Skip to content

N
nx-libs
Commit 1ea1cd8c authored by Adam Jackson's avatar Adam Jackson Committed by Mike Gabriel
Browse files
Options

glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098 8/8] (V3)

v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) v3: RHEL5 backport v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: 's avatarJulien Cristau <jcristau@debian.org> Reviewed-by: 's avatarMichal Srb <msrb@suse.com> Reviewed-by: 's avatarAndy Ritger <aritger@nvidia.com> Signed-off-by: 's avatarAdam Jackson <ajax@redhat.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: 's avatarFedora X Ninjas <x@fedoraproject.org> Signed-off-by: 's avatarDave Airlie <airlied@redhat.com>
parent 9c558f9c
Hide whitespace changes
Inline Side-by-side
Showing with 121 additions and 107 deletions
nx-X11/programs/Xserver/GL/glx/glxcmds.c
View file @ 1ea1cd8c
...@@ -1490,7 +1490,7 @@ int __glXRender(__GLXclientState *cl, GLbyte *pc) ...@@ -1490,7 +1490,7 @@ int __glXRender(__GLXclientState *cl, GLbyte *pc)
if (entry->varsize) { if (entry->varsize) {
/* variable size command */ /* variable size command */
extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, False); extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, False, left - __GLX_RENDER_HDR_SIZE);
if (extra < 0) { if (extra < 0) {
return BadLength; return BadLength;
} }
...@@ -1563,6 +1563,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) ...@@ -1563,6 +1563,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc)
if (cl->largeCmdRequestsSoFar == 0) { if (cl->largeCmdRequestsSoFar == 0) {
__GLXrenderSizeData *entry; __GLXrenderSizeData *entry;
int extra = 0, cmdlen; int extra = 0, cmdlen;
int left = (req->length << 2) - sz_xGLXRenderLargeReq;
/* /*
** This is the first request of a multi request command. ** This is the first request of a multi request command.
** Make enough space in the buffer, then copy the entire request. ** Make enough space in the buffer, then copy the entire request.
...@@ -1608,7 +1609,8 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) ...@@ -1608,7 +1609,8 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc)
** be computed from its parameters), all the parameters needed ** be computed from its parameters), all the parameters needed
** will be in the 1st request, so it's okay to do this. ** will be in the 1st request, so it's okay to do this.
*/ */
extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, False); extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, False,
left - __GLX_RENDER_LARGE_HDR_SIZE);
if (extra < 0) { if (extra < 0) {
return BadLength; return BadLength;
} }
......
nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c
View file @ 1ea1cd8c
...@@ -541,7 +541,8 @@ int __glXSwapRender(__GLXclientState *cl, GLbyte *pc) ...@@ -541,7 +541,8 @@ int __glXSwapRender(__GLXclientState *cl, GLbyte *pc)
if (entry->varsize) { if (entry->varsize) {
/* variable size command */ /* variable size command */
extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, True); extra = (*entry->varsize)(pc + __GLX_RENDER_HDR_SIZE, True,
left - __GLX_RENDER_HDR_SIZE);
if (extra < 0) { if (extra < 0) {
return BadLength; return BadLength;
} }
...@@ -620,6 +621,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) ...@@ -620,6 +621,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc)
if (cl->largeCmdRequestsSoFar == 0) { if (cl->largeCmdRequestsSoFar == 0) {
__GLXrenderSizeData *entry; __GLXrenderSizeData *entry;
int extra = 0; int extra = 0;
int left = (req->length << 2) - sz_xGLXRenderLargeReq;
size_t cmdlen; size_t cmdlen;
/* /*
** This is the first request of a multi request command. ** This is the first request of a multi request command.
...@@ -667,7 +669,8 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) ...@@ -667,7 +669,8 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc)
** be computed from its parameters), all the parameters needed ** be computed from its parameters), all the parameters needed
** will be in the 1st request, so it's okay to do this. ** will be in the 1st request, so it's okay to do this.
*/ */
extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, True); extra = (*entry->varsize)(pc + __GLX_RENDER_LARGE_HDR_SIZE, True,
left - __GLX_RENDER_LARGE_HDR_SIZE);
if (extra < 0) { if (extra < 0) {
return BadLength; return BadLength;
} }
......
