summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
6 daysxkb: avoid undefined behavior due to left shift overflowHEADmasterAlan Coopersmith1-5/+3
Closes: #225 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/273>
12 daysXIM_SET_PAD: add do ... while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith1-2/+2
Clears 8 warnings from clang of the form: imDefIc.c:366:29: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] XIM_SET_PAD(&buf_s[2], len); /* pad */ ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysXrm.c: remove unneccessary ; after {}Alan Coopersmith1-2/+2
Clears 2 clang warnings: Xrm.c:1186:51: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] while (is_space(bits = next_char(c, str))) {}; ^ Xrm.c:1191:48: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] while (is_space(bits = next_char(c, str))) {}; ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysDL_APPEND/DL_DELETE: remove trailing semicolon from definitionsAlan Coopersmith1-2/+2
Clears 2 clang warnings: XlibInt.c:672:26: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] DL_APPEND(*head, add); ^ XlibInt.c:694:36: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] DL_DELETE(*head, event); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysxcb_io.c: add do ... while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith1-6/+6
Clears 10 warnings from clang of the form: xcb_io.c:177:56: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] xcb_xlib_unknown_req_in_deq); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysCI_GET_*_INFO_*: add do ... while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith2-4/+4
Clears 24 warnings from clang of the form: TextExt16.c:63:34: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] CI_GET_DEFAULT_INFO_1D (fs, def); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysRETURN: add do ... while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith1-1/+1
Clears 5 warnings from clang of the form: RdBitF.c:141:32: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] RETURN (BitmapFileInvalid); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 dayspoly.h: add do ... while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith1-8/+8
Clears 3 warnings from clang of the form: PolyReg.c:224:67: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] BRESINITPGONSTRUCT(dy, top->x, bottom->x, pETEs->bres); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysPutCommandResource: add do ... while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith1-2/+2
Clears 4 warnings from clang of the form: ParseCmd.c:158:43: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] PutCommandResource(options[i].value); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysGetFunc: add do ... while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith1-2/+2
Clears 4 warnings from clang of the form: CrGlCur.c:140:64: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] GetFunc (TryShapeCursorFunc, "XcursorTryShapeCursor", func); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 days_XkbCheckPendingRefresh: add do ... while (0) to avoid -Wextra-semi-stmtAlan Coopersmith1-2/+2
Clears 6 warnings from clang of the form: XKBBind.c:74:48: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] _XkbCheckPendingRefresh(dpy, dpy->xkb_info); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
12 daysset_toupper: add do { ... } while (0) to avoid -Wextra-semi-stmt warningsAlan Coopersmith1-2/+3
Clears 4 warnings from clang of the form: lcUtil.c:53:18: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] set_toupper(ch1); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/272>
2024-11-04ximcp: hide internal functionsJulien Cristau1-3/+3
commit 13e9ac4d45 "ximcp: Unmark to fabricate key events with XKeyEvent serial" added new _XimFabricateSerial / _XimUnfabricateSerial / _XimIsFabricatedSerial functions; they don't need to be exported by libX11. Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/271>
2024-10-12_XGetRequest: Set data field to 0 when initializing new requestsAlan Coopersmith1-2/+5
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/268>
2024-09-29_XlcDefaultMapModifiers: remove conversions between size_t & intAlan Coopersmith1-3/+3
Avoids build failures with gcc 14.2 when MALLOC_0_RETURNS_NULL is defined: lcWrap.c: In function ‘_XlcDefaultMapModifiers’: lcWrap.c:149:9: warning: ‘strcpy’ writing between 4294967296 and 9223372036854775806 bytes into a region of size 1 [-Wstringop-overflow=] 149 | strcpy(mods, prog_mods); | ^~~~~~~~~~~~~~~~~~~~~~~ ../../include/X11/Xlibint.h:457:24: note: destination object of size 1 allocated by ‘malloc’ 457 | # define Xmalloc(size) malloc((size_t)((size) == 0 ? 1 : (size))) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lcWrap.c:147:12: note: in expansion of macro ‘Xmalloc’ 147 | mods = Xmalloc(i); | ^~~~~~~ lcWrap.c:149:9: error: ‘__builtin_memcpy’ forming offset [1, 4294967295] is out of the bounds [0, 1] [-Werror=array-bounds=] 149 | strcpy(mods, prog_mods); | ^~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/267>
