This is an automated email from the git hooks/post-receive script. x2go pushed a commit to branch 3.6.x in repository nx-libs. commit 1ea1cd8c4f93b0c03e5b34fe174b3fc9f27c7dfa Author: Adam Jackson <ajax@redhat.com> Date: Mon Nov 10 12:13:48 2014 -0500 glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098 8/8] (V3) v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) v3: RHEL5 backport v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Michal Srb <msrb@suse.com> Reviewed-by: Andy Ritger <aritger@nvidia.com> Signed-off-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Fedora X Ninjas <x@fedoraproject.org> Signed-off-by: Dave Airlie <airlied@redhat.com> --- nx-X11/programs/Xserver/GL/glx/glxcmds.c | 6 +- nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c | 7 +- nx-X11/programs/Xserver/GL/glx/glxserver.h | 90 +++++++++---------- nx-X11/programs/Xserver/GL/glx/rensize.c | 125 ++++++++++++++------------ 4 files changed, 121 insertions(+), 107 deletions(-) diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmds.c b/nx-X11/programs/Xserver/GL/glx/glxcmds.c index 20c12f3..a1bb259 100644 --- a/nx-X11/programs/Xserver/GL/glx/glxcmds.c +++ b/nx-X11/programs/Xserver/GL/glx/glxcmds.c @@ -1490,7 +1490,7 @@ int __glXRender(__GLXclientState *cl, GLbyte *pc) if (entry->varsize) { /* variable size command */ - extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, False); + extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, False, left - __GLX_RENDER_HDR_SIZE); if (extra < 0) { return BadLength; } @@ -1563,6 +1563,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) if (cl->largeCmdRequestsSoFar == 0) { __GLXrenderSizeData *entry; int extra = 0, cmdlen; + int left = (req->length << 2) - sz_xGLXRenderLargeReq; /* ** This is the first request of a multi request command. ** Make enough space in the buffer, then copy the entire request. @@ -1608,7 +1609,8 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) ** be computed from its parameters), all the parameters needed ** will be in the 1st request, so it's okay to do this. */ - extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, False); + extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, False, + left - __GLX_RENDER_LARGE_HDR_SIZE); if (extra < 0) { return BadLength; } diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c index 2e228c0..33a748a 100644 --- a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c +++ b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c @@ -541,7 +541,8 @@ int __glXSwapRender(__GLXclientState *cl, GLbyte *pc) if (entry->varsize) { /* variable size command */ - extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, True); + extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, True, + left - __GLX_RENDER_HDR_SIZE); if (extra < 0) { return BadLength; } @@ -620,6 +621,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) if (cl->largeCmdRequestsSoFar == 0) { __GLXrenderSizeData *entry; int extra = 0; + int left = (req->length << 2) - sz_xGLXRenderLargeReq; size_t cmdlen; /* ** This is the first request of a multi request command. @@ -667,7 +669,8 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) ** be computed from its parameters), all the parameters needed ** will be in the 1st request, so it's okay to do this. */ - extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, True); + extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, True, + left - __GLX_RENDER_LARGE_HDR_SIZE); if (extra < 0) { return BadLength; } diff --git a/nx-X11/programs/Xserver/GL/glx/glxserver.h b/nx-X11/programs/Xserver/GL/glx/glxserver.h index 4047574..193ebcb 100644 --- a/nx-X11/programs/Xserver/GL/glx/glxserver.h +++ b/nx-X11/programs/Xserver/GL/glx/glxserver.h @@ -179,7 +179,7 @@ extern __GLXprocPtr __glXProcTable[]; */ typedef struct { int bytes; - int (*varsize)(GLbyte *pc, Bool swap); + int (*varsize)(GLbyte *pc, Bool swap, int left); } __GLXrenderSizeData; extern __GLXrenderSizeData __glXRenderSizeTable[]; extern __GLXrenderSizeData __glXRenderSizeTable_EXT[]; @@ -271,48 +271,48 @@ extern int __glXImageSize(GLenum format, GLenum type, GLint imageHeight, GLint rowLength, GLint skipImages, GLint skipRows, GLint alignment); -extern int __glXCallListsReqSize(GLbyte *pc, Bool swap); -extern int __glXBitmapReqSize(GLbyte *pc, Bool swap); -extern int __glXFogfvReqSize(GLbyte *pc, Bool swap); -extern int __glXFogivReqSize(GLbyte *pc, Bool swap); -extern int __glXLightfvReqSize(GLbyte *pc, Bool swap); -extern int __glXLightivReqSize(GLbyte *pc, Bool swap); -extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap); -extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap); -extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap); -extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap); -extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap); -extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap); -extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap); -extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap); -extern int __glXMap1dReqSize(GLbyte *pc, Bool swap); -extern int __glXMap1fReqSize(GLbyte *pc, Bool swap); -extern int __glXMap2dReqSize(GLbyte *pc, Bool swap); -extern int __glXMap2fReqSize(GLbyte *pc, Bool swap); -extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap); -extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap); -extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap); -extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap); -extern int __glXDrawArraysSize(GLbyte *pc, Bool swap); -extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap); -extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap); -extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ); -extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap); -extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap); -extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap); -extern int __glXColorTableReqSize(GLbyte *pc, Bool swap); -extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap); -extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap); -extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap); +extern int __glXCallListsReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXBitmapReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXFogfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXFogivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap1dReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap1fReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap2dReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXMap2fReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXDrawArraysSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap, int reqlen ); +extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorTableReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); /* * Routines for computing the size of returned data. @@ -322,7 +322,7 @@ extern int __glXConvolutionParameterfvSize(GLenum pname); extern int __glXColorTableParameterfvSize(GLenum pname); extern int __glXColorTableParameterivSize(GLenum pname); -extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap); -extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap); +extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap, int reqlen); +extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap, int reqlen); #endif /* !__GLX_server_h__ */ diff --git a/nx-X11/programs/Xserver/GL/glx/rensize.c b/nx-X11/programs/Xserver/GL/glx/rensize.c index 9bf0d00..dc3475e 100644 --- a/nx-X11/programs/Xserver/GL/glx/rensize.c +++ b/nx-X11/programs/Xserver/GL/glx/rensize.c @@ -48,7 +48,7 @@ (((a & 0xff000000U)>>24) | ((a & 0xff0000U)>>8) | \ ((a & 0xff00U)<<8) | ((a & 0xffU)<<24)) -int __glXCallListsReqSize(GLbyte *pc, Bool swap ) +int __glXCallListsReqSize(GLbyte *pc, Bool swap, int reqlen) { GLsizei n = *(GLsizei *)(pc + 0); GLenum type = *(GLenum *)(pc + 4); @@ -60,7 +60,7 @@ int __glXCallListsReqSize(GLbyte *pc, Bool swap ) return n * __glCallLists_size( type ); } -int __glXFogivReqSize(GLbyte *pc, Bool swap ) +int __glXFogivReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 0); if (swap) { @@ -69,12 +69,12 @@ int __glXFogivReqSize(GLbyte *pc, Bool swap ) return 4 * __glFogiv_size( pname ); /* defined in samplegl lib */ } -int __glXFogfvReqSize(GLbyte *pc, Bool swap ) +int __glXFogfvReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXFogivReqSize( pc, swap ); + return __glXFogivReqSize( pc, swap, reqlen); } -int __glXLightfvReqSize(GLbyte *pc, Bool swap ) +int __glXLightfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -83,12 +83,12 @@ int __glXLightfvReqSize(GLbyte *pc, Bool swap ) return 4 * __glLightfv_size( pname ); /* defined in samplegl lib */ } -int __glXLightivReqSize(GLbyte *pc, Bool swap ) +int __glXLightivReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXLightfvReqSize( pc, swap ); + return __glXLightfvReqSize( pc, swap, reqlen); } -int __glXLightModelfvReqSize(GLbyte *pc, Bool swap ) +int __glXLightModelfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 0); if (swap) { @@ -97,12 +97,12 @@ int __glXLightModelfvReqSize(GLbyte *pc, Bool swap ) return 4 * __glLightModelfv_size( pname ); /* defined in samplegl lib */ } -int __glXLightModelivReqSize(GLbyte *pc, Bool swap ) +int __glXLightModelivReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXLightModelfvReqSize( pc, swap ); + return __glXLightModelfvReqSize( pc, swap, reqlen); } -int __glXMaterialfvReqSize(GLbyte *pc, Bool swap ) +int __glXMaterialfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -111,12 +111,12 @@ int __glXMaterialfvReqSize(GLbyte *pc, Bool swap ) return 4 * __glMaterialfv_size( pname ); /* defined in samplegl lib */ } -int __glXMaterialivReqSize(GLbyte *pc, Bool swap ) +int __glXMaterialivReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXMaterialfvReqSize( pc, swap ); + return __glXMaterialfvReqSize( pc, swap, reqlen); } -int __glXTexGendvReqSize(GLbyte *pc, Bool swap ) +int __glXTexGendvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -125,7 +125,7 @@ int __glXTexGendvReqSize(GLbyte *pc, Bool swap ) return 8 * __glTexGendv_size( pname ); /* defined in samplegl lib */ } -int __glXTexGenfvReqSize(GLbyte *pc, Bool swap ) +int __glXTexGenfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -134,12 +134,12 @@ int __glXTexGenfvReqSize(GLbyte *pc, Bool swap ) return 4 * __glTexGenfv_size( pname ); /* defined in samplegl lib */ } -int __glXTexGenivReqSize(GLbyte *pc, Bool swap ) +int __glXTexGenivReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXTexGenfvReqSize( pc, swap ); + return __glXTexGenfvReqSize( pc, swap, reqlen); } -int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap ) +int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -148,12 +148,12 @@ int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap ) return 4 * __glTexParameterfv_size( pname ); /* defined in samplegl lib */ } -int __glXTexParameterivReqSize(GLbyte *pc, Bool swap ) +int __glXTexParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXTexParameterfvReqSize( pc, swap ); + return __glXTexParameterfvReqSize( pc, swap, reqlen); } -int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap ) +int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -162,12 +162,12 @@ int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap ) return 4 * __glTexEnvfv_size( pname ); /* defined in samplegl lib */ } -int __glXTexEnvivReqSize(GLbyte *pc, Bool swap ) +int __glXTexEnvivReqSize(GLbyte *pc, Bool swap, int reqlen ) { - return __glXTexEnvfvReqSize( pc, swap ); + return __glXTexEnvfvReqSize( pc, swap, reqlen); } -int __glXMap1dReqSize(GLbyte *pc, Bool swap ) +int __glXMap1dReqSize(GLbyte *pc, Bool swap, int reqlen ) { GLenum target; GLint order; @@ -183,7 +183,7 @@ int __glXMap1dReqSize(GLbyte *pc, Bool swap ) return safe_mul(8, safe_mul(__glMap1d_size(target), order)); } -int __glXMap1fReqSize(GLbyte *pc, Bool swap ) +int __glXMap1fReqSize(GLbyte *pc, Bool swap, int reqlen ) { GLenum target; GLint order; @@ -205,7 +205,7 @@ static int Map2Size(int k, int majorOrder, int minorOrder) return safe_mul(k, safe_mul(majorOrder, minorOrder)); } -int __glXMap2dReqSize(GLbyte *pc, Bool swap ) +int __glXMap2dReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum target; GLint uorder, vorder; @@ -221,7 +221,7 @@ int __glXMap2dReqSize(GLbyte *pc, Bool swap ) return safe_mul(8, Map2Size(__glMap2d_size(target), uorder, vorder)); } -int __glXMap2fReqSize(GLbyte *pc, Bool swap ) +int __glXMap2fReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum target; GLint uorder, vorder; @@ -237,7 +237,7 @@ int __glXMap2fReqSize(GLbyte *pc, Bool swap ) return safe_mul(4, Map2Size(__glMap2f_size(target), uorder, vorder)); } -int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap ) +int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLint mapsize; mapsize = *(GLint *)(pc + 4); @@ -247,12 +247,12 @@ int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap ) return 4 * mapsize; } -int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap ) +int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXPixelMapfvReqSize( pc, swap ); + return __glXPixelMapfvReqSize( pc, swap, reqlen); } -int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap ) +int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLint mapsize; mapsize = *(GLint *)(pc + 4); @@ -458,7 +458,7 @@ int __glXImageSize( GLenum format, GLenum type, GLenum target, } -int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap ) +int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchDrawPixelsHeader *hdr = (__GLXdispatchDrawPixelsHeader *) pc; GLenum format = hdr->format; @@ -482,7 +482,7 @@ int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, skipRows, alignment ); } -int __glXBitmapReqSize(GLbyte *pc, Bool swap ) +int __glXBitmapReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchBitmapHeader *hdr = (__GLXdispatchBitmapHeader *) pc; GLint w = hdr->width; @@ -502,7 +502,7 @@ int __glXBitmapReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, skipRows, alignment ); } -int __glXTexImage1DReqSize(GLbyte *pc, Bool swap ) +int __glXTexImage1DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc; GLenum target = hdr->target; @@ -531,7 +531,7 @@ int __glXTexImage1DReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, skipRows, alignment ); } -int __glXTexImage2DReqSize(GLbyte *pc, Bool swap ) +int __glXTexImage2DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc; GLenum target = hdr->target; @@ -578,13 +578,14 @@ int __glXTypeSize(GLenum enm) } } -int __glXDrawArraysSize( GLbyte *pc, Bool swap ) +int __glXDrawArraysSize( GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc; __GLXdispatchDrawArraysComponentHeader *compHeader; GLint numVertexes = hdr->numVertexes; GLint numComponents = hdr->numComponents; GLint arrayElementSize = 0; + GLint x, size; int i; if (swap) { @@ -593,6 +594,13 @@ int __glXDrawArraysSize( GLbyte *pc, Bool swap ) } pc += sizeof(__GLXdispatchDrawArraysHeader); + reqlen -= sizeof(__GLXdispatchDrawArraysHeader); + + size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader), + numComponents); + if (size < 0 || reqlen < 0 || reqlen < size) + return -1; + compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc; for (i=0; i<numComponents; i++) { @@ -636,23 +644,24 @@ int __glXDrawArraysSize( GLbyte *pc, Bool swap ) return -1; } - arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype)); + x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype))); + if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0) + return -1; pc += sizeof(__GLXdispatchDrawArraysComponentHeader); } - return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) + - (numVertexes * arrayElementSize)); + return safe_add(size, safe_mul(numVertexes, arrayElementSize)); } -int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap ) +int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap, int reqlen) { GLint n = *(GLsizei *)(pc + 0); if (swap) n = SWAPL(n); return(8*n); /* 4*n for textures, 4*n for priorities */ } -int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap ) +int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc; GLenum format = hdr->format; @@ -674,7 +683,7 @@ int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, skipRows, alignment ); } -int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap ) +int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc; GLenum format = hdr->format; @@ -698,7 +707,7 @@ int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, skipRows, alignment ); } -int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ) +int __glXTexImage3DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchTexImage3DHeader *hdr = (__GLXdispatchTexImage3DHeader *) pc; GLenum target = hdr->target; @@ -735,7 +744,7 @@ int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ) } } -int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap ) +int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchTexSubImage3DHeader *hdr = (__GLXdispatchTexSubImage3DHeader *) pc; @@ -772,7 +781,7 @@ int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap ) } } -int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap ) +int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchConvolutionFilterHeader *hdr = (__GLXdispatchConvolutionFilterHeader *) pc; @@ -795,7 +804,7 @@ int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, 0, alignment ); } -int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap ) +int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchConvolutionFilterHeader *hdr = (__GLXdispatchConvolutionFilterHeader *) pc; @@ -841,7 +850,7 @@ int __glXConvolutionParameterfvSize(GLenum pname) return __glXConvolutionParameterivSize(pname); } -int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap ) +int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -850,12 +859,12 @@ int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap ) return 4 * __glXConvolutionParameterivSize( pname ); } -int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap ) +int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen) { - return __glXConvolutionParameterivReqSize( pc, swap ); + return __glXConvolutionParameterivReqSize( pc, swap, reqlen); } -int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap ) +int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchConvolutionFilterHeader *hdr = (__GLXdispatchConvolutionFilterHeader *) pc; @@ -904,7 +913,7 @@ int __glXColorTableParameterivSize(GLenum pname) return __glXColorTableParameterfvSize(pname); } -int __glXColorTableReqSize(GLbyte *pc, Bool swap ) +int __glXColorTableReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchColorTableHeader *hdr = (__GLXdispatchColorTableHeader *) pc; @@ -939,7 +948,7 @@ int __glXColorTableReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, 0, alignment ); } -int __glXColorSubTableReqSize(GLbyte *pc, Bool swap ) +int __glXColorSubTableReqSize(GLbyte *pc, Bool swap, int reqlen) { __GLXdispatchColorSubTableHeader *hdr = (__GLXdispatchColorSubTableHeader *) pc; @@ -962,7 +971,7 @@ int __glXColorSubTableReqSize(GLbyte *pc, Bool swap ) 0, rowLength, 0, 0, alignment ); } -int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap ) +int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 4); if (swap) { @@ -971,13 +980,13 @@ int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap ) return 4 * __glXColorTableParameterfvSize(pname); } -int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap ) +int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) { /* no difference between fv and iv versions */ - return __glXColorTableParameterfvReqSize(pc, swap); + return __glXColorTableParameterfvReqSize(pc, swap, reqlen); } -int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap ) +int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap, int reqlen) { GLenum pname = *(GLenum *)(pc + 0); if (swap) { @@ -986,8 +995,8 @@ int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap ) return 4 * __glPointParameterfvEXT_size( pname ); } -int __glXPointParameterivReqSize(GLbyte *pc, Bool swap ) +int __glXPointParameterivReqSize(GLbyte *pc, Bool swap, int reqlen) { /* no difference between fv and iv versions */ - return __glXPointParameterfvARBReqSize(pc, swap); + return __glXPointParameterfvARBReqSize(pc, swap, reqlen); } -- Alioth's /srv/git/_hooks_/post-receive-email on /srv/git/code.x2go.org/nx-libs.git