nx-X11/programs/Xserver/GL/glx/glxserver.h
View file @ 1ea1cd8c
...@@ -179,7 +179,7 @@ extern __GLXprocPtr __glXProcTable[]; ...@@ -179,7 +179,7 @@ extern __GLXprocPtr __glXProcTable[];
*/ */
typedef struct { typedef struct {
int bytes; int bytes;
int (*varsize)(GLbyte *pc, Bool swap); int (*varsize)(GLbyte *pc, Bool swap, int left);
} __GLXrenderSizeData; } __GLXrenderSizeData;
extern __GLXrenderSizeData __glXRenderSizeTable[]; extern __GLXrenderSizeData __glXRenderSizeTable[];
extern __GLXrenderSizeData __glXRenderSizeTable_EXT[]; extern __GLXrenderSizeData __glXRenderSizeTable_EXT[];
...@@ -271,48 +271,48 @@ extern int __glXImageSize(GLenum format, GLenum type, ...@@ -271,48 +271,48 @@ extern int __glXImageSize(GLenum format, GLenum type,
GLint imageHeight, GLint rowLength, GLint skipImages, GLint skipRows, GLint imageHeight, GLint rowLength, GLint skipImages, GLint skipRows,
GLint alignment); GLint alignment);
extern int __glXCallListsReqSize(GLbyte *pc, Bool swap); extern int __glXCallListsReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXBitmapReqSize(GLbyte *pc, Bool swap); extern int __glXBitmapReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXFogfvReqSize(GLbyte *pc, Bool swap); extern int __glXFogfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXFogivReqSize(GLbyte *pc, Bool swap); extern int __glXFogivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXLightfvReqSize(GLbyte *pc, Bool swap); extern int __glXLightfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXLightivReqSize(GLbyte *pc, Bool swap); extern int __glXLightivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap); extern int __glXLightModelfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap); extern int __glXLightModelivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap); extern int __glXMaterialfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap); extern int __glXMaterialivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap); extern int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap); extern int __glXTexParameterivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap); extern int __glXTexImage1DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap); extern int __glXTexImage2DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap); extern int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap); extern int __glXTexEnvivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap); extern int __glXTexGendvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap); extern int __glXTexGenfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap); extern int __glXTexGenivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXMap1dReqSize(GLbyte *pc, Bool swap); extern int __glXMap1dReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXMap1fReqSize(GLbyte *pc, Bool swap); extern int __glXMap1fReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXMap2dReqSize(GLbyte *pc, Bool swap); extern int __glXMap2dReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXMap2fReqSize(GLbyte *pc, Bool swap); extern int __glXMap2fReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap); extern int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap); extern int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap); extern int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap); extern int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXDrawArraysSize(GLbyte *pc, Bool swap); extern int __glXDrawArraysSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap); extern int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap); extern int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap); extern int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ); extern int __glXTexImage3DReqSize(GLbyte *pc, Bool swap, int reqlen );
extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap); extern int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap); extern int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap); extern int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap); extern int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap); extern int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap); extern int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXColorTableReqSize(GLbyte *pc, Bool swap); extern int __glXColorTableReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap); extern int __glXColorSubTableReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap); extern int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap); extern int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap, int reqlen);
/* /*
* Routines for computing the size of returned data. * Routines for computing the size of returned data.
