summaryrefslogtreecommitdiffstats
path: root/x11
diff options
context:
space:
mode:
Diffstat (limited to 'x11')
-rw-r--r--x11/libXrender/Makefile1
-rw-r--r--x11/libXrender/files/patch-src_Filter.c70
-rw-r--r--x11/libXrender/files/patch-src_Xrender.c114
3 files changed, 185 insertions, 0 deletions
diff --git a/x11/libXrender/Makefile b/x11/libXrender/Makefile
index 0f60547..4205a28 100644
--- a/x11/libXrender/Makefile
+++ b/x11/libXrender/Makefile
@@ -3,6 +3,7 @@
PORTNAME= libXrender
PORTVERSION= 0.9.7
+PORTREVISION= 1
CATEGORIES= x11
MAINTAINER= x11@FreeBSD.org
diff --git a/x11/libXrender/files/patch-src_Filter.c b/x11/libXrender/files/patch-src_Filter.c
new file mode 100644
index 0000000..9bd1784
--- /dev/null
+++ b/x11/libXrender/files/patch-src_Filter.c
@@ -0,0 +1,70 @@
+--- src/Filter.c.orig 2013-06-03 19:11:25.000000000 +0000
++++ src/Filter.c 2013-06-03 19:11:31.000000000 +0000
+@@ -25,6 +25,7 @@
+ #include <config.h>
+ #endif
+ #include "Xrenderint.h"
++#include <limits.h>
+
+ XFilters *
+ XRenderQueryFilters (Display *dpy, Drawable drawable)
+@@ -37,7 +38,7 @@ XRenderQueryFilters (Display *dpy, Drawa
+ char *name;
+ char len;
+ int i;
+- long nbytes, nbytesAlias, nbytesName;
++ unsigned long nbytes, nbytesAlias, nbytesName;
+
+ if (!RenderHasExtension (info))
+ return NULL;
+@@ -60,26 +61,36 @@ XRenderQueryFilters (Display *dpy, Drawa
+ SyncHandle ();
+ return NULL;
+ }
+- /*
+- * Compute total number of bytes for filter names
+- */
+- nbytes = (long)rep.length << 2;
+- nbytesAlias = rep.numAliases * 2;
+- if (rep.numAliases & 1)
+- nbytesAlias += 2;
+- nbytesName = nbytes - nbytesAlias;
+
+ /*
+- * Allocate one giant block for the whole data structure
++ * Limit each component of combined size to 1/4 the max, which is far
++ * more than they should ever possibly need.
+ */
+- filters = Xmalloc (sizeof (XFilters) +
+- rep.numFilters * sizeof (char *) +
+- rep.numAliases * sizeof (short) +
+- nbytesName);
++ if ((rep.length < (INT_MAX >> 2)) &&
++ (rep.numFilters < ((INT_MAX / 4) / sizeof (char *))) &&
++ (rep.numAliases < ((INT_MAX / 4) / sizeof (short)))) {
++ /*
++ * Compute total number of bytes for filter names
++ */
++ nbytes = (unsigned long)rep.length << 2;
++ nbytesAlias = rep.numAliases * 2;
++ if (rep.numAliases & 1)
++ nbytesAlias += 2;
++ nbytesName = nbytes - nbytesAlias;
++
++ /*
++ * Allocate one giant block for the whole data structure
++ */
++ filters = Xmalloc (sizeof (XFilters) +
++ (rep.numFilters * sizeof (char *)) +
++ (rep.numAliases * sizeof (short)) +
++ nbytesName);
++ } else
++ filters = NULL;
+
+ if (!filters)
+ {
+- _XEatData (dpy, (unsigned long) rep.length << 2);
++ _XEatDataWords(dpy, rep.length);
+ UnlockDisplay (dpy);
+ SyncHandle ();
+ return NULL;
diff --git a/x11/libXrender/files/patch-src_Xrender.c b/x11/libXrender/files/patch-src_Xrender.c
new file mode 100644
index 0000000..0d282cb
--- /dev/null
+++ b/x11/libXrender/files/patch-src_Xrender.c
@@ -0,0 +1,114 @@
+--- src/Xrender.c.orig 2013-06-03 19:11:25.000000000 +0000
++++ src/Xrender.c 2013-06-03 19:11:34.000000000 +0000
+@@ -26,6 +26,7 @@
+ #include <config.h>
+ #endif
+ #include "Xrenderint.h"
++#include <limits.h>
+
+ XRenderExtInfo XRenderExtensionInfo;
+ char XRenderExtensionName[] = RENDER_NAME;
+@@ -411,8 +412,8 @@ XRenderQueryFormats (Display *dpy)
+ CARD32 *xSubpixel;
+ void *xData;
+ int nf, ns, nd, nv;
+- int rlength;
