diff options
| author | Julien Cristau <jcristau@debian.org> | 2011-01-23 13:35:54 +0100 |
|---|---|---|
| committer | Julien Cristau <jcristau@debian.org> | 2011-02-15 12:19:59 +0100 |
| commit | 402b329c3aa8ddbebaa1f593306a02d4cd6fed26 (patch) | |
| tree | e81084ba6ff67bd9927bc280f87d48e6705f379e /glx/glxcmdsswap.c | |
| parent | 1137c11be0f82049d28024eaf963c6f76e0d4334 (diff) | |
glx: Work around wrong request lengths sent by mesa
mesa used to send too long requests for GLXDestroyPixmap,
GLXDestroyWindow, GLXChangeDrawableAttributes, GLXGetDrawableAttributes
and GLXGetFBConfigsSGIX.
Fixes a regression introduced in ec9c97c6bf70b523bc500bd3adf62176f1bb33a4
X.Org bug#33324 <https://bugs.freedesktop.org/show_bug.cgi?id=33324>
Reported-by: xunx.fang@intel.com
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Diffstat (limited to 'glx/glxcmdsswap.c')
| -rw-r--r-- | glx/glxcmdsswap.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c index d58de6299..76e6fb629 100644 --- a/glx/glxcmdsswap.c +++ b/glx/glxcmdsswap.c @@ -279,7 +279,7 @@ int __glXDispSwap_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc) xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq); + REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq); __GLX_SWAP_INT(&req->screen); return __glXDisp_GetFBConfigsSGIX(cl, pc); @@ -368,7 +368,7 @@ int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc) xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq); + REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->glxpixmap); @@ -476,7 +476,9 @@ int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc) client->errorValue = req->numAttribs; return BadValue; } - REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3); + if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len) + return BadLength; + attribs = (CARD32*)(req + 1); __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1); @@ -542,7 +544,7 @@ int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc) xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXDestroyWindowReq); + REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq); __GLX_SWAP_INT(&req->glxwindow); @@ -742,7 +744,7 @@ int __glXDispSwap_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc) xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc; __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq); + REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->drawable); |