Attachment #16289 for bug #50206

View | Details | Raw Unified | Return to bug 50206
Collapse All | Expand All

Lines 155-160 Link Here

(-)xc/programs/Xserver/GL/dri/xf86dri.c (+59 lines)
155		155
156	REQUEST(xXF86DRIQueryDirectRenderingCapableReq);	156	REQUEST(xXF86DRIQueryDirectRenderingCapableReq);
157	REQUEST_SIZE_MATCH(xXF86DRIQueryDirectRenderingCapableReq);	157	REQUEST_SIZE_MATCH(xXF86DRIQueryDirectRenderingCapableReq);
		158	if (stuff->screen >= screenInfo.numScreens) {
		159	client->errorValue = stuff->screen;
		160	return BadValue;
		161	}
		162
158	rep.type = X_Reply;	163	rep.type = X_Reply;
159	rep.length = 0;	164	rep.length = 0;
160	rep.sequenceNumber = client->sequence;	165	rep.sequenceNumber = client->sequence;
Lines 184-189 Link Here
184		189
185	REQUEST(xXF86DRIOpenConnectionReq);	190	REQUEST(xXF86DRIOpenConnectionReq);
186	REQUEST_SIZE_MATCH(xXF86DRIOpenConnectionReq);	191	REQUEST_SIZE_MATCH(xXF86DRIOpenConnectionReq);
		192	if (stuff->screen >= screenInfo.numScreens) {
		193	client->errorValue = stuff->screen;
		194	return BadValue;
		195	}
187		196
188	if (!DRIOpenConnection( screenInfo.screens[stuff->screen],	197	if (!DRIOpenConnection( screenInfo.screens[stuff->screen],
189	&hSAREA,	198	&hSAREA,
Lines 221-226 Link Here
221		230
222	REQUEST(xXF86DRIAuthConnectionReq);	231	REQUEST(xXF86DRIAuthConnectionReq);
223	REQUEST_SIZE_MATCH(xXF86DRIAuthConnectionReq);	232	REQUEST_SIZE_MATCH(xXF86DRIAuthConnectionReq);
		233	if (stuff->screen >= screenInfo.numScreens) {
		234	client->errorValue = stuff->screen;
		235	return BadValue;
		236	}
224		237
225	rep.type = X_Reply;	238	rep.type = X_Reply;
226	rep.length = 0;	239	rep.length = 0;
Lines 242-247 Link Here
242	{	255	{
243	REQUEST(xXF86DRICloseConnectionReq);	256	REQUEST(xXF86DRICloseConnectionReq);
244	REQUEST_SIZE_MATCH(xXF86DRICloseConnectionReq);	257	REQUEST_SIZE_MATCH(xXF86DRICloseConnectionReq);
		258	if (stuff->screen >= screenInfo.numScreens) {
		259	client->errorValue = stuff->screen;
		260	return BadValue;
		261	}
245		262
246	DRICloseConnection( screenInfo.screens[stuff->screen]);	263	DRICloseConnection( screenInfo.screens[stuff->screen]);
247		264
Lines 258-263 Link Here
258		275
259	REQUEST(xXF86DRIGetClientDriverNameReq);	276	REQUEST(xXF86DRIGetClientDriverNameReq);
260	REQUEST_SIZE_MATCH(xXF86DRIGetClientDriverNameReq);	277	REQUEST_SIZE_MATCH(xXF86DRIGetClientDriverNameReq);
		278	if (stuff->screen >= screenInfo.numScreens) {
		279	client->errorValue = stuff->screen;
		280	return BadValue;
		281	}
261		282
262	DRIGetClientDriverName( screenInfo.screens[stuff->screen],	283	DRIGetClientDriverName( screenInfo.screens[stuff->screen],
263	(int *)&rep.ddxDriverMajorVersion,	284	(int *)&rep.ddxDriverMajorVersion,
Lines 295-300 Link Here
295		316
296	REQUEST(xXF86DRICreateContextReq);	317	REQUEST(xXF86DRICreateContextReq);
297	REQUEST_SIZE_MATCH(xXF86DRICreateContextReq);	318	REQUEST_SIZE_MATCH(xXF86DRICreateContextReq);
		319	if (stuff->screen >= screenInfo.numScreens) {
		320	client->errorValue = stuff->screen;
		321	return BadValue;
		322	}
		323
298	rep.type = X_Reply;	324	rep.type = X_Reply;
299	rep.length = 0;	325	rep.length = 0;
300	rep.sequenceNumber = client->sequence;	326	rep.sequenceNumber = client->sequence;
Lines 329-334 Link Here
329	{	355	{
330	REQUEST(xXF86DRIDestroyContextReq);	356	REQUEST(xXF86DRIDestroyContextReq);
331	REQUEST_SIZE_MATCH(xXF86DRIDestroyContextReq);	357	REQUEST_SIZE_MATCH(xXF86DRIDestroyContextReq);
		358	if (stuff->screen >= screenInfo.numScreens) {
		359	client->errorValue = stuff->screen;
		360	return BadValue;
		361	}
332		362
333	if (!DRIDestroyContext( screenInfo.screens[stuff->screen],	363	if (!DRIDestroyContext( screenInfo.screens[stuff->screen],
334	stuff->context)) {	364	stuff->context)) {
Lines 348-353 Link Here
348		378
349	REQUEST(xXF86DRICreateDrawableReq);	379	REQUEST(xXF86DRICreateDrawableReq);
350	REQUEST_SIZE_MATCH(xXF86DRICreateDrawableReq);	380	REQUEST_SIZE_MATCH(xXF86DRICreateDrawableReq);
		381	if (stuff->screen >= screenInfo.numScreens) {
		382	client->errorValue = stuff->screen;
		383	return BadValue;
		384	}
		385
351	rep.type = X_Reply;	386	rep.type = X_Reply;
352	rep.length = 0;	387	rep.length = 0;
353	rep.sequenceNumber = client->sequence;	388	rep.sequenceNumber = client->sequence;
Lines 378-383 Link Here
378	REQUEST(xXF86DRIDestroyDrawableReq);	413	REQUEST(xXF86DRIDestroyDrawableReq);
379	DrawablePtr pDrawable;	414	DrawablePtr pDrawable;
380	REQUEST_SIZE_MATCH(xXF86DRIDestroyDrawableReq);	415	REQUEST_SIZE_MATCH(xXF86DRIDestroyDrawableReq);
		416	if (stuff->screen >= screenInfo.numScreens) {
		417	client->errorValue = stuff->screen;
		418	return BadValue;
		419	}
381		420
382	if (!(pDrawable = (DrawablePtr)SecurityLookupDrawable(	421	if (!(pDrawable = (DrawablePtr)SecurityLookupDrawable(
383	(Drawable)stuff->drawable,	422	(Drawable)stuff->drawable,
Lines 409-414 Link Here
409		448
410	REQUEST(xXF86DRIGetDrawableInfoReq);	449	REQUEST(xXF86DRIGetDrawableInfoReq);
411	REQUEST_SIZE_MATCH(xXF86DRIGetDrawableInfoReq);	450	REQUEST_SIZE_MATCH(xXF86DRIGetDrawableInfoReq);
		451	if (stuff->screen >= screenInfo.numScreens) {
		452	client->errorValue = stuff->screen;
		453	return BadValue;
		454	}
		455
412	rep.type = X_Reply;	456	rep.type = X_Reply;
413	rep.length = 0;	457	rep.length = 0;
414	rep.sequenceNumber = client->sequence;	458	rep.sequenceNumber = client->sequence;
Lines 483-488 Link Here
483		527
484	REQUEST(xXF86DRIGetDeviceInfoReq);	528	REQUEST(xXF86DRIGetDeviceInfoReq);
485	REQUEST_SIZE_MATCH(xXF86DRIGetDeviceInfoReq);	529	REQUEST_SIZE_MATCH(xXF86DRIGetDeviceInfoReq);
		530	if (stuff->screen >= screenInfo.numScreens) {
		531	client->errorValue = stuff->screen;
		532	return BadValue;
		533	}
		534
486	rep.type = X_Reply;	535	rep.type = X_Reply;
487	rep.length = 0;	536	rep.length = 0;
488	rep.sequenceNumber = client->sequence;	537	rep.sequenceNumber = client->sequence;
Lines 528-533 Link Here
528	DrawablePtr pDrawable;	577	DrawablePtr pDrawable;
529		578
530	REQUEST_SIZE_MATCH(xXF86DRIOpenFullScreenReq);	579	REQUEST_SIZE_MATCH(xXF86DRIOpenFullScreenReq);
		580	if (stuff->screen >= screenInfo.numScreens) {
		581	client->errorValue = stuff->screen;
		582	return BadValue;
		583	}
		584
531	rep.type = X_Reply;	585	rep.type = X_Reply;
532	rep.length = 0;	586	rep.length = 0;
533	rep.sequenceNumber = client->sequence;	587	rep.sequenceNumber = client->sequence;
Lines 554-559 Link Here
554	DrawablePtr pDrawable;	608	DrawablePtr pDrawable;
555		609
556	REQUEST_SIZE_MATCH(xXF86DRICloseFullScreenReq);	610	REQUEST_SIZE_MATCH(xXF86DRICloseFullScreenReq);
		611	if (stuff->screen >= screenInfo.numScreens) {
		612	client->errorValue = stuff->screen;
		613	return BadValue;
		614	}
		615
557	rep.type = X_Reply;	616	rep.type = X_Reply;
558	rep.length = 0;	617	rep.length = 0;
559	rep.sequenceNumber = client->sequence;	618	rep.sequenceNumber = client->sequence;




