xserver: Branch 'server-1.3-branch' - 2 commits
Keith Packard
keithp at kemper.freedesktop.org
Fri Apr 6 09:33:28 EEST 2007
Xext/xcmisc.c | 13 +++++++++++--
os/WaitFor.c | 9 ++++++---
2 files changed, 17 insertions(+), 5 deletions(-)
New commits:
diff-tree 44c4bd5df3aae191be9fc836be26f91497d02901 (from 44ea7a3e0d8fa636f4e5dd392caf618120d98413)
Author: Matthieu Herrb <matthieu at roadrock.(none)>
Date: Tue Apr 3 15:47:18 2007 +0200
CVE-2007-1003: XC-MISC Extension ProcXCMiscGetXIDList() Memory Corruption
(cherry picked from commit 645d87cf8ef724d4591614f9994cdc4d7549a7a8)
diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c
index f26218e..8c7a86e 100644
--- a/Xext/xcmisc.c
+++ b/Xext/xcmisc.c
@@ -42,6 +42,12 @@ from The Open Group.
#include <X11/extensions/xcmiscstr.h>
#include "modinit.h"
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
#if 0
static unsigned char XCMiscCode;
#endif
@@ -143,7 +149,10 @@ ProcXCMiscGetXIDList(client)
REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
- pids = (XID *)ALLOCATE_LOCAL(stuff->count * sizeof(XID));
+ if (stuff->count > UINT32_MAX / sizeof(XID))
+ return BadAlloc;
+
+ pids = (XID *)Xalloc(stuff->count * sizeof(XID));
if (!pids)
{
return BadAlloc;
@@ -164,7 +173,7 @@ ProcXCMiscGetXIDList(client)
client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
WriteSwappedDataToClient(client, count * sizeof(XID), pids);
}
- DEALLOCATE_LOCAL(pids);
+ Xfree(pids);
return(client->noClientException);
}
diff-tree 44ea7a3e0d8fa636f4e5dd392caf618120d98413 (from 042ef1f573d6e98756cc98c296bddd1aa9e4c8ca)
Author: Tomas Janousek <tomi at nomi.cz>
Date: Wed Mar 28 14:46:30 2007 -0400
Bug #10296: Fix timer rescheduling.
(cherry picked from commit 8c7f56d92d8471ee059c14d322af5f7f555dd5c6)
diff --git a/os/WaitFor.c b/os/WaitFor.c
index ba227a3..d0f9f62 100644
--- a/os/WaitFor.c
+++ b/os/WaitFor.c
@@ -125,7 +125,7 @@ struct _OsTimerRec {
};
static void DoTimer(OsTimerPtr timer, CARD32 now, OsTimerPtr *prev);
-static void CheckAllTimers(CARD32 now);
+static void CheckAllTimers(void);
static OsTimerPtr timers = NULL;
/*****************
@@ -204,7 +204,7 @@ WaitForSomething(int *pClientsReady)
timeout = timers->expires - now;
if (timeout > 0 && timeout > timers->delta + 250) {
/* time has rewound. reset the timers. */
- CheckAllTimers(now);
+ CheckAllTimers();
}
if (timers) {
@@ -439,11 +439,14 @@ ANYSET(FdMask *src)
/* If time has rewound, re-run every affected timer.
* Timers might drop out of the list, so we have to restart every time. */
static void
-CheckAllTimers(CARD32 now)
+CheckAllTimers(void)
{
OsTimerPtr timer;
+ CARD32 now;
start:
+ now = GetTimeInMillis();
+
for (timer = timers; timer; timer = timer->next) {
if (timer->expires - now > timer->delta + 250) {
TimerForce(timer);
More information about the xorg-commit
mailing list