Various fixes, applied to panoramiX.c in commit 2b266eda, also need applying to pseudoramiX.c: Fix panoramiX request and reply swapping Set window and screen values in panoramix replies Prevent buffer overrun in ProcPanoramiXGetScreenSize
pseudoramiX.c: In function 'ProcPseudoramiXGetState': pseudoramiX.c:221:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap pseudoramiX.c: In function 'ProcPseudoramiXGetScreenCount': pseudoramiX.c:250:62: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap pseudoramiX.c: In function 'ProcPseudoramiXGetScreenSize': pseudoramiX.c:283:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap pseudoramiX.c:284:57: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap I haven't checked if there are any other fixes applied to panoramiX.c since pseudoramiX.c was derived from it which also should be brought across. Signed-off-by: Jon TURNEY <[email protected]> --- hw/xquartz/pseudoramiX.c | 17 +++++++++++++---- 1 files changed, 13 insertions(+), 4 deletions(-) diff --git a/hw/xquartz/pseudoramiX.c b/hw/xquartz/pseudoramiX.c index 8bb7f2d..b1b8867 100644 --- a/hw/xquartz/pseudoramiX.c +++ b/hw/xquartz/pseudoramiX.c @@ -211,10 +211,11 @@ ProcPseudoramiXGetState(ClientPtr client) rep.length = 0; rep.sequenceNumber = client->sequence; rep.state = !noPseudoramiXExtension; + rep.window = stuff->window; if (client->swapped) { swaps(&rep.sequenceNumber); swapl(&rep.length); - swaps(&rep.state); + swapl(&rep.window); } WriteToClient(client, sizeof(xPanoramiXGetStateReply), (char *)&rep); return Success; @@ -240,10 +241,11 @@ ProcPseudoramiXGetScreenCount(ClientPtr client) rep.length = 0; rep.sequenceNumber = client->sequence; rep.ScreenCount = pseudoramiXNumScreens; + rep.window = stuff->window; if (client->swapped) { swaps(&rep.sequenceNumber); swapl(&rep.length); - swaps(&rep.ScreenCount); + swapl(&rep.window); } WriteToClient(client, sizeof(xPanoramiXGetScreenCountReply), (char *)&rep); return Success; @@ -259,6 +261,9 @@ ProcPseudoramiXGetScreenSize(ClientPtr client) register int n, rc; TRACE(); + + if (stuff->screen >= pseudoramiXNumScreens) + return BadMatch; REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq); rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess); @@ -273,11 +278,15 @@ ProcPseudoramiXGetScreenSize(ClientPtr client) // was screenInfo.screens[stuff->screen]->width; rep.height = pseudoramiXScreens[stuff->screen].h; // was screenInfo.screens[stuff->screen]->height; + rep.window = stuff->window; + rep.screen = stuff->screen; if (client->swapped) { swaps(&rep.sequenceNumber); swapl(&rep.length); - swaps(&rep.width); - swaps(&rep.height); + swapl(&rep.width); + swapl(&rep.height); + swapl(&rep.window); + swapl(&rep.screen); } WriteToClient(client, sizeof(xPanoramiXGetScreenSizeReply), (char *)&rep); return Success; -- 1.7.9 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