+- int nbytes;
++ unsigned long rlength;
++ unsigned long nbytes;
+
+ RenderCheckExtension (dpy, info, 0);
+ LockDisplay (dpy);
+@@ -458,24 +459,35 @@ XRenderQueryFormats (Display *dpy)
+ if (async_state.major_version == 0 && async_state.minor_version < 6)
+ rep.numSubpixel = 0;
+
+- xri = (XRenderInfo *) Xmalloc (sizeof (XRenderInfo) +
+- rep.numFormats * sizeof (XRenderPictFormat) +
+- rep.numScreens * sizeof (XRenderScreen) +
+- rep.numDepths * sizeof (XRenderDepth) +
+- rep.numVisuals * sizeof (XRenderVisual));
+- rlength = (rep.numFormats * sizeof (xPictFormInfo) +
+- rep.numScreens * sizeof (xPictScreen) +
+- rep.numDepths * sizeof (xPictDepth) +
+- rep.numVisuals * sizeof (xPictVisual) +
+- rep.numSubpixel * 4);
+- xData = (void *) Xmalloc (rlength);
+- nbytes = (int) rep.length << 2;
++ if ((rep.numFormats < ((INT_MAX / 4) / sizeof (XRenderPictFormat))) &&
++ (rep.numScreens < ((INT_MAX / 4) / sizeof (XRenderScreen))) &&
++ (rep.numDepths < ((INT_MAX / 4) / sizeof (XRenderDepth))) &&
++ (rep.numVisuals < ((INT_MAX / 4) / sizeof (XRenderVisual))) &&
++ (rep.numSubpixel < ((INT_MAX / 4) / 4)) &&
++ (rep.length < (INT_MAX >> 2)) ) {
++ xri = Xmalloc (sizeof (XRenderInfo) +
++ (rep.numFormats * sizeof (XRenderPictFormat)) +
++ (rep.numScreens * sizeof (XRenderScreen)) +
++ (rep.numDepths * sizeof (XRenderDepth)) +
++ (rep.numVisuals * sizeof (XRenderVisual)));
++ rlength = ((rep.numFormats * sizeof (xPictFormInfo)) +
++ (rep.numScreens * sizeof (xPictScreen)) +
++ (rep.numDepths * sizeof (xPictDepth)) +
++ (rep.numVisuals * sizeof (xPictVisual)) +
++ (rep.numSubpixel * 4));
++ xData = Xmalloc (rlength);
++ nbytes = (unsigned long) rep.length << 2;
++ } else {
++ xri = NULL;
++ xData = NULL;
++ rlength = nbytes = 0;
++ }
+
+ if (!xri || !xData || nbytes < rlength)
+ {
+ if (xri) Xfree (xri);
+ if (xData) Xfree (xData);
+- _XEatData (dpy, nbytes);
++ _XEatDataWords (dpy, rep.length);
+ UnlockDisplay (dpy);
+ SyncHandle ();
+ return 0;
+@@ -832,7 +844,7 @@ XRenderQueryPictIndexValues(Display *d
+ xRenderQueryPictIndexValuesReq *req;
+ xRenderQueryPictIndexValuesReply rep;
+ XIndexValue *values;
+- int nbytes, nread, rlength, i;
++ unsigned int nbytes, nread, rlength, i;
+
+ RenderCheckExtension (dpy, info, NULL);
+
+@@ -848,18 +860,25 @@ XRenderQueryPictIndexValues(Display *d
+ return NULL;
+ }
+
+- /* request data length */
+- nbytes = (long)rep.length << 2;
+- /* bytes of actual data in the request */
+- nread = rep.numIndexValues * SIZEOF (xIndexValue);
+- /* size of array returned to application */
+- rlength = rep.numIndexValues * sizeof (XIndexValue);
++ if ((rep.length < (INT_MAX >> 2)) &&
++ (rep.numIndexValues < (INT_MAX / sizeof (XIndexValue)))) {
++ /* request data length */
++ nbytes = rep.length << 2;
++ /* bytes of actual data in the request */
++ nread = rep.numIndexValues * SIZEOF (xIndexValue);
++ /* size of array returned to application */
++ rlength = rep.numIndexValues * sizeof (XIndexValue);
++
++ /* allocate returned data */
++ values = Xmalloc (rlength);
++ } else {
++ nbytes = nread = rlength = 0;
++ values = NULL;
++ }
+
+- /* allocate returned data */
+- values = (XIndexValue *)Xmalloc (rlength);
+ if (!values)
+ {
+- _XEatData (dpy, nbytes);
++ _XEatDataWords (dpy, rep.length);
+ UnlockDisplay (dpy);
+ SyncHandle ();
+ return NULL;
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-23 16:41:25 +0800