summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2014-12-16randr: Use Monitor list for Xineramarandr-monitorsKeith Packard1-90/+20
This replaces the CRTC-based Xinerama implementation with one which uses Monitors instead, allowing clients to manipulate the Xinerama configuration through the RandR Monitor list. Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-16randr: Add Monitor supportKeith Packard7-1/+818
Store the user-defined monitors in the RandR screen private. Generate a list of monitors from both the user-defined ones and from any outputs not mentioned in one of the user-defined monitors. This list covers both the outputs in the main screen as well as any slaves. Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-13modesetting: Enable Xv when using glamorKeith Packard1-0/+13
This just calls the existing function to create the relevant Xv adaptor and hook it up. Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-13present: When composited, get the bits into the window pixmap immediatelypresent-compositorKeith Packard1-0/+17
When a window is composited, we want to notify the compositing manager of the new contents *before* the next frame, so that it can prepare them for display at the next frame, instead of doing the copy at that frame time, and notifying the compositor so that it would always be a frame behind. This change catches the common case of a operation destined for the next frame and immediately performs the copy, leaving the queue entry around so that the PresentComplete event can be delivered at the target frame time. This should give applications the right answer if the Compositor is able to get the frame constructed before that frame happens, which is at least better than the current situation where the client receives the PresentComplete notify at the target frame, but the contents will not be displayed until a subsequent frame. Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-13present: Create helper functions for the copy and idle stepsKeith Packard2-16/+42
There were two instances of calls that cleaned up after a vblank was done with the pixmap and related idle_fence, one invoked after the copy was performed and the other when the vblank was skipped because a newer operation was queued. Now these two shared the present_vblank_idle helper function, which idles the pixmap, destroys the fence and resets the vblank state. Some of this work wasn't done in the old copy version because it would also happen when the vblank was destroyed soon after the copy was performed, but we'll want to clean up the pixmap-related objects right after the copy when the compositor improvements are added next. Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-12present: Store current present mode in vblank instead of just flip booleanKeith Packard2-26/+20
This changes the 'flip' boolean in the present structure to hold the PresentComplete mode value, which gives us precise information about whether the operation has been skipped, copied or flipped without having to intuit that from the state of the pixmap, window and flip values. Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-11glamor: Make sure glamor_egl_close_screen wraps glamor_close_screenMichel Dänzer1-3/+3
The other way around fails to destroy the screen pixmap EGL image: ==1782== 80 (32 direct, 48 indirect) bytes in 1 blocks are definitely lost in loss record 981 of 2,171 ==1782== at 0x4C28C20: malloc (vg_replace_malloc.c:296) ==1782== by 0xF9D4BD2: dri2_create_image_from_dri (egl_dri2.c:1264) ==1782== by 0xF9D4BD2: dri2_create_image_dma_buf (egl_dri2.c:1764) ==1782== by 0xF9D4BD2: dri2_create_image_khr (egl_dri2.c:1798) ==1782== by 0xF9C7937: eglCreateImageKHR (eglapi.c:1494) ==1782== by 0x85D5655: _glamor_egl_create_image (glamor_egl.c:134) ==1782== by 0x85D5655: glamor_egl_create_textured_pixmap (glamor_egl.c:302) ==1782== by 0x85D579B: glamor_egl_create_textured_screen (glamor_egl.c:225) ==1782== by 0xC1BE05D: radeon_glamor_create_screen_resources (radeon_glamor.c:67) ==1782== by 0xC1B6153: RADEONCreateScreenResources_KMS (radeon_kms.c:258) ==1782== by 0x4B2105: xf86CrtcCreateScreenResources (xf86Crtc.c:709) ==1782== by 0x43C823: dix_main (main.c:223) ==1782== by 0x6CFAB44: (below main) (libc-start.c:287) Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-11glamor: Make glamor_destroy_textured_pixmap idempotentMichel Dänzer2-2/+1
For robustness against drivers which may call both glamor_(egl_)destroy_textured_pixmap and glamor_destroy_pixmap. Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-11glamor: Make glamor_set_pixmap_private not crash if the pixmap has no fboMichel Dänzer1-2/+5
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-11glamor: Fix use-after-free in glamor_destroy_textured_pixmapMichel Dänzer1-3/+4
