mirror of
https://git.FreeBSD.org/ports.git
synced 2024-11-27 00:57:50 +00:00
Update x11-servers/xorg-server to 1.4.2 (security update).
This commit is contained in:
parent
e06dc8998c
commit
f6f6dbd0e4
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=214895
@ -6,8 +6,7 @@
|
||||
#
|
||||
|
||||
PORTNAME= xorg-server
|
||||
PORTVERSION= 1.4
|
||||
PORTREVISION= 10
|
||||
PORTVERSION= 1.4.2
|
||||
PORTEPOCH= 1
|
||||
CATEGORIES= x11-servers
|
||||
MASTER_SITES= http://xorg.freedesktop.org/releases/individual/xserver/:fdo \
|
||||
|
@ -1,6 +1,6 @@
|
||||
MD5 (xorg/xserver/xorg-server-1.4.tar.bz2) = a06d9fe4f9f1d459ae02657f9ce64220
|
||||
SHA256 (xorg/xserver/xorg-server-1.4.tar.bz2) = 51b142df328d427143705371f139a08ff3bcd6efe0eab91f4178ca4017c0ebc2
|
||||
SIZE (xorg/xserver/xorg-server-1.4.tar.bz2) = 6179392
|
||||
MD5 (xorg/xserver/xorg-server-1.4.2.tar.bz2) = fa2915ae377f61c340a18ebef484b64b
|
||||
SHA256 (xorg/xserver/xorg-server-1.4.2.tar.bz2) = 829c66ec4c295822700067c87afae796b8e67530cc65a7b83060ea29a4ff316d
|
||||
SIZE (xorg/xserver/xorg-server-1.4.2.tar.bz2) = 6216638
|
||||
MD5 (xorg/xserver/MesaLib-7.0.1.tar.bz2) = c056abd763e899114bf745c9eedbf9ad
|
||||
SHA256 (xorg/xserver/MesaLib-7.0.1.tar.bz2) = 5190ffac157882d9129d31f262339512f4a45dcf95ccdad213760a7d54d82de7
|
||||
SIZE (xorg/xserver/MesaLib-7.0.1.tar.bz2) = 3343538
|
||||
|
@ -1,515 +0,0 @@
|
||||
diff --git Xext/EVI.c Xext/EVI.c
|
||||
index 8fe3481..13bd32a 100644
|
||||
--- Xext/EVI.c
|
||||
+++ Xext/EVI.c
|
||||
@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
#include <X11/extensions/XEVIstr.h>
|
||||
#include "EVIstruct.h"
|
||||
#include "modinit.h"
|
||||
+#include "scrnintstr.h"
|
||||
|
||||
#if 0
|
||||
static unsigned char XEVIReqCode = 0;
|
||||
@@ -87,10 +88,22 @@ ProcEVIGetVisualInfo(ClientPtr client)
|
||||
{
|
||||
REQUEST(xEVIGetVisualInfoReq);
|
||||
xEVIGetVisualInfoReply rep;
|
||||
- int n, n_conflict, n_info, sz_info, sz_conflict;
|
||||
+ int i, n, n_conflict, n_info, sz_info, sz_conflict;
|
||||
VisualID32 *conflict;
|
||||
+ unsigned int total_visuals = 0;
|
||||
xExtendedVisualInfo *eviInfo;
|
||||
int status;
|
||||
+
|
||||
+ /*
|
||||
+ * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume
|
||||
+ * here that you don't have more than 2^32 visuals over all your screens;
|
||||
+ * this seems like a safe assumption.