...@@ -322,7 +322,7 @@ extern int __glXConvolutionParameterfvSize(GLenum pname); ...@@ -322,7 +322,7 @@ extern int __glXConvolutionParameterfvSize(GLenum pname);
extern int __glXColorTableParameterfvSize(GLenum pname); extern int __glXColorTableParameterfvSize(GLenum pname);
extern int __glXColorTableParameterivSize(GLenum pname); extern int __glXColorTableParameterivSize(GLenum pname);
extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap); extern int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap, int reqlen);
extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap); extern int __glXPointParameterivReqSize(GLbyte *pc, Bool swap, int reqlen);
#endif /* !__GLX_server_h__ */ #endif /* !__GLX_server_h__ */
nx-X11/programs/Xserver/GL/glx/rensize.c
View file @ 1ea1cd8c
...@@ -48,7 +48,7 @@ ...@@ -48,7 +48,7 @@
(((a & 0xff000000U)>>24) | ((a & 0xff0000U)>>8) | \ (((a & 0xff000000U)>>24) | ((a & 0xff0000U)>>8) | \
((a & 0xff00U)<<8) | ((a & 0xffU)<<24)) ((a & 0xff00U)<<8) | ((a & 0xffU)<<24))
int __glXCallListsReqSize(GLbyte *pc, Bool swap ) int __glXCallListsReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLsizei n = *(GLsizei *)(pc + 0); GLsizei n = *(GLsizei *)(pc + 0);
GLenum type = *(GLenum *)(pc + 4); GLenum type = *(GLenum *)(pc + 4);
...@@ -60,7 +60,7 @@ int __glXCallListsReqSize(GLbyte *pc, Bool swap ) ...@@ -60,7 +60,7 @@ int __glXCallListsReqSize(GLbyte *pc, Bool swap )
return n * __glCallLists_size( type ); return n * __glCallLists_size( type );
} }
int __glXFogivReqSize(GLbyte *pc, Bool swap ) int __glXFogivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 0); GLenum pname = *(GLenum *)(pc + 0);
if (swap) { if (swap) {
...@@ -69,12 +69,12 @@ int __glXFogivReqSize(GLbyte *pc, Bool swap ) ...@@ -69,12 +69,12 @@ int __glXFogivReqSize(GLbyte *pc, Bool swap )
return 4 * __glFogiv_size( pname ); /* defined in samplegl lib */ return 4 * __glFogiv_size( pname ); /* defined in samplegl lib */
} }
int __glXFogfvReqSize(GLbyte *pc, Bool swap ) int __glXFogfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXFogivReqSize( pc, swap ); return __glXFogivReqSize( pc, swap, reqlen);
} }
int __glXLightfvReqSize(GLbyte *pc, Bool swap ) int __glXLightfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -83,12 +83,12 @@ int __glXLightfvReqSize(GLbyte *pc, Bool swap ) ...@@ -83,12 +83,12 @@ int __glXLightfvReqSize(GLbyte *pc, Bool swap )
return 4 * __glLightfv_size( pname ); /* defined in samplegl lib */ return 4 * __glLightfv_size( pname ); /* defined in samplegl lib */
} }
int __glXLightivReqSize(GLbyte *pc, Bool swap ) int __glXLightivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXLightfvReqSize( pc, swap ); return __glXLightfvReqSize( pc, swap, reqlen);
} }
int __glXLightModelfvReqSize(GLbyte *pc, Bool swap ) int __glXLightModelfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 0); GLenum pname = *(GLenum *)(pc + 0);
if (swap) { if (swap) {
...@@ -97,12 +97,12 @@ int __glXLightModelfvReqSize(GLbyte *pc, Bool swap ) ...@@ -97,12 +97,12 @@ int __glXLightModelfvReqSize(GLbyte *pc, Bool swap )
return 4 * __glLightModelfv_size( pname ); /* defined in samplegl lib */ return 4 * __glLightModelfv_size( pname ); /* defined in samplegl lib */
} }
int __glXLightModelivReqSize(GLbyte *pc, Bool swap ) int __glXLightModelivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXLightModelfvReqSize( pc, swap ); return __glXLightModelfvReqSize( pc, swap, reqlen);
} }
int __glXMaterialfvReqSize(GLbyte *pc, Bool swap ) int __glXMaterialfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -111,12 +111,12 @@ int __glXMaterialfvReqSize(GLbyte *pc, Bool swap ) ...@@ -111,12 +111,12 @@ int __glXMaterialfvReqSize(GLbyte *pc, Bool swap )
return 4 * __glMaterialfv_size( pname ); /* defined in samplegl lib */ return 4 * __glMaterialfv_size( pname ); /* defined in samplegl lib */
} }
int __glXMaterialivReqSize(GLbyte *pc, Bool swap ) int __glXMaterialivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXMaterialfvReqSize( pc, swap ); return __glXMaterialfvReqSize( pc, swap, reqlen);