==25551== Invalid read of size 8 ==25551== at 0x85D5F2C: glamor_egl_destroy_pixmap_image (glamor_egl.c:527) ==25551== by 0x85D7750: glamor_destroy_pixmap (glamor.c:235) ==25551== by 0xC1BDD9B: radeon_glamor_destroy_pixmap (radeon_glamor.c:278) ==25551== by 0x5098F6: FreePicture (picture.c:1425) ==25551== by 0x85DD7A9: glamor_unrealize_glyph_caches (glamor_glyphs.c:257) ==25551== by 0x85D7B50: glamor_close_screen (glamor.c:586) ==25551== by 0x4B1A82: xf86CrtcCloseScreen (xf86Crtc.c:734) ==25551== by 0x4CFFC7: CursorCloseScreen (cursor.c:187) ==25551== by 0x513A44: AnimCurCloseScreen (animcur.c:106) ==25551== by 0x51529B: present_close_screen (present_screen.c:64) ==25551== by 0x43CA83: dix_main (main.c:351) ==25551== by 0x6CFAB44: (below main) (libc-start.c:287) ==25551== Address 0x83dafa0 is 96 bytes inside a block of size 152 free'd ==25551== at 0x4C29E90: free (vg_replace_malloc.c:473) ==25551== by 0x85D76B4: glamor_destroy_textured_pixmap (glamor.c:225) ==25551== by 0x85D7750: glamor_destroy_pixmap (glamor.c:235) ==25551== by 0xC1BDD9B: radeon_glamor_destroy_pixmap (radeon_glamor.c:278) ==25551== by 0x5098F6: FreePicture (picture.c:1425) ==25551== by 0x85DD7A9: glamor_unrealize_glyph_caches (glamor_glyphs.c:257) ==25551== by 0x85D7B50: glamor_close_screen (glamor.c:586) ==25551== by 0x4B1A82: xf86CrtcCloseScreen (xf86Crtc.c:734) ==25551== by 0x4CFFC7: CursorCloseScreen (cursor.c:187) ==25551== by 0x513A44: AnimCurCloseScreen (animcur.c:106) ==25551== by 0x51529B: present_close_screen (present_screen.c:64) ==25551== by 0x43CA83: dix_main (main.c:351) Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-11Solaris: delete undocumented, unuseful -protect0 flagAlan Coopersmith1-31/+0
Solaris already makes the page at address 0 inaccessible by default to catch NULL pointer bugs, we don't need a double secret undocumented flag to try to make our own hacky attempt at it. As a bonus, deleting this code removes gcc warning of: sun_init.c: In function 'xf86OpenConsole': sun_init.c:103:17: warning: declaration of 'fd' shadows a previous local [-Wshadow] int fd = -1; ^ sun_init.c:89:9: warning: shadowed declaration is here [-Wshadow] int fd; ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Mark Kettenis <kettenis@openbsd.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-11modesetting: Use GBM for buffer allocations if Glamor supports it.Kenneth Graunke3-8/+68
For performance, Glamor wants to render to tiled buffers, not linear ones. Using GBM allows us to pick the 3D driver's preferred tiling modes. v2: Declare drmmode->gbm as void * if !GLAMOR_HAS_GBM. v3: Just use a forward declaration of struct gbm_device. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-11glamor: Add an accessor for the GBM device.Dave Airlie2-0/+14
(Originally written by Dave Airlie; split into a separate patch by Kenneth Graunke.) Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-11modesetting: Create a drmmode_bo wrapper; use it for front_bo.Kenneth Graunke3-24/+61
This code is going to be extended to support GBM BOs soon. This small abstraction removes a lot of direct dumb_bo access, so we can add that support in one place, rather than putting conditionals at every pitch/handle/etc access. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-11modesetting: Drop dumb_bo::map_count field and dead unmap code.Kenneth Graunke2-11/+0
The drm kernel API for dumb BOs apparently doesn't include an unmap ioctl, so we can't do much here. It looks like this code was copied from libkms, which was also unfinished. We may as well delete the dead variable that simply gets incremented and never read. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-11modesetting: Move dumb_bo into its own source files.Kenneth Graunke5-117/+194
Eventually, drmmode_display will be able to use GBM for handling buffers, and won't need dumb_bo. Keeping the display related logic and buffer object abstraction in separate files seems a bit tidier. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-11modesetting: Create helper for glamor_egl_create_textured_screen call.Kenneth Graunke3-24/+28
This will need to change when we add GBM support; by pulling it into a helper function, we should only have to edit one place. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-11modesetting: Move ModifyPixmapHeader calls out of if/else branches.Kenneth Graunke1-10/+6
Both branches called ModifyPixmapHeader with essentially the same parameters. By using new_pixels in the shadowfb case, we can make them completely the same, and move them out a level, for simplicity. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-11modesetting: Stop using glamor_egl_create_textured_screen_ext().Kenneth Graunke2-12/+10