|
||||
+ */
|
||||
+ for (i = 0; i < screenInfo.numScreens; i++)
|
||||
+ total_visuals += screenInfo.screens[i]->numVisuals;
|
||||
+ if (stuff->n_visual > total_visuals)
|
||||
+ return BadValue;
|
||||
+
|
||||
REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
|
||||
status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
|
||||
&eviInfo, &n_info, &conflict, &n_conflict);
|
||||
diff --git Xext/cup.c Xext/cup.c
|
||||
index 6bfa278..781b9ce 100644
|
||||
--- Xext/cup.c
|
||||
+++ Xext/cup.c
|
||||
@@ -196,6 +196,9 @@ int ProcGetReservedColormapEntries(
|
||||
|
||||
REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
|
||||
|
||||
+ if (stuff->screen >= screenInfo.numScreens)
|
||||
+ return BadValue;
|
||||
+
|
||||
#ifndef HAVE_SPECIAL_DESKTOP_COLORS
|
||||
citems[CUP_BLACK_PIXEL].pixel =
|
||||
screenInfo.screens[stuff->screen]->blackPixel;
|
||||
diff --git Xext/sampleEVI.c Xext/sampleEVI.c
|
||||
index 7508aa7..b871bfd 100644
|
||||
--- Xext/sampleEVI.c
|
||||
+++ Xext/sampleEVI.c
|
||||
@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
#include <X11/extensions/XEVIstr.h>
|
||||
#include "EVIstruct.h"
|
||||
#include "scrnintstr.h"
|
||||
+
|
||||
+#if HAVE_STDINT_H
|
||||
+#include <stdint.h>
|
||||
+#elif !defined(UINT32_MAX)
|
||||
+#define UINT32_MAX 0xffffffffU
|
||||
+#endif
|
||||
+
|
||||
static int sampleGetVisualInfo(
|
||||
VisualID32 *visual,
|
||||
int n_visual,
|
||||
@@ -42,24 +49,36 @@ static int sampleGetVisualInfo(
|
||||
VisualID32 **conflict_rn,
|
||||
int *n_conflict_rn)
|
||||
{
|
||||
- int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
|
||||
+ unsigned int max_sz_evi;
|
||||
VisualID32 *temp_conflict;
|
||||
xExtendedVisualInfo *evi;
|
||||
- int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
|
||||
+ unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
|
||||
register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
|
||||
- *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
|
||||
- if (!*evi_rn)
|
||||
- return BadAlloc;
|
||||
+
|
||||
+ if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
|
||||
+ return BadAlloc;
|
||||
+ max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
|
||||
+
|
||||
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
|
||||
if (screenInfo.screens[scrI]->numVisuals > max_visuals)
|
||||
max_visuals = screenInfo.screens[scrI]->numVisuals;
|
||||
}
|
||||
+
|
||||
+ if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens
|
||||
+ * max_visuals))
|
||||
+ return BadAlloc;
|
||||
max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
|
||||
+
|
||||
+ *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
|
||||
+ if (!*evi_rn)
|
||||
+ return BadAlloc;
|
||||
+
|
||||
temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
|
||||
if (!temp_conflict) {
|
||||
xfree(*evi_rn);
|
||||
return BadAlloc;
|
||||
}
|
||||
+
|
||||
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
|
||||
for (visualI = 0; visualI < n_visual; visualI++) {
|
||||
evi[sz_evi].core_visual_id = visual[visualI];
|
||||
diff --git Xext/security.c Xext/security.c
|
||||
index ba057de..e9d48c9 100644
|
||||
--- Xext/security.c
|
||||
+++ Xext/security.c
|
||||
@@ -1563,7 +1563,7 @@ SecurityLoadPropertyAccessList(void)
|
||||
if (!SecurityPolicyFile)
|
||||
return;
|
||||
|
||||
- f = fopen(SecurityPolicyFile, "r");
|
||||
+ f = Fopen(SecurityPolicyFile, "r");