2024-08-31SetFontPath: if ndirs is 0, skip work to make a list of directoriesAlan Coopersmith1-27/+33
Clears warning from gcc 14.1: SetFPath.c: In function ‘XSetFontPath’: ../include/X11/Xlibint.h:463:24: warning: argument 1 value is zero [-Walloc-zero] 463 | # define Xmalloc(size) malloc((size_t)(size)) | ^~~~~~~~~~~~~~~~~~~~~~ SetFPath.c:61:18: note: in expansion of macro ‘Xmalloc’ 61 | if ((p = Xmalloc (nbytes))) { | ^~~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/266>
2024-08-09Fix indentationOlivier Fourdan1-4/+4
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/264>
2024-08-09Close xcb connection after freeing display structureOlivier Fourdan2-3/+8
Commit 1472048b7 to fix a colormap threading issue added a display lock/unlock and a call to SyncHandle() to _XcmsFreeClientCmaps(). When running synchronized, that means calling XSync(). _XcmsFreeClientCmaps() is called from _XFreeDisplayStructure() via XCloseDisplay() after the xcb connection is closed. So when running synchronized, we may end up calling XSync() after the xcb connection to the display is closed, which will generate a spurious XIO error: | #0 in _XDefaultIOError () at /lib64/libX11.so.6 | #1 in _XIOError () at /lib64/libX11.so.6 | #2 in _XReply () at /lib64/libX11.so.6 | #3 in XSync () at /lib64/libX11.so.6 | #4 in _XSyncFunction () at /lib64/libX11.so.6 | 8#5 in _XFreeDisplayStructure () at /lib64/libX11.so.6 | 8#6 in XCloseDisplay () at /lib64/libX11.so.6 To avoid that issue, closed the xcb connection to the display last. v2: And same in OutOfMemory() as well (José Expósito) Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Reviewed-by: José Expósito <jexposit@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/264>
2024-07-13xlibi18n/lcFile.c: avoid use of possibly-NULL pointer with strcpyAlan Coopersmith1-6/+6
Fixes gcc warnings: lcFile.c: In function ‘_XlcLocaleLibDirName’: lcFile.c:708:5: warning: use of possibly-NULL ‘last_dir_name’ where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument] 708 | strcpy (last_dir_name, dir_name); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/258>
2024-07-06Revert "unifdef __vax__"Alan Coopersmith1-0/+4
This reverts commit 4ce3962b701c502acc96b6eaf104a5ffc317c5d7. Requested by NetBSD which still has a supported VAX port. Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/257>
2024-06-24Fix deadlock in XRebindKeysym()Olivier Fourdan1-1/+2
Xlib is now built with threading support enabled from the constructor by default. XRebindKeysym() acquires the display lock, then calls: | XRebindKeysym() | LockDisplay() | ComputeMaskFromKeytrans() | -> XkbKeysymToModifiers() | -> _XkbLoadDpy() | -> XkbGetMap() | -> XkbGetUpdatedMap() | LockDisplay() And the dead lock: | Xlib ERROR: XKBGetMap.c line 575 thread 1fc6e580: locking display already | locked at KeyBind.c line 937 To avoid the issue, call ComputeMaskFromKeytrans() from outside the display lock. Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Closes: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/216 Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/256>
2024-06-15Make colormap private interfaces thread safe.Olivier Fourdan1-0/+14
Protect access to the dpy structure by a display lock, so that these can be called outside of a global display lock. That allows the XCMS colormap functions to be thread safe without having the whole functions within a display lock, to avoid deadlocks. Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> See-also: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/215 See-also: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/94 Reviewed-by: Adam Jackson <ajax@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/254>
2024-06-15Revert "Protect colormap add/removal with display lock"Olivier Fourdan3-9/+9
That commit 99a2cf1aa was moving the calls to the _Xcms*CmapRec*() family of functions within a display lock to make the XCMS colormap functions thread safe. Unfortunately, that causes a deadlock in XCopyColormapAndFree(), because _XcmsCopyCmapRecAndFree() calls CmapRecForColormap() which calls XGetVisualInfo() which also tries to acquire the display lock. So, instead of moving the entire functions within the display lock, let's try to make the functions themselves thread safe in the following commit, and revert this change which causes a deadlock. This reverts commit 99a2cf1aa0b58391078d5d3edf0a7dab18c7745d. Fixes: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/215 See-also: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/94 Reviewed-by: Adam Jackson <ajax@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/254>