The _ext variant takes an additional pointer argument, which it now ignores, thanks to Keith's recent patches. Signed-off-by: Kenneth Graunke <kenneth@whitecape.org> Tested-by: Jason Ekstrand <jason.ekstrand@intel.com> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-12-10glamor: Reinstate glamor_(egl_)destroy_textured_pixmapMichel Dänzer3-2/+15
They are part of the ABI. Signed-off-by: Michel Dänzer <michel.daenzer@amd.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-09glx: Add implementation of __GLXContext->loseCurrent for direct ctxtsNeil Roberts1-0/+7
This adds a dummy implementation for the loseCurrent function in __GLXContext for direct contexts which just returns GL_TRUE. Without this then the X server can crash if receives a MakeCurrent message for a direct context because it will attempt to call loseCurrent when cleaning up the client in the callback for ClientStateGone. [ajax: added assumed s-o-b line] Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86531 Reviewed-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Neil Roberts <neil@linux.intel.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-12-09Merge remote-tracking branch 'alanc/master'Keith Packard56-315/+898
2014-12-09dix: GetHosts bounds check using wrong pointer value [CVE-2014-8092 pt. 6]Keith Packard1-1/+1
GetHosts saves the pointer to allocated memory in *data, and then wants to bounds-check writes to that region, but was mistakenly using a bare 'data' instead of '*data'. Also, data is declared as void **, so we need a cast to turn it into a byte pointer so we can actually do pointer comparisons. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-09Missing parens in REQUEST_FIXED_SIZE macro [CVE-2014-8092 pt. 5]Keith Packard1-1/+1
The 'n' parameter must be surrounded by parens in both places to prevent precedence from mis-computing things. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-09glx: Can't mix declarations and code in X.org sources [CVE-2014-8098 pt. 9]Keith Packard1-1/+2
We're using compiler compatibility settings which generate warnings when a variable is declared after the first statement. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-09dbe: Call to DDX SwapBuffers requires address of int, not unsigned int ↵Keith Packard1-2/+4
[CVE-2014-8097 pt. 2] When the local types used to walk the DBE request were changed, this changed the type of the parameter passed to the DDX SwapBuffers API, but there wasn't a matching change in the API definition. At this point, with the API frozen, I just stuck a new variable in with the correct type. Because we've already bounds-checked nStuff to be smaller than UINT32_MAX / sizeof(DbeSwapInfoRec), we know it will fit in a signed int without overflow. Signed-off-by: Keith Packard <keithp@keithp.com Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-09glamor: Free existing EGL image when assigning new oneKeith Packard1-7/+21
When reallocating the framebuffer on screen resize, the old EGL image was getting leaked. Check for an existing EGL image and free it in this case. Signed-off-by: Keith Packard <keithp@keithp.com> Revewied-by: Zhigang Gong <zhigang.gong@linux.intel.com>
2014-12-09glamor: Remove redundant reference to screen pixmap EGL imageKeith Packard1-12/+1
There's no reason to store this in the egl screen private as the screen pixmap will always hold a reference to it anyways. Signed-off-by: Keith Packard <keithp@keithp.com> Revewied-by: Zhigang Gong <zhigang.gong@linux.intel.com>
2014-12-09glamor: Always destroy EGL image associated with destroyed pixmapKeith Packard6-58/+19
There were three paths that called eglDestroyImageKHR: * The front buffer * The intel driver's flip buffer * pixmaps under DRI3 This patch unifies the second two by having glamor_destroy_pixmap always destroy any associaged EGL image. This allows us to stop storing the back_pixmap pointer in glamor as that was only used to make sure that buffer was freed at server reset time. v2: check for valid pixmap_priv before using it in glamor_egl_destroy_pixmap_image Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Zhigang Gong <zhigang.gong@linux.intel.com>
2014-12-08glx: Fix mask truncation in __glXGetAnswerBuffer [CVE-2014-8093 6/6]Robert Morell1-1/+1
On a system where sizeof(unsigned) != sizeof(intptr_t), the unary bitwise not operation will result in a mask that clears all high bits from temp_buf in the expression: temp_buf = (temp_buf + mask) & ~mask; Signed-off-by: Robert Morell <rmorell@nvidia.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098 8/8]Adam Jackson5-154/+205
v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Length checking for non-generated single requests (v2) [CVE-2014-8098 7/8]Adam Jackson5-29/+95