|
||||
if (!f)
|
||||
{
|
||||
ErrorF("error opening security policy file %s\n",
|
||||
@@ -1646,7 +1646,7 @@ SecurityLoadPropertyAccessList(void)
|
||||
}
|
||||
#endif /* PROPDEBUG */
|
||||
|
||||
- fclose(f);
|
||||
+ Fclose(f);
|
||||
} /* SecurityLoadPropertyAccessList */
|
||||
|
||||
|
||||
diff --git Xext/shm.c Xext/shm.c
|
||||
index ac587be..6f99e90 100644
|
||||
--- Xext/shm.c
|
||||
+++ Xext/shm.c
|
||||
@@ -711,6 +711,8 @@ ProcPanoramiXShmCreatePixmap(
|
||||
int i, j, result, rc;
|
||||
ShmDescPtr shmdesc;
|
||||
REQUEST(xShmCreatePixmapReq);
|
||||
+ unsigned int width, height, depth;
|
||||
+ unsigned long size;
|
||||
PanoramiXRes *newPix;
|
||||
|
||||
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
|
||||
@@ -724,11 +726,18 @@ ProcPanoramiXShmCreatePixmap(
|
||||
return rc;
|
||||
|
||||
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
|
||||
- if (!stuff->width || !stuff->height)
|
||||
+
|
||||
+ width = stuff->width;
|
||||
+ height = stuff->height;
|
||||
+ depth = stuff->depth;
|
||||
+ if (!width || !height || !depth)
|
||||
{
|
||||
client->errorValue = 0;
|
||||
return BadValue;
|
||||
}
|
||||
+ if (width > 32767 || height > 32767)
|
||||
+ return BadAlloc;
|
||||
+
|
||||
if (stuff->depth != 1)
|
||||
{
|
||||
pDepth = pDraw->pScreen->allowedDepths;
|
||||
@@ -738,10 +747,18 @@ ProcPanoramiXShmCreatePixmap(
|
||||
client->errorValue = stuff->depth;
|
||||
return BadValue;
|
||||
}
|
||||
+
|
||||
CreatePmap:
|
||||
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
|
||||
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
|
||||
- client);
|
||||
+ size = PixmapBytePad(width, depth) * height;
|
||||
+ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
|
||||
+ if (size < width * height)
|
||||
+ return BadAlloc;
|
||||
+ /* thankfully, offset is unsigned */
|
||||
+ if (stuff->offset + size < size)
|
||||
+ return BadAlloc;
|
||||
+ }
|
||||
+
|
||||
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
|
||||
|
||||
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
|
||||
return BadAlloc;
|
||||
@@ -1040,6 +1057,8 @@ ProcShmCreatePixmap(client)
|
||||
register int i, rc;
|
||||
ShmDescPtr shmdesc;
|
||||
REQUEST(xShmCreatePixmapReq);
|
||||
+ unsigned int width, height, depth;
|
||||
+ unsigned long size;
|
||||
|
||||
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
|
||||
client->errorValue = stuff->pid;
|
||||
@@ -1052,11 +1071,18 @@ ProcShmCreatePixmap(client)
|
||||
return rc;
|
||||
|
||||
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
|
||||
- if (!stuff->width || !stuff->height)
|
||||
+
|
||||
+ width = stuff->width;
|
||||
+ height = stuff->height;
|
||||
+ depth = stuff->depth;
|
||||
+ if (!width || !height || !depth)
|
||||
{
|
||||
client->errorValue = 0;
|
||||
return BadValue;
|
||||
}
|
||||
+ if (width > 32767 || height > 32767)
|
||||
+ return BadAlloc;
|
||||
+
|
||||
if (stuff->depth != 1)
|
||||
{
|
||||
pDepth = pDraw->pScreen->allowedDepths;
|
||||
@@ -1066,10 +1092,18 @@ ProcShmCreatePixmap(client)
|
||||
client->errorValue = stuff->depth;
|
||||
return BadValue;
|
||||
}
|
||||
+
|
||||
CreatePmap:
|
||||
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
|
||||
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
|
||||
- client);
|
||||
+ size = PixmapBytePad(width, depth) * height;
|
||||
+ if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