} }
int __glXTexGendvReqSize(GLbyte *pc, Bool swap ) int __glXTexGendvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -125,7 +125,7 @@ int __glXTexGendvReqSize(GLbyte *pc, Bool swap ) ...@@ -125,7 +125,7 @@ int __glXTexGendvReqSize(GLbyte *pc, Bool swap )
return 8 * __glTexGendv_size( pname ); /* defined in samplegl lib */ return 8 * __glTexGendv_size( pname ); /* defined in samplegl lib */
} }
int __glXTexGenfvReqSize(GLbyte *pc, Bool swap ) int __glXTexGenfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -134,12 +134,12 @@ int __glXTexGenfvReqSize(GLbyte *pc, Bool swap ) ...@@ -134,12 +134,12 @@ int __glXTexGenfvReqSize(GLbyte *pc, Bool swap )
return 4 * __glTexGenfv_size( pname ); /* defined in samplegl lib */ return 4 * __glTexGenfv_size( pname ); /* defined in samplegl lib */
} }
int __glXTexGenivReqSize(GLbyte *pc, Bool swap ) int __glXTexGenivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXTexGenfvReqSize( pc, swap ); return __glXTexGenfvReqSize( pc, swap, reqlen);
} }
int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap ) int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -148,12 +148,12 @@ int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap ) ...@@ -148,12 +148,12 @@ int __glXTexParameterfvReqSize(GLbyte *pc, Bool swap )
return 4 * __glTexParameterfv_size( pname ); /* defined in samplegl lib */ return 4 * __glTexParameterfv_size( pname ); /* defined in samplegl lib */
} }
int __glXTexParameterivReqSize(GLbyte *pc, Bool swap ) int __glXTexParameterivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXTexParameterfvReqSize( pc, swap ); return __glXTexParameterfvReqSize( pc, swap, reqlen);
} }
int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap ) int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -162,12 +162,12 @@ int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap ) ...@@ -162,12 +162,12 @@ int __glXTexEnvfvReqSize(GLbyte *pc, Bool swap )
return 4 * __glTexEnvfv_size( pname ); /* defined in samplegl lib */ return 4 * __glTexEnvfv_size( pname ); /* defined in samplegl lib */
} }
int __glXTexEnvivReqSize(GLbyte *pc, Bool swap ) int __glXTexEnvivReqSize(GLbyte *pc, Bool swap, int reqlen )
{ {
return __glXTexEnvfvReqSize( pc, swap ); return __glXTexEnvfvReqSize( pc, swap, reqlen);
} }
int __glXMap1dReqSize(GLbyte *pc, Bool swap ) int __glXMap1dReqSize(GLbyte *pc, Bool swap, int reqlen )
{ {
GLenum target; GLenum target;
GLint order; GLint order;
...@@ -183,7 +183,7 @@ int __glXMap1dReqSize(GLbyte *pc, Bool swap ) ...@@ -183,7 +183,7 @@ int __glXMap1dReqSize(GLbyte *pc, Bool swap )
return safe_mul(8, safe_mul(__glMap1d_size(target), order)); return safe_mul(8, safe_mul(__glMap1d_size(target), order));
} }
int __glXMap1fReqSize(GLbyte *pc, Bool swap ) int __glXMap1fReqSize(GLbyte *pc, Bool swap, int reqlen )
{ {
GLenum target; GLenum target;
GLint order; GLint order;
...@@ -205,7 +205,7 @@ static int Map2Size(int k, int majorOrder, int minorOrder) ...@@ -205,7 +205,7 @@ static int Map2Size(int k, int majorOrder, int minorOrder)
return safe_mul(k, safe_mul(majorOrder, minorOrder)); return safe_mul(k, safe_mul(majorOrder, minorOrder));
} }
int __glXMap2dReqSize(GLbyte *pc, Bool swap ) int __glXMap2dReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum target; GLenum target;
GLint uorder, vorder; GLint uorder, vorder;
...@@ -221,7 +221,7 @@ int __glXMap2dReqSize(GLbyte *pc, Bool swap ) ...@@ -221,7 +221,7 @@ int __glXMap2dReqSize(GLbyte *pc, Bool swap )
return safe_mul(8, Map2Size(__glMap2d_size(target), uorder, vorder)); return safe_mul(8, Map2Size(__glMap2d_size(target), uorder, vorder));
} }
int __glXMap2fReqSize(GLbyte *pc, Bool swap ) int __glXMap2fReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum target; GLenum target;
GLint uorder, vorder; GLint uorder, vorder;
...@@ -237,7 +237,7 @@ int __glXMap2fReqSize(GLbyte *pc, Bool swap ) ...@@ -237,7 +237,7 @@ int __glXMap2fReqSize(GLbyte *pc, Bool swap )
return safe_mul(4, Map2Size(__glMap2f_size(target), uorder, vorder)); return safe_mul(4, Map2Size(__glMap2f_size(target), uorder, vorder));