    int i, p;

    screen = req->screen;
    if (screen >= screenInfo.numScreens) {
	/* The client library must send a valid screen number. */
	client->errorValue = screen;
	return BadValue;

    ClientPtr client = cl->client;
    xGLXQueryExtensionsStringReq *req = (xGLXQueryExtensionsStringReq *) pc;
    xGLXQueryExtensionsStringReply reply;
    GLuint screen;
    size_t n, length;
    const char *ptr;
    char *buf;

    /*
    ** Check if screen exists.
    */
    if (screen >= screenInfo.numScreens) {
	client->errorValue = screen;
	return BadValue;
    }

    xGLXQueryServerStringReq *req = (xGLXQueryServerStringReq *) pc;
    xGLXQueryServerStringReply reply;
    int name;
    GLuint screen;
    size_t n, length;
    const char *ptr;
    char *buf;

    /*
    ** Check if screen exists.
    */
    if (screen >= screenInfo.numScreens) {
	client->errorValue = screen;
	return BadValue;
    }

Return to bug 50206

Lines 761-767 Link Here

(-)xc/programs/Xserver/GL/glx/glxcmds.c (-5 / +5 lines)
761	int i, p;	761	int i, p;
762		762
763	screen = req->screen;	763	screen = req->screen;
764	if (screen > screenInfo.numScreens) {	764	if (screen >= screenInfo.numScreens) {
765	/* The client library must send a valid screen number. */	765	/* The client library must send a valid screen number. */
766	client->errorValue = screen;	766	client->errorValue = screen;
767	return BadValue;	767	return BadValue;
Lines 1466-1472 Link Here
1466	ClientPtr client = cl->client;	1466	ClientPtr client = cl->client;
1467	xGLXQueryExtensionsStringReq req = (xGLXQueryExtensionsStringReq ) pc;	1467	xGLXQueryExtensionsStringReq req = (xGLXQueryExtensionsStringReq ) pc;
1468	xGLXQueryExtensionsStringReply reply;	1468	xGLXQueryExtensionsStringReply reply;
1469	GLint screen;	1469	GLuint screen;
1470	size_t n, length;	1470	size_t n, length;
1471	const char *ptr;	1471	const char *ptr;
1472	char *buf;	1472	char *buf;
Lines 1475-1481 Link Here
1475	/*	1475	/*
1476	** Check if screen exists.	1476	** Check if screen exists.
1477	*/	1477	*/
1478	if ((screen < 0) \|\| (screen >= screenInfo.numScreens)) {	1478	if (screen >= screenInfo.numScreens) {
1479	client->errorValue = screen;	1479	client->errorValue = screen;
1480	return BadValue;	1480	return BadValue;
1481	}	1481	}
Lines 1511-1517 Link Here
1511	xGLXQueryServerStringReq req = (xGLXQueryServerStringReq ) pc;	1511	xGLXQueryServerStringReq req = (xGLXQueryServerStringReq ) pc;
1512	xGLXQueryServerStringReply reply;	1512	xGLXQueryServerStringReply reply;
1513	int name;	1513	int name;
1514	GLint screen;	1514	GLuint screen;
1515	size_t n, length;	1515	size_t n, length;
1516	const char *ptr;	1516	const char *ptr;
1517	char *buf;	1517	char *buf;
Lines 1521-1527 Link Here
1521	/*	1521	/*
1522	** Check if screen exists.	1522	** Check if screen exists.
1523	*/	1523	*/
1524	if ((screen < 0) \|\| (screen >= screenInfo.numScreens)) {	1524	if (screen >= screenInfo.numScreens) {
1525	client->errorValue = screen;	1525	client->errorValue = screen;
1526	return BadValue;	1526	return BadValue;
1527	}	1527	}