|
||||
+ if (size < width * height)
|
||||
+ return BadAlloc;
|
||||
+ /* thankfully, offset is unsigned */
|
||||
+ if (stuff->offset + size < size)
|
||||
+ return BadAlloc;
|
||||
+ }
|
||||
+
|
||||
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
|
||||
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
|
||||
pDraw->pScreen, stuff->width,
|
||||
stuff->height, stuff->depth,
|
||||
diff --git Xi/chgfctl.c Xi/chgfctl.c
|
||||
index 2e0e13c..235d659 100644
|
||||
--- Xi/chgfctl.c
|
||||
+++ Xi/chgfctl.c
|
||||
@@ -327,18 +327,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev,
|
||||
xStringFeedbackCtl * f)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
int i, j;
|
||||
KeySym *syms, *sup_syms;
|
||||
|
||||
syms = (KeySym *) (f + 1);
|
||||
if (client->swapped) {
|
||||
swaps(&f->length, n); /* swapped num_keysyms in calling proc */
|
||||
- p = (long *)(syms);
|
||||
- for (i = 0; i < f->num_keysyms; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+ SwapLongs((CARD32 *) syms, f->num_keysyms);
|
||||
}
|
||||
|
||||
if (f->num_keysyms > s->ctrl.max_symbols) {
|
||||
diff --git Xi/chgkmap.c Xi/chgkmap.c
|
||||
index eac520f..75ee9f5 100644
|
||||
--- Xi/chgkmap.c
|
||||
+++ Xi/chgkmap.c
|
||||
@@ -79,18 +79,14 @@ int
|
||||
SProcXChangeDeviceKeyMapping(ClientPtr client)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
- int i, count;
|
||||
+ unsigned int count;
|
||||
|
||||
REQUEST(xChangeDeviceKeyMappingReq);
|
||||
swaps(&stuff->length, n);
|
||||
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
|
||||
- p = (long *)&stuff[1];
|
||||
count = stuff->keyCodes * stuff->keySymsPerKeyCode;
|
||||
- for (i = 0; i < count; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
|
||||
+ SwapLongs((CARD32 *) (&stuff[1]), count);
|
||||
return (ProcXChangeDeviceKeyMapping(client));
|
||||
}
|
||||
|
||||
@@ -106,10 +102,14 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
|
||||
int ret;
|
||||
unsigned len;
|
||||
DeviceIntPtr dev;
|
||||
+ unsigned int count;
|
||||
|
||||
REQUEST(xChangeDeviceKeyMappingReq);
|
||||
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
|
||||
|
||||
+ count = stuff->keyCodes * stuff->keySymsPerKeyCode;
|
||||
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
|
||||
+
|
||||
dev = LookupDeviceIntRec(stuff->deviceid);
|
||||
if (dev == NULL) {
|
||||
SendErrorToClient(client, IReqCode, X_ChangeDeviceKeyMapping, 0,
|
||||
diff --git Xi/chgprop.c Xi/chgprop.c
|
||||
index 59a93c6..21bda5b 100644
|
||||
--- Xi/chgprop.c
|
||||
+++ Xi/chgprop.c
|
||||
@@ -81,19 +81,15 @@ int
|
||||
SProcXChangeDeviceDontPropagateList(ClientPtr client)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
- int i;
|
||||
|
||||
REQUEST(xChangeDeviceDontPropagateListReq);
|
||||
swaps(&stuff->length, n);
|
||||
REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
|
||||
swapl(&stuff->window, n);
|
||||
swaps(&stuff->count, n);
|
||||
- p = (long *)&stuff[1];
|
||||
- for (i = 0; i < stuff->count; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
|
||||
+ stuff->count * sizeof(CARD32));
|
||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
|
||||
return (ProcXChangeDeviceDontPropagateList(client));
|
||||
}
|
||||
|
||||
diff --git Xi/grabdev.c Xi/grabdev.c
|
||||
index e2809ef..d0b4ae7 100644
|
||||
--- Xi/grabdev.c
|
||||
+++ Xi/grabdev.c
|
||||
@@ -82,8 +82,6 @@ int
|
||||
SProcXGrabDevice(ClientPtr client)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
- int i;
|
||||
|
||||
REQUEST(xGrabDeviceReq);
|
||||
swaps(&stuff->length, n);
|
||||
@@ -91,11 +89,11 @@ SProcXGrabDevice(ClientPtr client)
|
||||
swapl(&stuff->grabWindow, n);
|
||||
swapl(&stuff->time, n);
|
||||
swaps(&stuff->event_count, n);
|
||||
- p = (long *)&stuff[1];
|
||||
- for (i = 0; i < stuff->event_count; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+
|
||||
+ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
|
||||
+ return BadLength;
|
||||
+
|
||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
|
||||
|
||||
return (ProcXGrabDevice(client));
|
||||
}
|
||||
diff --git Xi/grabdevb.c Xi/grabdevb.c
|
||||
index df62d0c..18db1f7 100644
|
||||
--- Xi/grabdevb.c
|
||||
+++ Xi/grabdevb.c
|
||||
@@ -80,8 +80,6 @@ int
|
||||
SProcXGrabDeviceButton(ClientPtr client)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
- int i;
|
||||
|
||||
REQUEST(xGrabDeviceButtonReq);
|
||||
swaps(&stuff->length, n);
|
||||
@@ -89,11 +87,9 @@ SProcXGrabDeviceButton(ClientPtr client)
|
||||
swapl(&stuff->grabWindow, n);
|
||||
swaps(&stuff->modifiers, n);
|
||||
swaps(&stuff->event_count, n);
|
||||
- p = (long *)&stuff[1];
|
||||
- for (i = 0; i < stuff->event_count; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
|
||||
+ stuff->event_count * sizeof(CARD32));
|
||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
|
||||
|
||||
return (ProcXGrabDeviceButton(client));
|
||||
}
|
||||
diff --git Xi/grabdevk.c Xi/grabdevk.c
|
||||
index b74592f..429b2f7 100644
|
||||
--- Xi/grabdevk.c
|
||||
+++ Xi/grabdevk.c
|
||||
@@ -80,8 +80,6 @@ int
|
||||
SProcXGrabDeviceKey(ClientPtr client)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
- int i;
|
||||
|
||||
REQUEST(xGrabDeviceKeyReq);
|
||||
swaps(&stuff->length, n);
|
||||
@@ -89,11 +87,8 @@ SProcXGrabDeviceKey(ClientPtr client)
|
||||
swapl(&stuff->grabWindow, n);
|
||||
swaps(&stuff->modifiers, n);
|
||||
swaps(&stuff->event_count, n);
|
||||
- p = (long *)&stuff[1];
|
||||
- for (i = 0; i < stuff->event_count; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
|
||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
|
||||
return (ProcXGrabDeviceKey(client));
|
||||
}
|
||||
|
||||
diff --git Xi/selectev.c Xi/selectev.c
|
||||
index d52db1b..19415c5 100644
|
||||
--- Xi/selectev.c
|
||||
+++ Xi/selectev.c
|
||||
@@ -131,19 +131,16 @@ int
|
||||
SProcXSelectExtensionEvent(ClientPtr client)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
- int i;
|
||||
|
||||
REQUEST(xSelectExtensionEventReq);
|
||||
swaps(&stuff->length, n);
|
||||
REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
|
||||
swapl(&stuff->window, n);
|
||||
swaps(&stuff->count, n);
|
||||
- p = (long *)&stuff[1];
|
||||
- for (i = 0; i < stuff->count; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+ REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
|
||||
+ stuff->count * sizeof(CARD32));
|
||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
|
||||
+
|
||||
return (ProcXSelectExtensionEvent(client));
|
||||
}
|
||||
|
||||
diff --git Xi/sendexev.c Xi/sendexev.c
|
||||
index eac9abe..9803cf3 100644
|
||||
--- Xi/sendexev.c
|
||||
+++ Xi/sendexev.c
|
||||
@@ -83,7 +83,7 @@ int
|
||||
SProcXSendExtensionEvent(ClientPtr client)
|
||||
{
|
||||
char n;
|
||||
- long *p;
|
||||