v2: Fix single versus vendor-private length checking for ARB_imaging subset extensions. (Julien Cristau) v3: Fix single versus vendor-private length checking for ARB_imaging subset extensions. (Julien Cristau) Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Length-checking for non-generated vendor private requests ↵Adam Jackson2-0/+4
[CVE-2014-8098 6/8] Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Request length checks for SetClientInfoARB [CVE-2014-8098 5/8]Adam Jackson1-5/+14
Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Top-level length checking for swapped VendorPrivate requests ↵Adam Jackson1-0/+4
[CVE-2014-8098 4/8] Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8]Adam Jackson1-23/+34
This is a half-measure until we start passing request length into the varsize function, but it's better than the nothing we had before. v2: Verify that there's at least a large render header's worth of dataBytes (Julien Cristau) Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Integer overflow protection for non-generated render requests (v3) ↵Adam Jackson1-36/+41
[CVE-2014-8093 5/6] v2: Fix constants in __glXMap2fReqSize (Michal Srb) Validate w/h/d for proxy targets too (Keith Packard) v3: Fix Map[12]Size to correctly reject order == 0 (Julien Cristau) Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Length checking for GLXRender requests (v2) [CVE-2014-8098 2/8]Julien Cristau1-11/+10
v2: Remove can't-happen comparison for cmdlen < 0 (Michal Srb) Reviewed-by: Adam Jackson <ajax@redhat.com> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Add safe_{add,mul,pad} (v3) [CVE-2014-8093 4/6]Adam Jackson1-0/+41
These are paranoid about integer overflow, and will return -1 if their operation would overflow a (signed) integer or if either argument is negative. Note that RenderLarge requests are sized with a uint32_t so in principle this could be sketchy there, but dix limits bigreqs to 128M so you shouldn't ever notice, and honestly if you're sending more than 2G of rendering commands you're already doing something very wrong. v2: Use INT_MAX for consistency with the rest of the server (jcristau) v3: Reject negative arguments (anholt) Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Fix image size computation for EXT_texture_integer [CVE-2014-8098 1/8]Adam Jackson1-0/+10
Without this we'd reject the request with BadLength. Note that some old versions of Mesa had a bug in the same place, and would _send_ zero bytes of image data; these will now be rejected, correctly. Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Additional paranoia in __glXGetAnswerBuffer / __GLX_GET_ANSWER_BUFFER ↵Adam Jackson2-2/+8
(v2) [CVE-2014-8093 3/6] If the computed reply size is negative, something went wrong, treat it as an error. v2: Be more careful about size_t being unsigned (Matthieu Herrb) v3: SIZE_MAX not SIZE_T_MAX (Alan Coopersmith) Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093 2/6]Adam Jackson2-16/+16
Before this we'd just clamp the image size to 0, which was just hideously stupid; if the parameters were such that they'd overflow an integer, you'd allocate a small buffer, then pass huge values into (say) ReadPixels, and now you're scribbling over arbitrary server memory. Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08glx: Be more paranoid about variable-length requests [CVE-2014-8093 1/6]Adam Jackson1-2/+2
If the size computation routine returns -1 we should just reject the request outright. Clamping it to zero could give an attacker the opportunity to also mangle cmdlen in such a way that the subsequent length check passes, and the request would get executed, thus passing data we wanted to reject to the renderer. Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08Add REQUEST_FIXED_SIZE testcases to test/misc.cAlan Coopersmith1-0/+37
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08Add request length checking test cases for some Xinput 2.x requestsAlan Coopersmith4-0/+20
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08Add request length checking test cases for some Xinput 1.x requestsAlan Coopersmith4-1/+158
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08xfixes: unvalidated length in SProcXFixesSelectSelectionInput [CVE-2014-8102]Alan Coopersmith1-0/+1
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08render: unvalidated lengths in Render extn. swapped procs [CVE-2014-8100 2/2]Alan Coopersmith1-1/+15
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08render: check request size before reading it [CVE-2014-8100 1/2]Julien Cristau1-2/+2
Otherwise we may be reading outside of the client request. Signed-off-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-12-08randr: unvalidated lengths in RandR extension swapped procs [CVE-2014-8101]Alan Coopersmith1-0/+4
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-03 00:48:01 +0000