diff options
| author | Jeremy Huddleston Sequoia <jeremyhu@apple.com> | 2014-01-01 10:47:52 -0800 |
|---|---|---|
| committer | Jeremy Huddleston Sequoia <jeremyhu@apple.com> | 2014-01-22 15:17:18 -0800 |
| commit | f218c147c2bb77ab3b5dc091ddb62839fa165254 (patch) | |
| tree | 0053a06a91f87a74f4680113bc1d77a91b8469a7 | |
| parent | 2599b3a42b9d637534b0ed5018aa4bc692c0f5e5 (diff) | |
XQuartz: Validate length in appledri before swapping
Avoids potential memory corruption from bad requests
Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
(cherry picked from commit a03f096a85537d9e881cedaa6cb71aca43a97086)
| -rw-r--r-- | hw/xquartz/xpr/appledri.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c index d7e984467..77574655b 100644 --- a/hw/xquartz/xpr/appledri.c +++ b/hw/xquartz/xpr/appledri.c @@ -406,6 +406,7 @@ SProcAppleDRIQueryDirectRenderingCapable(register ClientPtr client) { REQUEST(xAppleDRIQueryDirectRenderingCapableReq); swaps(&stuff->length); + REQUEST_SIZE_MATCH(xAppleDRIQueryDirectRenderingCapableReq); swapl(&stuff->screen); return ProcAppleDRIQueryDirectRenderingCapable(client); } @@ -415,6 +416,7 @@ SProcAppleDRIAuthConnection(register ClientPtr client) { REQUEST(xAppleDRIAuthConnectionReq); swaps(&stuff->length); + REQUEST_SIZE_MATCH(xAppleDRIAuthConnectionReq); swapl(&stuff->screen); swapl(&stuff->magic); return ProcAppleDRIAuthConnection(client); @@ -425,6 +427,7 @@ SProcAppleDRICreateSurface(register ClientPtr client) { REQUEST(xAppleDRICreateSurfaceReq); swaps(&stuff->length); + REQUEST_SIZE_MATCH(xAppleDRICreateSurfaceReq); swapl(&stuff->screen); swapl(&stuff->drawable); swapl(&stuff->client_id); @@ -436,6 +439,7 @@ SProcAppleDRIDestroySurface(register ClientPtr client) { REQUEST(xAppleDRIDestroySurfaceReq); swaps(&stuff->length); + REQUEST_SIZE_MATCH(xAppleDRIDestroySurfaceReq); swapl(&stuff->screen); swapl(&stuff->drawable); return ProcAppleDRIDestroySurface(client); @@ -446,6 +450,7 @@ SProcAppleDRICreatePixmap(register ClientPtr client) { REQUEST(xAppleDRICreatePixmapReq); swaps(&stuff->length); + REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq); swapl(&stuff->screen); swapl(&stuff->drawable); return ProcAppleDRICreatePixmap(client); @@ -456,6 +461,7 @@ SProcAppleDRIDestroyPixmap(register ClientPtr client) { REQUEST(xAppleDRIDestroyPixmapReq); swaps(&stuff->length); + REQUEST_SIZE_MATCH(xAppleDRIDestroyPixmapReq); swapl(&stuff->drawable); return ProcAppleDRIDestroyPixmap(client); } |