+ CARD32 *p;
|
||||
int i;
|
||||
xEvent eventT;
|
||||
xEvent *eventP;
|
||||
@@ -94,6 +94,11 @@ SProcXSendExtensionEvent(ClientPtr client)
|
||||
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
|
||||
swapl(&stuff->destination, n);
|
||||
swaps(&stuff->count, n);
|
||||
+
|
||||
+ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
|
||||
+ (stuff->num_events * (sizeof(xEvent) >> 2)))
|
||||
+ return BadLength;
|
||||
+
|
||||
eventP = (xEvent *) & stuff[1];
|
||||
for (i = 0; i < stuff->num_events; i++, eventP++) {
|
||||
proc = EventSwapVector[eventP->u.u.type & 0177];
|
||||
@@ -103,11 +108,8 @@ SProcXSendExtensionEvent(ClientPtr client)
|
||||
*eventP = eventT;
|
||||
}
|
||||
|
||||
- p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events);
|
||||
- for (i = 0; i < stuff->count; i++) {
|
||||
- swapl(p, n);
|
||||
- p++;
|
||||
- }
|
||||
+ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);
|
||||
+ SwapLongs(p, stuff->count);
|
||||
return (ProcXSendExtensionEvent(client));
|
||||
}
|
||||
|
||||
diff --git dix/dixfonts.c dix/dixfonts.c
|
||||
index c21b3ec..7bb2404 100644
|
||||
--- dix/dixfonts.c
|
||||
+++ dix/dixfonts.c
|
||||
@@ -325,6 +325,13 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
|
||||
err = BadFontName;
|
||||
goto bail;
|
||||
}
|
||||
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
|
||||
+ if (pfont->info.firstCol > pfont->info.lastCol ||
|
||||
+ pfont->info.firstRow > pfont->info.lastRow ||
|
||||
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
|
||||
+ err = AllocError;
|
||||
+ goto bail;
|
||||
+ }
|
||||
if (!pfont->fpe)
|
||||
pfont->fpe = fpe;
|
||||
pfont->refcnt++;
|
||||
diff --git hw/xfree86/common/xf86MiscExt.c hw/xfree86/common/xf86MiscExt.c
|
||||
index 655304e..ccb4f75 100644
|
||||
--- hw/xfree86/common/xf86MiscExt.c
|
||||
+++ hw/xfree86/common/xf86MiscExt.c
|
||||
@@ -568,6 +568,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval,
|
||||
|
||||
DEBUG_P("MiscExtPassMessage");
|
||||
|
||||
+ /* should check this in the protocol, but xf86NumScreens isn't exported */
|
||||
+ if (scrnIndex >= xf86NumScreens)
|
||||
+ return BadValue;
|
||||
+
|
||||
if (*pScr->HandleMessage == NULL)
|
||||
return BadImplementation;
|
||||
return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);
|
@ -1,14 +0,0 @@
|
||||
--- config/dbus-core.c.orig 2008-05-28 18:04:17.000000000 +0000
|
||||
+++ config/dbus-core.c 2008-05-28 18:04:01.000000000 +0000
|
||||
@@ -87,7 +87,8 @@
|
||||
dbus_connection_unref(bus_info.connection);
|
||||
|
||||
RemoveBlockAndWakeupHandlers(block_handler, wakeup_handler, &bus_info);
|
||||
- RemoveGeneralSocket(bus_info.fd);
|
||||
+ if (bus_info.fd != -1)
|
||||
+ RemoveGeneralSocket(bus_info.fd);
|
||||
bus_info.fd = -1;
|
||||
bus_info.connection = NULL;
|
||||
|
||||
|
||||
|
@ -1,147 +0,0 @@
|
||||
From: Daniel Stone <daniel@fooishbar.org>
|
||||
Date: Sun, 23 Sep 2007 14:17:03 +0000 (+0300)
|
||||
Subject: Input: Generate XKB mapping changes for all core-sending devices (bug #12523)
|
||||
X-Git-Url: http://gitweb.freedesktop.org/?p=xorg/xserver.git;a=commitdiff;h=27ad5d74c20f01516a1bff73be283f8982fcf0fe
|
||||
|
||||
Input: Generate XKB mapping changes for all core-sending devices (bug #12523)
|
||||
|
||||
When we change the mapping on a core device, make sure we propagate this
|
||||
through to XKB for all extended devices as well.