} }
int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap ) int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLint mapsize; GLint mapsize;
mapsize = *(GLint *)(pc + 4); mapsize = *(GLint *)(pc + 4);
...@@ -247,12 +247,12 @@ int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap ) ...@@ -247,12 +247,12 @@ int __glXPixelMapfvReqSize(GLbyte *pc, Bool swap )
return 4 * mapsize; return 4 * mapsize;
} }
int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap ) int __glXPixelMapuivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXPixelMapfvReqSize( pc, swap ); return __glXPixelMapfvReqSize( pc, swap, reqlen);
} }
int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap ) int __glXPixelMapusvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLint mapsize; GLint mapsize;
mapsize = *(GLint *)(pc + 4); mapsize = *(GLint *)(pc + 4);
...@@ -458,7 +458,7 @@ int __glXImageSize( GLenum format, GLenum type, GLenum target, ...@@ -458,7 +458,7 @@ int __glXImageSize( GLenum format, GLenum type, GLenum target,
} }
int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap ) int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchDrawPixelsHeader *hdr = (__GLXdispatchDrawPixelsHeader *) pc; __GLXdispatchDrawPixelsHeader *hdr = (__GLXdispatchDrawPixelsHeader *) pc;
GLenum format = hdr->format; GLenum format = hdr->format;
...@@ -482,7 +482,7 @@ int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap ) ...@@ -482,7 +482,7 @@ int __glXDrawPixelsReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, skipRows, alignment ); 0, rowLength, 0, skipRows, alignment );
} }
int __glXBitmapReqSize(GLbyte *pc, Bool swap ) int __glXBitmapReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchBitmapHeader *hdr = (__GLXdispatchBitmapHeader *) pc; __GLXdispatchBitmapHeader *hdr = (__GLXdispatchBitmapHeader *) pc;
GLint w = hdr->width; GLint w = hdr->width;
...@@ -502,7 +502,7 @@ int __glXBitmapReqSize(GLbyte *pc, Bool swap ) ...@@ -502,7 +502,7 @@ int __glXBitmapReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, skipRows, alignment ); 0, rowLength, 0, skipRows, alignment );
} }
int __glXTexImage1DReqSize(GLbyte *pc, Bool swap ) int __glXTexImage1DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc; __GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc;
GLenum target = hdr->target; GLenum target = hdr->target;
...@@ -531,7 +531,7 @@ int __glXTexImage1DReqSize(GLbyte *pc, Bool swap ) ...@@ -531,7 +531,7 @@ int __glXTexImage1DReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, skipRows, alignment ); 0, rowLength, 0, skipRows, alignment );
} }
int __glXTexImage2DReqSize(GLbyte *pc, Bool swap ) int __glXTexImage2DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc; __GLXdispatchTexImageHeader *hdr = (__GLXdispatchTexImageHeader *) pc;
GLenum target = hdr->target; GLenum target = hdr->target;
...@@ -578,13 +578,14 @@ int __glXTypeSize(GLenum enm) ...@@ -578,13 +578,14 @@ int __glXTypeSize(GLenum enm)
} }
} }
int __glXDrawArraysSize( GLbyte *pc, Bool swap ) int __glXDrawArraysSize( GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc; __GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc;
__GLXdispatchDrawArraysComponentHeader *compHeader; __GLXdispatchDrawArraysComponentHeader *compHeader;
GLint numVertexes = hdr->numVertexes; GLint numVertexes = hdr->numVertexes;
GLint numComponents = hdr->numComponents; GLint numComponents = hdr->numComponents;
GLint arrayElementSize = 0; GLint arrayElementSize = 0;
GLint x, size;
int i; int i;
if (swap) { if (swap) {
...@@ -593,6 +594,13 @@ int __glXDrawArraysSize( GLbyte *pc, Bool swap ) ...@@ -593,6 +594,13 @@ int __glXDrawArraysSize( GLbyte *pc, Bool swap )
} }
pc += sizeof(__GLXdispatchDrawArraysHeader); pc += sizeof(__GLXdispatchDrawArraysHeader);
reqlen -= sizeof(__GLXdispatchDrawArraysHeader);
size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader),
numComponents);
if (size < 0 || reqlen < 0 || reqlen < size)
return -1;
compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc; compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc;
for (i=0; i<numComponents; i++) { for (i=0; i<numComponents; i++) {
...@@ -636,23 +644,24 @@ int __glXDrawArraysSize( GLbyte *pc, Bool swap ) ...@@ -636,23 +644,24 @@ int __glXDrawArraysSize( GLbyte *pc, Bool swap )
return -1; return -1;
} }
arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype)); x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype)));
if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0)
return -1;
pc += sizeof(__GLXdispatchDrawArraysComponentHeader); pc += sizeof(__GLXdispatchDrawArraysComponentHeader);
} }
return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) + return safe_add(size, safe_mul(numVertexes, arrayElementSize));
(numVertexes * arrayElementSize));
} }
int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap ) int __glXPrioritizeTexturesReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLint n = *(GLsizei *)(pc + 0); GLint n = *(GLsizei *)(pc + 0);
if (swap) n = SWAPL(n); if (swap) n = SWAPL(n);
return(8*n); /* 4*n for textures, 4*n for priorities */ return(8*n); /* 4*n for textures, 4*n for priorities */
} }
int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap ) int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc; __GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc;
GLenum format = hdr->format; GLenum format = hdr->format;
...@@ -674,7 +683,7 @@ int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap ) ...@@ -674,7 +683,7 @@ int __glXTexSubImage1DReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, skipRows, alignment ); 0, rowLength, 0, skipRows, alignment );
} }
int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap ) int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc; __GLXdispatchTexSubImageHeader *hdr = (__GLXdispatchTexSubImageHeader *) pc;
GLenum format = hdr->format; GLenum format = hdr->format;
...@@ -698,7 +707,7 @@ int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap ) ...@@ -698,7 +707,7 @@ int __glXTexSubImage2DReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, skipRows, alignment ); 0, rowLength, 0, skipRows, alignment );
} }
int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ) int __glXTexImage3DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchTexImage3DHeader *hdr = (__GLXdispatchTexImage3DHeader *) pc; __GLXdispatchTexImage3DHeader *hdr = (__GLXdispatchTexImage3DHeader *) pc;
GLenum target = hdr->target; GLenum target = hdr->target;
...@@ -735,7 +744,7 @@ int __glXTexImage3DReqSize(GLbyte *pc, Bool swap ) ...@@ -735,7 +744,7 @@ int __glXTexImage3DReqSize(GLbyte *pc, Bool swap )
} }
} }
int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap ) int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchTexSubImage3DHeader *hdr = __GLXdispatchTexSubImage3DHeader *hdr =
(__GLXdispatchTexSubImage3DHeader *) pc; (__GLXdispatchTexSubImage3DHeader *) pc;
...@@ -772,7 +781,7 @@ int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap ) ...@@ -772,7 +781,7 @@ int __glXTexSubImage3DReqSize(GLbyte *pc, Bool swap )
} }
} }
int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap ) int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchConvolutionFilterHeader *hdr = __GLXdispatchConvolutionFilterHeader *hdr =
(__GLXdispatchConvolutionFilterHeader *) pc; (__GLXdispatchConvolutionFilterHeader *) pc;
...@@ -795,7 +804,7 @@ int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap ) ...@@ -795,7 +804,7 @@ int __glXConvolutionFilter1DReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, 0, alignment ); 0, rowLength, 0, 0, alignment );
} }
int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap ) int __glXConvolutionFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchConvolutionFilterHeader *hdr = __GLXdispatchConvolutionFilterHeader *hdr =
(__GLXdispatchConvolutionFilterHeader *) pc; (__GLXdispatchConvolutionFilterHeader *) pc;
...@@ -841,7 +850,7 @@ int __glXConvolutionParameterfvSize(GLenum pname) ...@@ -841,7 +850,7 @@ int __glXConvolutionParameterfvSize(GLenum pname)
