Attachment 16289 Details for Bug 50206

[patch] xfree86_4.1.0_glx_dri_outofbounds_index-security.diff

xfree86_4.1.0_glx_dri_integer_overflow.diff (text/plain), 5.65 KB, created by Thomas Biege on 2004-03-02 00:25:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-03-02 00:25:33 UTC

Size: 5.65 KB

patch

obsolete

>--- xc/programs/Xserver/GL/dri/xf86dri.c	29 Oct 2002 20:28:57 -0000	1.10
>+++ xc/programs/Xserver/GL/dri/xf86dri.c	13 Dec 2002 15:51:57 -0000
>@@ -155,6 +155,11 @@
> 
>     REQUEST(xXF86DRIQueryDirectRenderingCapableReq);
>     REQUEST_SIZE_MATCH(xXF86DRIQueryDirectRenderingCapableReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
>+
>     rep.type = X_Reply;
>     rep.length = 0;
>     rep.sequenceNumber = client->sequence;
>@@ -184,6 +189,10 @@
> 
>     REQUEST(xXF86DRIOpenConnectionReq);
>     REQUEST_SIZE_MATCH(xXF86DRIOpenConnectionReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
> 
>     if (!DRIOpenConnection( screenInfo.screens[stuff->screen], 
> 			    &hSAREA,
>@@ -221,6 +230,10 @@
>     
>     REQUEST(xXF86DRIAuthConnectionReq);
>     REQUEST_SIZE_MATCH(xXF86DRIAuthConnectionReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
> 
>     rep.type = X_Reply;
>     rep.length = 0;
>@@ -242,6 +255,10 @@
> {
>     REQUEST(xXF86DRICloseConnectionReq);
>     REQUEST_SIZE_MATCH(xXF86DRICloseConnectionReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
> 
>     DRICloseConnection( screenInfo.screens[stuff->screen]);
> 
>@@ -258,6 +275,10 @@
> 
>     REQUEST(xXF86DRIGetClientDriverNameReq);
>     REQUEST_SIZE_MATCH(xXF86DRIGetClientDriverNameReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
> 
>     DRIGetClientDriverName( screenInfo.screens[stuff->screen],
> 			    (int *)&rep.ddxDriverMajorVersion,
>@@ -295,6 +316,11 @@
> 
>     REQUEST(xXF86DRICreateContextReq);
>     REQUEST_SIZE_MATCH(xXF86DRICreateContextReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
>+
>     rep.type = X_Reply;
>     rep.length = 0;
>     rep.sequenceNumber = client->sequence;
>@@ -329,6 +355,10 @@
> {
>     REQUEST(xXF86DRIDestroyContextReq);
>     REQUEST_SIZE_MATCH(xXF86DRIDestroyContextReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
> 
>     if (!DRIDestroyContext( screenInfo.screens[stuff->screen],
> 			    stuff->context)) {
>@@ -348,6 +378,11 @@
> 
>     REQUEST(xXF86DRICreateDrawableReq);
>     REQUEST_SIZE_MATCH(xXF86DRICreateDrawableReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
>+
>     rep.type = X_Reply;
>     rep.length = 0;
>     rep.sequenceNumber = client->sequence;
>@@ -378,6 +413,10 @@
>     REQUEST(xXF86DRIDestroyDrawableReq);
>     DrawablePtr pDrawable;
>     REQUEST_SIZE_MATCH(xXF86DRIDestroyDrawableReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
> 
>     if (!(pDrawable = (DrawablePtr)SecurityLookupDrawable(
> 						(Drawable)stuff->drawable,
>@@ -409,6 +448,11 @@
> 
>     REQUEST(xXF86DRIGetDrawableInfoReq);
>     REQUEST_SIZE_MATCH(xXF86DRIGetDrawableInfoReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
>+
>     rep.type = X_Reply;
>     rep.length = 0;
>     rep.sequenceNumber = client->sequence;
>@@ -483,6 +527,11 @@
> 
>     REQUEST(xXF86DRIGetDeviceInfoReq);
>     REQUEST_SIZE_MATCH(xXF86DRIGetDeviceInfoReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
>+
>     rep.type = X_Reply;
>     rep.length = 0;
>     rep.sequenceNumber = client->sequence;
>@@ -528,6 +577,11 @@
>     DrawablePtr                 pDrawable;
> 
>     REQUEST_SIZE_MATCH(xXF86DRIOpenFullScreenReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
>+
>     rep.type           = X_Reply;
>     rep.length         = 0;
>     rep.sequenceNumber = client->sequence;
>@@ -554,6 +608,11 @@
>     DrawablePtr                  pDrawable;
> 
>     REQUEST_SIZE_MATCH(xXF86DRICloseFullScreenReq);
>+    if (stuff->screen >= screenInfo.numScreens) {
>+	client->errorValue = stuff->screen;
>+	return BadValue;
>+    }
>+
>     rep.type           = X_Reply;
>     rep.length         = 0;
>     rep.sequenceNumber = client->sequence;
>--- xc/programs/Xserver/GL/glx/glxcmds.c	25 Nov 2002 19:58:38 -0000	1.8
>+++ xc/programs/Xserver/GL/glx/glxcmds.c	13 Dec 2002 15:52:01 -0000
>@@ -761,7 +761,7 @@
>     int i, p;
> 
>     screen = req->screen;
>-    if (screen > screenInfo.numScreens) {
>+    if (screen >= screenInfo.numScreens) {
> 	/* The client library must send a valid screen number. */
> 	client->errorValue = screen;
> 	return BadValue;
>@@ -1466,7 +1466,7 @@
>     ClientPtr client = cl->client;
>     xGLXQueryExtensionsStringReq *req = (xGLXQueryExtensionsStringReq *) pc;
>     xGLXQueryExtensionsStringReply reply;
>-    GLint screen;
>+    GLuint screen;
>     size_t n, length;
>     const char *ptr;
>     char *buf;
>@@ -1475,7 +1475,7 @@
>     /*
>     ** Check if screen exists.
>     */
>-    if ((screen < 0) || (screen >= screenInfo.numScreens)) {
>+    if (screen >= screenInfo.numScreens) {
> 	client->errorValue = screen;
> 	return BadValue;
>     }
>@@ -1511,7 +1511,7 @@
>     xGLXQueryServerStringReq *req = (xGLXQueryServerStringReq *) pc;
>     xGLXQueryServerStringReply reply;
>     int name;
>-    GLint screen;
>+    GLuint screen;
>     size_t n, length;
>     const char *ptr;
>     char *buf;
>@@ -1521,7 +1521,7 @@
>     /*
>     ** Check if screen exists.
>     */
>-    if ((screen < 0) || (screen >= screenInfo.numScreens)) {
>+    if (screen >= screenInfo.numScreens) {
> 	client->errorValue = screen;
> 	return BadValue;
>     }

Actions: View | Diff

Attachments on bug 50206: 16289 | 16321 | 16322