|
||||
---
|
||||
|
||||
--- Xi/exevents.c
|
||||
+++ Xi/exevents.c
|
||||
@@ -73,6 +73,10 @@ SOFTWARE.
|
||||
#include "dixgrabs.h" /* CreateGrab() */
|
||||
#include "scrnintstr.h"
|
||||
|
||||
+#ifdef XKB
|
||||
+#include "xkbsrv.h"
|
||||
+#endif
|
||||
+
|
||||
#define WID(w) ((w) ? ((w)->drawable.id) : 0)
|
||||
#define AllModifiersMask ( \
|
||||
ShiftMask | LockMask | ControlMask | Mod1Mask | Mod2Mask | \
|
||||
@@ -942,7 +946,7 @@ SetModifierMapping(ClientPtr client, Dev
|
||||
}
|
||||
|
||||
void
|
||||
-SendDeviceMappingNotify(CARD8 request,
|
||||
+SendDeviceMappingNotify(ClientPtr client, CARD8 request,
|
||||
KeyCode firstKeyCode, CARD8 count, DeviceIntPtr dev)
|
||||
{
|
||||
xEvent event;
|
||||
@@ -957,6 +961,11 @@ SendDeviceMappingNotify(CARD8 request,
|
||||
ev->count = count;
|
||||
}
|
||||
|
||||
+#ifdef XKB
|
||||
+ if (request == MappingKeyboard || request == MappingModifier)
|
||||
+ XkbApplyMappingChange(dev, request, firstKeyCode, count, client);
|
||||
+#endif
|
||||
+
|
||||
SendEventToAllWindows(dev, DeviceMappingNotifyMask, (xEvent *) ev, 1);
|
||||
}
|
||||
|
||||
@@ -992,7 +1001,7 @@ ChangeKeyMapping(ClientPtr client,
|
||||
keysyms.map = map;
|
||||
if (!SetKeySymsMap(&k->curKeySyms, &keysyms))
|
||||
return BadAlloc;
|
||||
- SendDeviceMappingNotify(MappingKeyboard, firstKeyCode, keyCodes, dev);
|
||||
+ SendDeviceMappingNotify(client, MappingKeyboard, firstKeyCode, keyCodes, dev);
|
||||
return client->noClientException;
|
||||
}
|
||||
|
||||
--- Xi/setbmap.c
|
||||
+++ Xi/setbmap.c
|
||||
@@ -134,7 +134,7 @@ ProcXSetDeviceButtonMapping(ClientPtr cl
|
||||
}
|
||||
|
||||
if (ret != MappingBusy)
|
||||
- SendDeviceMappingNotify(MappingPointer, 0, 0, dev);
|
||||
+ SendDeviceMappingNotify(client, MappingPointer, 0, 0, dev);
|
||||
return Success;
|
||||
}
|
||||
|
||||
--- Xi/setmmap.c
|
||||
+++ Xi/setmmap.c
|
||||
@@ -122,7 +122,7 @@ ProcXSetDeviceModifierMapping(ClientPtr
|
||||
if (ret == MappingSuccess || ret == MappingBusy || ret == MappingFailed) {
|
||||
rep.success = ret;
|
||||
if (ret == MappingSuccess)
|
||||
- SendDeviceMappingNotify(MappingModifier, 0, 0, dev);
|
||||
+ SendDeviceMappingNotify(client, MappingModifier, 0, 0, dev);
|
||||
WriteReplyToClient(client, sizeof(xSetDeviceModifierMappingReply),
|
||||
&rep);
|
||||
} else {
|
||||
--- dix/devices.c
|
||||
+++ dix/devices.c
|
||||
@@ -1208,10 +1208,9 @@ SendMappingNotify(unsigned request, unsi
|
||||
}
|
||||
#ifdef XKB
|
||||
if (!noXkbExtension &&
|
||||
- ((request == MappingKeyboard) || (request == MappingModifier))) {
|
||||
- XkbApplyMappingChange(inputInfo.keyboard,request,firstKeyCode,count,
