizeof(xRectangle));
if (!origRecs)
return BadAlloc;
memcpy((char *) origRecs, (char *) &stuff[1], memcpy((char *) origRecs, (char *) &stuff[1],
nrects * sizeof(xRectangle)); nrects * sizeof(xRectangle));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {
@ -1653,7 +1658,6 @@ PanoramiXPolyArc(ClientPtr client)
int result, narcs, i, j; int result, narcs, i, j;
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
Bool isRoot; Bool isRoot;
xArc *origArcs;
REQUEST(xPolyArcReq); REQUEST(xPolyArcReq);
@ -1679,7 +1683,9 @@ PanoramiXPolyArc(ClientPtr client)
return BadLength; return BadLength;
narcs /= sizeof(xArc); narcs /= sizeof(xArc);
if (narcs > 0) { if (narcs > 0) {
origArcs = calloc(narcs, sizeof(xArc)); xArc *origArcs = calloc(narcs, sizeof(xArc));
if (!origArcs)
return BadAlloc;
memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc)); memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {
@ -1718,7 +1724,6 @@ PanoramiXFillPoly(ClientPtr client)
int result, count, j; int result, count, j;
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
Bool isRoot; Bool isRoot;
DDXPointPtr locPts;
REQUEST(xFillPolyReq); REQUEST(xFillPolyReq);
@ -1741,7 +1746,9 @@ PanoramiXFillPoly(ClientPtr client)
count = bytes_to_int32((client->req_len << 2) - sizeof(xFillPolyReq)); count = bytes_to_int32((client->req_len << 2) - sizeof(xFillPolyReq));
if (count > 0) { if (count > 0) {
locPts = calloc(count, sizeof(DDXPointRec)); DDXPointPtr locPts = calloc(count, sizeof(DDXPointRec));
if (!locPts)
return BadAlloc;
memcpy((char *) locPts, (char *) &stuff[1], memcpy((char *) locPts, (char *) &stuff[1],
count * sizeof(DDXPointRec)); count * sizeof(DDXPointRec));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {
@ -1784,8 +1791,6 @@ PanoramiXPolyFillRectangle(ClientPtr client)
int result, things, i, j; int result, things, i, j;
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
Bool isRoot; Bool isRoot;
xRectangle *origRects;
REQUEST(xPolyFillRectangleReq); REQUEST(xPolyFillRectangleReq);
REQUEST_AT_LEAST_SIZE(xPolyFillRectangleReq); REQUEST_AT_LEAST_SIZE(xPolyFillRectangleReq);
@ -1810,7 +1815,9 @@ PanoramiXPolyFillRectangle(ClientPtr client)
return BadLength; return BadLength;
things >>= 3; things >>= 3;
if (things > 0) { if (things > 0) {
origRects = calloc(things, sizeof(xRectangle)); xRectangle *origRects = calloc(things, sizeof(xRectangle));
if (!origRects)
return BadAlloc;
memcpy((char *) origRects, (char *) &stuff[1], memcpy((char *) origRects, (char *) &stuff[1],
things * sizeof(xRectangle)); things * sizeof(xRectangle));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {
@ -1851,7 +1858,6 @@ PanoramiXPolyFillArc(ClientPtr client)
PanoramiXRes *gc, *draw; PanoramiXRes *gc, *draw;
Bool isRoot; Bool isRoot;
int result, narcs, i, j; int result, narcs, i, j;
xArc *origArcs;
REQUEST(xPolyFillArcReq); REQUEST(xPolyFillArcReq);
@ -1877,7 +1883,9 @@ PanoramiXPolyFillArc(ClientPtr client)
return BadLength; return BadLength;
narcs /= sizeof(xArc); narcs /= sizeof(xArc);
if (narcs > 0) { if (narcs > 0) {
origArcs = calloc(narcs, sizeof(xArc)); xArc *origArcs = calloc(narcs, sizeof(xArc));
if (!origArcs)
return BadAlloc;
memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc)); memcpy((char *) origArcs, (char *) &stuff[1], narcs * sizeof(xArc));
FOR_NSCREENS_FORWARD(j) { FOR_NSCREENS_FORWARD(j) {