diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-13 00:47:57 -0700 |
|---|---|---|
| committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2013-04-13 00:47:57 -0700 |
| commit | cf1a1dc1b9ca34a29d0471da9389f8eae70ddbd9 (patch) | |
| tree | 0192e2034e89cde312c3410bff6acd411e01d2c7 /src | |
| parent | 2fb49b59ff530ea3d0288b1b1ab5ccd046a1213b (diff) | |
Use _XEatDataWords to avoid overflow of rep.length shifting
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/XvMC.c | 24 |
1 files changed, 18 insertions, 6 deletions
@@ -16,6 +16,18 @@ #include <sys/time.h> #include <X11/extensions/Xext.h> #include <X11/extensions/extutil.h> +#include <limits.h> + +#ifndef HAVE__XEATDATAWORDS +static inline void _XEatDataWords(Display *dpy, unsigned long n) +{ +# ifndef LONG64 + if (n >= (ULONG_MAX >> 2)) + _XIOError(dpy); +# endif + _XEatData (dpy, n << 2); +} +#endif static XExtensionInfo _xvmc_info_data; static XExtensionInfo *xvmc_info = &_xvmc_info_data; @@ -134,7 +146,7 @@ XvMCSurfaceInfo * XvMCListSurfaceTypes(Display *dpy, XvPortID port, int *num) surface_info[i].flags = sinfo.flags; } } else - _XEatData(dpy, rep.length << 2); + _XEatDataWords(dpy, rep.length); } UnlockDisplay (dpy); @@ -207,7 +219,7 @@ XvImageFormatValues * XvMCListSubpictureTypes ( ret[i].scanline_order = Info.scanline_order; } } else - _XEatData(dpy, rep.length << 2); + _XEatDataWords(dpy, rep.length); } UnlockDisplay (dpy); @@ -278,7 +290,7 @@ Status _xvmc_create_context ( _XRead(dpy, (char*)(*priv_data), rep.length << 2); *priv_count = rep.length; } else - _XEatData(dpy, rep.length << 2); + _XEatDataWords(dpy, rep.length); } UnlockDisplay (dpy); @@ -359,7 +371,7 @@ Status _xvmc_create_surface ( _XRead(dpy, (char*)(*priv_data), rep.length << 2); *priv_count = rep.length; } else - _XEatData(dpy, rep.length << 2); + _XEatDataWords(dpy, rep.length); } UnlockDisplay (dpy); @@ -449,7 +461,7 @@ Status _xvmc_create_subpicture ( _XRead(dpy, (char*)(*priv_data), rep.length << 2); *priv_count = rep.length; } else - _XEatData(dpy, rep.length << 2); + _XEatDataWords(dpy, rep.length); } UnlockDisplay (dpy); @@ -579,7 +591,7 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, } else { - _XEatData(dpy, realSize); + _XEatDataWords(dpy, rep.length); UnlockDisplay (dpy); SyncHandle (); return -1; |