diff options
| author | Peter Harris <peter.harris@hummingbird.com> | 2007-12-20 15:58:01 -0500 |
|---|---|---|
| committer | Julien Cristau <jcristau@debian.org> | 2008-09-21 19:19:24 +0200 |
| commit | 2b266eda6e23d16116f8a8e258192df353970279 (patch) | |
| tree | aea30e756f8b031ef0c924c98661e679f2da3eee /Xext | |
| parent | 03ab8f11d25b0ca39a3b37b5350bca4c1028768e (diff) | |
Fix panoramiX request and reply swapping
Fix panoramiX request and reply swapping
Set window and screen values in panoramix replies
Prevent buffer overrun in ProcPanoramiXGetScreenSize
Diffstat (limited to 'Xext')
| -rw-r--r-- | Xext/panoramiX.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c index 22b51aa71..d948702b2 100644 --- a/Xext/panoramiX.c +++ b/Xext/panoramiX.c @@ -932,10 +932,11 @@ ProcPanoramiXGetState(ClientPtr client) rep.length = 0; rep.sequenceNumber = client->sequence; rep.state = !noPanoramiXExtension; + rep.window = stuff->window; if (client->swapped) { swaps (&rep.sequenceNumber, n); swapl (&rep.length, n); - swaps (&rep.state, n); + swapl (&rep.window, n); } WriteToClient (client, sizeof (xPanoramiXGetStateReply), (char *) &rep); return client->noClientException; @@ -959,10 +960,11 @@ ProcPanoramiXGetScreenCount(ClientPtr client) rep.length = 0; rep.sequenceNumber = client->sequence; rep.ScreenCount = PanoramiXNumScreens; + rep.window = stuff->window; if (client->swapped) { swaps (&rep.sequenceNumber, n); swapl (&rep.length, n); - swaps (&rep.ScreenCount, n); + swapl (&rep.window, n); } WriteToClient (client, sizeof (xPanoramiXGetScreenCountReply), (char *) &rep); return client->noClientException; @@ -976,6 +978,9 @@ ProcPanoramiXGetScreenSize(ClientPtr client) xPanoramiXGetScreenSizeReply rep; int n, rc; + if (stuff->screen >= PanoramiXNumScreens) + return BadMatch; + REQUEST_SIZE_MATCH(xPanoramiXGetScreenSizeReq); rc = dixLookupWindow(&pWin, stuff->window, client, DixGetAttrAccess); if (rc != Success) @@ -987,11 +992,15 @@ ProcPanoramiXGetScreenSize(ClientPtr client) /* screen dimensions */ rep.width = panoramiXdataPtr[stuff->screen].width; rep.height = panoramiXdataPtr[stuff->screen].height; + rep.window = stuff->window; + rep.screen = stuff->screen; if (client->swapped) { swaps (&rep.sequenceNumber, n); swapl (&rep.length, n); - swaps (&rep.width, n); - swaps (&rep.height, n); + swapl (&rep.width, n); + swapl (&rep.height, n); + swapl (&rep.window, n); + swapl (&rep.screen, n); } WriteToClient (client, sizeof (xPanoramiXGetScreenSizeReply), (char *) &rep); return client->noClientException; |