Fix byte swapping of XF86VidMode{Get,Set}GammaRamp

Fixes OpenSolaris Bug 8315:
Xorg segfaults when screensaver fades in cross-endian xdmcp session
<http://defect.opensolaris.org/bz/show_bug.cgi?id=8315>

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>

1 files changed, 6 insertions, 10 deletions

diff --git a/hw/xfree86/dixmods/extmod/xf86vmode.c b/hw/xfree86/dixmods/extmod/xf86vmode.c
index ea8089e94..10b9ed370 100644
--- a/hw/xfree86/dixmods/extmod/xf86vmode.c
+++ b/hw/xfree86/dixmods/extmod/xf86vmode.c
@@ -1541,6 +1541,7 @@ ProcXF86VidModeGetGammaRamp(ClientPtr client)
 {
     CARD16 *ramp = NULL;
     int n, length, i;
+    size_t ramplen;
     xXF86VidModeGetGammaRampReply rep;
     REQUEST(xXF86VidModeGetGammaRampReq);
 
@@ -1555,7 +1556,8 @@ ProcXF86VidModeGetGammaRamp(ClientPtr client)
     length = (stuff->size + 1) & ~1;
 
     if(stuff->size) {
-        if(!(ramp = xalloc(length * 3 * sizeof(CARD16))))
+        ramplen = length * 3 * sizeof(CARD16);
+        if (!(ramp = xalloc(ramplen)))
             return BadAlloc;
    
         if (!VidModeGetGammaRamp(stuff->screen, stuff->size, 
@@ -1573,13 +1575,12 @@ ProcXF86VidModeGetGammaRamp(ClientPtr client)
         swaps(&rep.sequenceNumber, n);
         swapl(&rep.length, n);
         swaps(&rep.size, n);
-        for(i = 0; i < length * 3; i++)
-            swaps(&ramp[i],n);
+        SwapShorts(ramp, length * 3);
     }
     WriteToClient(client, sizeof(xXF86VidModeGetGammaRampReply), (char *)&rep);
 
     if(stuff->size) {
-        WriteToClient(client, rep.length << 2, (char*)ramp);
+        WriteToClient(client, ramplen, (char*)ramp);
         xfree(ramp);
     }
 
@@ -2060,7 +2061,6 @@ SProcXF86VidModeGetGamma(ClientPtr client)
 static int
 SProcXF86VidModeSetGammaRamp(ClientPtr client)
 {
-    CARD16 *ramp;
     int length, n;
     REQUEST(xXF86VidModeSetGammaRampReq);
     swaps(&stuff->length, n);
@@ -2069,11 +2069,7 @@ SProcXF86VidModeSetGammaRamp(ClientPtr client)
     swaps(&stuff->screen, n);
     length = ((stuff->size + 1) & ~1) * 6;
     REQUEST_FIXED_SIZE(xXF86VidModeSetGammaRampReq, length);
-    ramp = (CARD16*)&stuff[1];
-    while(length--) {
-        swaps(ramp, n);
-        ramp++;
-    }
+    SwapRestS(stuff);
     return ProcXF86VidModeSetGammaRamp(client);
 }