2024-06-15Revert "Fix XTS regression in XCopyColormapAndFree"Olivier Fourdan1-5/+0
This change was to fix the next change that we are to revert as well. This reverts commit 68c72a7341b114277ab232f2499ee3bd035af8a0. Reviewed-by: Adam Jackson <ajax@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/254>
2024-06-07Avoid buffer overflow in _XimLookupMBText & _XimLookupUTF8TextAlan Coopersmith1-0/+4
Reported-by: u32i <u32i@proton.me> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/251>
2024-05-07XKBMAlloc: Check that needed is >= 0 in XkbResizeKeyActionsJosé Expósito1-1/+1
Passing a negative value in `needed` to the `XkbResizeKeyActions()` function can create a `newActs` array of an unespected size. Check the value and return if it is invalid. This error has been found by a static analysis tool. This is the report: Error: OVERRUN (CWE-119): libX11-1.8.7/src/xkb/XKBMAlloc.c:811: cond_const: Checking "xkb->server->size_acts == 0" implies that "xkb->server->size_acts" is 0 on the true branch. libX11-1.8.7/src/xkb/XKBMAlloc.c:811: buffer_alloc: "calloc" allocates 8 bytes dictated by parameters "(size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts)" and "8UL". libX11-1.8.7/src/xkb/XKBMAlloc.c:811: var_assign: Assigning: "newActs" = "calloc((size_t)((xkb->server->size_acts == 0) ? 1 : xkb->server->size_acts), 8UL)". libX11-1.8.7/src/xkb/XKBMAlloc.c:815: assignment: Assigning: "nActs" = "1". libX11-1.8.7/src/xkb/XKBMAlloc.c:829: cond_at_least: Checking "nCopy > 0" implies that "nCopy" is at least 1 on the true branch. libX11-1.8.7/src/xkb/XKBMAlloc.c:830: overrun-buffer-arg: Overrunning buffer pointed to by "&newActs[nActs]" of 8 bytes by passing it to a function which accesses it at byte offset 15 using argument "nCopy * 8UL" (which evaluates to 8). # 828| # 829| if (nCopy > 0) # 830|-> memcpy(&newActs[nActs], XkbKeyActionsPtr(xkb, i), # 831| nCopy * sizeof(XkbAction)); # 832| if (nCopy < nKeyActs) Signed-off-by: José Expósito <jexposit@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/250>
2024-04-26ximcp: Unmark fabricated with serial 0 and Xic commit_infoTakao Fujiwara1-0/+1
GTK2 XIM resets the XKeyEvent serial to 0 even if _XimCommitRecv() sets the serial so now checks if the events are sent with Xic->private.proto.commit_info. Closes: !246 Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
2024-04-26Accept anon windows in XFilterEvent to update XIM stateTakao Fujiwara1-0/+25
When input focuses are switched quickly with shortcut keys in a Java window, the focus is sometimes lost and the Window=0 is assigned in XFilterEvent() but the XKeyEvent was forwarded by a XIM serer(IBus) with XIM_FORWARD_EVENT -> XNextEvent() -> XFilterEvent() and the event needs to be forwarded to the XIM XKeyEvent press and release filters to update the XIM state with Window=0 likes _XimPendingFilter() and _XimUnfabricateSerial(). Closes: #205, #206 Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial") Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
2024-04-26ximcp: Add fabricated_time in XimProtoPrivate for timeoutTakao Fujiwara1-4/+6
When users type keys quickly, some applications using Steam or Java do not call XNextEvent() for a key event but _XimFilterKeypress() and _XimFilterKeyrelease() expect to receive the key events forwarded by input methods. Now fabricated_time Time value is added to XimProtoPrivate to check the timeout value. Closes: #205 Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial") Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
2024-04-12ximcp: Unmark to fabricate key events with XKeyEvent serialTakao Fujiwara1-0/+17
_XimProtoKeypressFilter() and _XimProtoKeyreleaseFilter() can receive XKeyEvent from both the typing on the keyboard and the callback of XIM_FORWARD_EVENT. If the filter functions unmark to fabricate XKeyEvent from the typing on the keyboard during receiving XKeyEvent from the callback of XIM_FORWARD_EVENT with typing keys very quickly likes an bar code scanner (or evemu-play), XIM server cannot receive some key events and it causes the key typing order to get scrambled. Now XIM client saves the serial in XKeyEvent and the filter functions unmark to fabricate XKeyEvent from the callback of XIM_FORWARD_EVENT only. This and 024d229f are same patches but the regression issues will be fixed by the later patches. Closes: #198 Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial") Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
2024-04-05Revert "ximcp: Unmark to fabricate key events with XKeyEvent serial"Peter Hutterer1-17/+0
This commit causes a regression, see #205, #206, #207, #208. This reverts commit 024d229fdf88a7755577b01b46af6ef908d599e0.
