mesa sends too long requests for GLXDestroyPixmap, GLXDestroyWindow, GLXChangeDrawableAttributes, GLXGetDrawableAttributes and GLXGetFBConfigsSGIX.
Fixes a regression introduced in ec9c97c6bf70b523bc500bd3adf62176f1bb33a4 X.Org bug#33324 <https://bugs.freedesktop.org/show_bug.cgi?id=33324> Reported-by: [email protected] Signed-off-by: Julien Cristau <[email protected]> --- glx/glxcmds.c | 19 +++++++++++++++---- 1 files changed, 15 insertions(+), 4 deletions(-) diff --git a/glx/glxcmds.c b/glx/glxcmds.c index 5d633df..9b4bc9e 100644 --- a/glx/glxcmds.c +++ b/glx/glxcmds.c @@ -1132,7 +1132,8 @@ int __glXDisp_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc) { ClientPtr client = cl->client; xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc; - REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq); + /* work around mesa bug, don't use REQUEST_SIZE_MATCH */ + REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq); return DoGetFBConfigs(cl, req->screen); } @@ -1356,7 +1357,9 @@ int __glXDisp_DestroyPixmap(__GLXclientState *cl, GLbyte *pc) ClientPtr client = cl->client; xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc; - REQUEST_SIZE_MATCH(xGLXDestroyPixmapReq); + /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set + * length to 3 instead of 2 */ + REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq); return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP); } @@ -1498,7 +1501,13 @@ int __glXDisp_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc) client->errorValue = req->numAttribs; return BadValue; } +#if 0 + /* mesa sends an additional 8 bytes */ REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3); +#else + if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len) + return BadLength; +#endif return DoChangeDrawableAttributes(cl->client, req->drawable, req->numAttribs, (CARD32 *) (req + 1)); @@ -1563,7 +1572,8 @@ int __glXDisp_DestroyWindow(__GLXclientState *cl, GLbyte *pc) ClientPtr client = cl->client; xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc; - REQUEST_SIZE_MATCH(xGLXDestroyWindowReq); + /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */ + REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq); return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW); } @@ -1872,7 +1882,8 @@ int __glXDisp_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc) ClientPtr client = cl->client; xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc; - REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq); + /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */ + REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq); return DoGetDrawableAttributes(cl, req->drawable); } -- 1.7.2.3 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