|
||||
- client);
|
||||
- }
|
||||
+ ((request == MappingKeyboard) || (request == MappingModifier)))
|
||||
+ XkbApplyMappingChange(inputInfo.keyboard, request, firstKeyCode, count,
|
||||
+ client);
|
||||
#endif
|
||||
|
||||
/* 0 is the server client */
|
||||
@@ -1359,6 +1358,7 @@ int
|
||||
ProcSetModifierMapping(ClientPtr client)
|
||||
{
|
||||
xSetModifierMappingReply rep;
|
||||
+ DeviceIntPtr dev;
|
||||
REQUEST(xSetModifierMappingReq);
|
||||
|
||||
REQUEST_AT_LEAST_SIZE(xSetModifierMappingReq);
|
||||
@@ -1374,8 +1374,10 @@ ProcSetModifierMapping(ClientPtr client)
|
||||
rep.success = DoSetModifierMapping(client, (KeyCode *)&stuff[1],
|
||||
stuff->numKeyPerModifier);
|
||||
|
||||
- /* FIXME: Send mapping notifies for all the extended devices as well. */
|
||||
SendMappingNotify(MappingModifier, 0, 0, client);
|
||||
+ for (dev = inputInfo.devices; dev; dev = dev->next)
|
||||
+ if (dev->key && dev->coreEvents)
|
||||
+ SendDeviceMappingNotify(client, MappingModifier, 0, 0, dev);
|
||||
WriteReplyToClient(client, sizeof(xSetModifierMappingReply), &rep);
|
||||
return client->noClientException;
|
||||
}
|
||||
@@ -1438,16 +1440,19 @@ ProcChangeKeyboardMapping(ClientPtr clie
|
||||
keysyms.maxKeyCode = stuff->firstKeyCode + stuff->keyCodes - 1;
|
||||
keysyms.mapWidth = stuff->keySymsPerKeyCode;
|
||||
keysyms.map = (KeySym *)&stuff[1];
|
||||
- for (pDev = inputInfo.devices; pDev; pDev = pDev->next) {
|
||||
- if ((pDev->coreEvents || pDev == inputInfo.keyboard) && pDev->key) {
|
||||
+ for (pDev = inputInfo.devices; pDev; pDev = pDev->next)
|
||||
+ if ((pDev->coreEvents || pDev == inputInfo.keyboard) && pDev->key)
|
||||
if (!SetKeySymsMap(&pDev->key->curKeySyms, &keysyms))
|
||||
return BadAlloc;
|
||||
- }
|
||||
- }
|
||||
|
||||
- /* FIXME: Send mapping notifies for all the extended devices as well. */
|
||||
SendMappingNotify(MappingKeyboard, stuff->firstKeyCode, stuff->keyCodes,
|
||||
client);
|
||||
+ for (pDev = inputInfo.devices; pDev; pDev = pDev->next)
|
||||
+ if (pDev->key && pDev->coreEvents)
|
||||
+ SendDeviceMappingNotify(client, MappingKeyboard,
|
||||
+ stuff->firstKeyCode, stuff->keyCodes,
|
||||
+ pDev);
|
||||
+
|
||||
return client->noClientException;
|
||||
}
|
||||
|
||||
--- include/exevents.h
|
||||
+++ include/exevents.h
|
||||
@@ -129,6 +129,7 @@ extern int SetModifierMapping(
|
||||
KeyClassPtr * /* k */);
|
||||
|
||||
extern void SendDeviceMappingNotify(
|
||||
+ ClientPtr /* client, */,
|
||||
CARD8 /* request, */,
|
||||
KeyCode /* firstKeyCode */,
|
||||
CARD8 /* count */,
|
Loading…
Reference in New Issue
Block a user