2024-03-25xlibi18n: restore parse_line1 for WIN32 buildsAlan Coopersmith1-0/+34
Accidentally removed by __UNIXOS2__ cleanup Closes: #204 Fixes: 225a4bbb ("unifdef __UNIXOS2__") Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-21unifdef NULL_NOT_ZEROAlan Coopersmith1-19/+5
I can't find any evidence this was ever defined, should only have been needed for odd-ball pre-C89 compilers. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-21unifdef USL_SHAREDLIBAlan Coopersmith1-15/+0
I can't find any history of this being set in the imake or autoconf builds Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-20unifdef LynxAlan Coopersmith2-8/+0
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-20unifdef __QNX__Alan Coopersmith1-1/+1
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-20unifdef __vax__Alan Coopersmith1-4/+0
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-20unifdef __sgi_not_xconsortiumAlan Coopersmith1-4/+0
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-20unifdef __sgiAlan Coopersmith1-4/+0
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-20unifdef sgiAlan Coopersmith1-1/+1
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-20unifdef hpuxAlan Coopersmith4-110/+13
Also removes shl_load() support, which was only buildable for HP-UX Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-11unifdef __UNIXOS2__Alan Coopersmith12-175/+4
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-11unifdef ultrixAlan Coopersmith1-17/+11
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-11unifdef AIXV3Alan Coopersmith2-13/+8
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-02-11unifdef __osf__Alan Coopersmith1-2/+2
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2024-01-31ximcp: Unmark to fabricate key events with XKeyEvent serialTakao Fujiwara1-0/+17
_XimProtoKeypressFilter() and _XimProtoKeyreleaseFilter() can receive XKeyEvent from both the typing on the keyboard and the callback of XIM_FORWARD_EVENT. If the filter functions unmark to fabricate XKeyEvent from the typing on the keyboard during receiving XKeyEvent from the callback of XIM_FORWARD_EVENT with typing keys very quickly likes an bar code scanner (or evemu-play), XIM server cannot receive some key events and it causes the key typing order to get scrambled. Now XIM client saves the serial in XKeyEvent and the filter functions unmark to fabricate XKeyEvent from the callback of XIM_FORWARD_EVENT only. Fixes: #198
2024-01-18Fix _XkbReadGetDeviceInfoReply for nButtons == dev->buttonsPeter Hutterer1-4/+2
XkbGetDeviceInfo(dpy, XkbXI_ButtonActionsMask, 2, 0, 0) always returns NULL because the number of buttons on the device equals (unsurpisingly) the number of buttons requested (i.e. first + nBtns == dev->nbuttons). This currently causes it to bail out and return NULL. Fixes f293659d5a4024bda386305bb7ebeb4647c40934
2023-09-22CVE-2023-43787: Integer overflow in XCreateImage() leading to a heap overflowYair Mizrahi1-5/+15
When the format is `Pixmap` it calculates the size of the image data as: ROUNDUP((bits_per_pixel * width), image->bitmap_pad); There is no validation on the `width` of the image, and so this calculation exceeds the capacity of a 4-byte integer, causing an overflow. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2023-09-22XCreatePixmap: trigger BadValue error for out-of-range dimensionsAlan Coopersmith1-0/+11
The CreatePixmap request specifies height & width of the image as CARD16 (unsigned 16-bit integer), so if either is larger than that, set it to 0 so the X server returns a BadValue error as the protocol requires. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2023-09-22XPutImage: clip images to maximum height & width allowed by protocolAlan Coopersmith1-0/+5
The PutImage request specifies height & width of the image as CARD16 (unsigned 16-bit integer), same as the maximum dimensions of an X11 Drawable, which the image is being copied to. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-23 01:11:06 +0000