return __glXConvolutionParameterivSize(pname); return __glXConvolutionParameterivSize(pname);
} }
int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap ) int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -850,12 +859,12 @@ int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap ) ...@@ -850,12 +859,12 @@ int __glXConvolutionParameterivReqSize(GLbyte *pc, Bool swap )
return 4 * __glXConvolutionParameterivSize( pname ); return 4 * __glXConvolutionParameterivSize( pname );
} }
int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap ) int __glXConvolutionParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
return __glXConvolutionParameterivReqSize( pc, swap ); return __glXConvolutionParameterivReqSize( pc, swap, reqlen);
} }
int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap ) int __glXSeparableFilter2DReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchConvolutionFilterHeader *hdr = __GLXdispatchConvolutionFilterHeader *hdr =
(__GLXdispatchConvolutionFilterHeader *) pc; (__GLXdispatchConvolutionFilterHeader *) pc;
...@@ -904,7 +913,7 @@ int __glXColorTableParameterivSize(GLenum pname) ...@@ -904,7 +913,7 @@ int __glXColorTableParameterivSize(GLenum pname)
return __glXColorTableParameterfvSize(pname); return __glXColorTableParameterfvSize(pname);
} }
int __glXColorTableReqSize(GLbyte *pc, Bool swap ) int __glXColorTableReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchColorTableHeader *hdr = __GLXdispatchColorTableHeader *hdr =
(__GLXdispatchColorTableHeader *) pc; (__GLXdispatchColorTableHeader *) pc;
...@@ -939,7 +948,7 @@ int __glXColorTableReqSize(GLbyte *pc, Bool swap ) ...@@ -939,7 +948,7 @@ int __glXColorTableReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, 0, alignment ); 0, rowLength, 0, 0, alignment );
} }
int __glXColorSubTableReqSize(GLbyte *pc, Bool swap ) int __glXColorSubTableReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
__GLXdispatchColorSubTableHeader *hdr = __GLXdispatchColorSubTableHeader *hdr =
(__GLXdispatchColorSubTableHeader *) pc; (__GLXdispatchColorSubTableHeader *) pc;
...@@ -962,7 +971,7 @@ int __glXColorSubTableReqSize(GLbyte *pc, Bool swap ) ...@@ -962,7 +971,7 @@ int __glXColorSubTableReqSize(GLbyte *pc, Bool swap )
0, rowLength, 0, 0, alignment ); 0, rowLength, 0, 0, alignment );
} }
int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap ) int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 4); GLenum pname = *(GLenum *)(pc + 4);
if (swap) { if (swap) {
...@@ -971,13 +980,13 @@ int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap ) ...@@ -971,13 +980,13 @@ int __glXColorTableParameterfvReqSize(GLbyte *pc, Bool swap )
return 4 * __glXColorTableParameterfvSize(pname); return 4 * __glXColorTableParameterfvSize(pname);
} }
int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap ) int __glXColorTableParameterivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
/* no difference between fv and iv versions */ /* no difference between fv and iv versions */
return __glXColorTableParameterfvReqSize(pc, swap); return __glXColorTableParameterfvReqSize(pc, swap, reqlen);
} }
int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap ) int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
GLenum pname = *(GLenum *)(pc + 0); GLenum pname = *(GLenum *)(pc + 0);
if (swap) { if (swap) {
...@@ -986,8 +995,8 @@ int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap ) ...@@ -986,8 +995,8 @@ int __glXPointParameterfvARBReqSize(GLbyte *pc, Bool swap )
return 4 * __glPointParameterfvEXT_size( pname ); return 4 * __glPointParameterfvEXT_size( pname );
} }
int __glXPointParameterivReqSize(GLbyte *pc, Bool swap ) int __glXPointParameterivReqSize(GLbyte *pc, Bool swap, int reqlen)
{ {
/* no difference between fv and iv versions */ /* no difference between fv and iv versions */
return __glXPointParameterfvARBReqSize(pc, swap); return __glXPointParameterfvARBReqSize(pc, swap, reqlen);
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment