glxproxy: Use _XEatDataWords (from Xlib 1.6) instead of _XEatData

Reduces risk of overflow from converting length field in X replies
from words to bytes.   (Also seems to be what several calls were
already incorrectly passing to _XEatData.)

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

4 files changed, 8 insertions, 8 deletions

diff --git a/hw/dmx/glxProxy/glxcmds.c b/hw/dmx/glxProxy/glxcmds.c
index 0e817ca07..8cdb25ec6 100644
--- a/hw/dmx/glxProxy/glxcmds.c
+++ b/hw/dmx/glxProxy/glxcmds.c
@@ -2610,7 +2610,7 @@ __glXQueryExtensionsString(__GLXclientState * cl, GLbyte * pc)
     be_buf = (char *) malloc(numbytes);
     if (!be_buf) {
         /* Throw data on the floor */
-        _XEatData(dpy, len);
+        _XEatDataWords(dpy, len);
     }
     else {
         _XReadPad(dpy, (char *) be_buf, numbytes);
@@ -2691,7 +2691,7 @@ __glXQueryServerString(__GLXclientState * cl, GLbyte * pc)
     be_buf = (char *) malloc(numbytes);
     if (!be_buf) {
         /* Throw data on the floor */
-        _XEatData(dpy, len);
+        _XEatDataWords(dpy, len);
     }
     else {
         _XReadPad(dpy, (char *) be_buf, numbytes);
diff --git a/hw/dmx/glxProxy/glxscreens.c b/hw/dmx/glxProxy/glxscreens.c
index 746d94e07..138afedf2 100644
--- a/hw/dmx/glxProxy/glxscreens.c
+++ b/hw/dmx/glxProxy/glxscreens.c
@@ -154,7 +154,7 @@ CalcServerVersionAndExtensions(void)
         be_extensions[s] = (char *) malloc(numbytes);
         if (!be_extensions[s]) {
             /* Throw data on the floor */
-            _XEatData(dpy, length);
+            _XEatDataWords(dpy, length);
         }
         else {
             _XReadPad(dpy, (char *) be_extensions[s], numbytes);
diff --git a/hw/dmx/glxProxy/glxsingle.c b/hw/dmx/glxProxy/glxsingle.c
index e60cfeb70..abfb880a3 100644
--- a/hw/dmx/glxProxy/glxsingle.c
+++ b/hw/dmx/glxProxy/glxsingle.c
@@ -258,7 +258,7 @@ __glXForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc)
         }
         else {
             /* Throw data on the floor */
-            _XEatData(dpy, be_buf_size);
+            _XEatDataWords(dpy, be_reply.length);
             return BadAlloc;
         }
     }
@@ -357,7 +357,7 @@ __glXForwardAllWithReply(__GLXclientState * cl, GLbyte * pc)
             }
             else {
                 /* Throw data on the floor */
-                _XEatData(dpy, be_buf_size);
+                _XEatDataWords(dpy, be_reply.length);
                 return BadAlloc;
             }
         }
@@ -993,7 +993,7 @@ __glXDisp_ReadPixels(__GLXclientState * cl, GLbyte * pc)
                     }
                     else {
                         /* Throw data on the floor */
-                        _XEatData(dpy, be_buf_size);
+                        _XEatDataWords(dpy, be_reply.length);
                         free(buf);
                         return BadAlloc;
                     }
diff --git a/hw/dmx/glxProxy/glxvendor.c b/hw/dmx/glxProxy/glxvendor.c
index 5777c6acc..50d505c4b 100644
--- a/hw/dmx/glxProxy/glxvendor.c
+++ b/hw/dmx/glxProxy/glxvendor.c
@@ -246,7 +246,7 @@ __glXVForwardPipe0WithReply(__GLXclientState * cl, GLbyte * pc)
         }
         else {
             /* Throw data on the floor */
-            _XEatData(dpy, be_buf_size);
+            _XEatDataWords(dpy, be_reply.length);
             return BadAlloc;
         }
     }
@@ -340,7 +340,7 @@ __glXVForwardAllWithReply(__GLXclientState * cl, GLbyte * pc)
             }
             else {
                 /* Throw data on the floor */
-                _XEatData(dpy, be_buf_size);
+                _XEatDataWords(dpy, be_reply.length);
                 return BadAlloc;
             }
         }