Thu Jun 6 16:39:20 2013 UTC ()
Apply patch (requested by mrg in ticket #1865):

xsrc/external/mitMesaLib/dist/src/glx/x11/XF86dri.c	patch
xsrc/external/mitlibFS/dist/src/FSOpenServ.c		patch
xsrc/external/mitlibX11/dist/modules/im/ximcp/imLcPrs.c	patch
xsrc/external/mitlibX11/dist/modules/im/ximcp/imTrX.c	patch
xsrc/external/mitlibX11/dist/src/AllCells.c		patch
xsrc/external/mitlibX11/dist/src/Font.c			patch
xsrc/external/mitlibX11/dist/src/FontInfo.c		patch
xsrc/external/mitlibX11/dist/src/FontNames.c		patch
xsrc/external/mitlibX11/dist/src/GetFPath.c		patch
xsrc/external/mitlibX11/dist/src/GetImage.c		patch
xsrc/external/mitlibX11/dist/src/GetMoEv.c		patch
xsrc/external/mitlibX11/dist/src/GetPntMap.c		patch
xsrc/external/mitlibX11/dist/src/GetProp.c		patch
xsrc/external/mitlibX11/dist/src/LiHosts.c		patch
xsrc/external/mitlibX11/dist/src/ListExt.c		patch
xsrc/external/mitlibX11/dist/src/ModMap.c		patch
xsrc/external/mitlibX11/dist/src/Xrm.c			patch
xsrc/external/mitlibX11/dist/src/xcms/cmsColNm.c	patch
xsrc/external/mitlibX11/dist/src/xkb/XKBExtDev.c	patch
xsrc/external/mitlibX11/dist/src/xkb/XKBGeom.c		patch
xsrc/external/mitlibX11/dist/src/xkb/XKBGetMap.c	patch
xsrc/external/mitlibX11/dist/src/xkb/XKBNames.c		patch
xsrc/external/mitlibXcursor/dist/src/file.c		patch
xsrc/external/mitlibXext/dist/src/XEVI.c		patch
xsrc/external/mitlibXext/dist/src/XShape.c		patch
xsrc/external/mitlibXext/dist/src/XSync.c		patch
xsrc/external/mitlibXext/dist/src/Xcup.c		patch
xsrc/external/mitlibXext/dist/src/Xdbe.c		patch
xsrc/external/mitlibXfixes/dist/src/Cursor.c		patch
xsrc/external/mitlibXi/dist/src/XGMotion.c		patch
xsrc/external/mitlibXi/dist/src/XGetBMap.c		patch
xsrc/external/mitlibXi/dist/src/XGetDCtl.c		patch
xsrc/external/mitlibXi/dist/src/XGetDProp.c		patch
xsrc/external/mitlibXi/dist/src/XGetFCtl.c		patch
xsrc/external/mitlibXi/dist/src/XGetProp.c		patch
xsrc/external/mitlibXi/dist/src/XListDev.c		patch
xsrc/external/mitlibXi/dist/src/XQueryDv.c		patch
xsrc/external/mitlibXinerama/dist/src/Xinerama.c	patch
xsrc/external/mitlibXrandr/dist/src/XrrProperty.c	patch
xsrc/external/mitlibXrender/dist/src/Filter.c		patch
xsrc/external/mitlibXrender/dist/src/Xrender.c		patch
xsrc/external/mitlibXres/dist/src/XRes.c		patch
xsrc/external/mitlibXt/dist/src/ResConfig.c		patch
xsrc/external/mitlibXt/dist/src/Selection.c		patch
xsrc/external/mitlibXv/dist/src/Xv.c			patch
xsrc/external/mitlibXvMC/dist/src/XvMC.c		patch
xsrc/external/mitlibXxf86dga/dist/src/XF86DGA2.c	patch
xsrc/external/mitlibXxf86vm/dist/src/XF86VMode.c	patch

	Fix protocol handling issues in X client libraries.
	[mrg, ticket #1865]


(riz)
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/MesaLib/dist/src/glx/x11/XF86dri.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libFS/dist/src/FSOpenServ.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/modules/im/ximcp/imLcPrs.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/modules/im/ximcp/imTrX.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libX11/dist/src/AllCells.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libX11/dist/src/GetFPath.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libX11/dist/src/ListExt.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/Font.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/FontInfo.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/FontNames.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetImage.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetMoEv.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetPntMap.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetProp.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/LiHosts.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/ModMap.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/Xrm.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xcms/cmsColNm.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBExtDev.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBGeom.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXcursor/dist/src/file.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/XEVI.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/XShape.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/XSync.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/Xcup.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/Xdbe.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXfixes/dist/src/Cursor.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXi/dist/src/XGMotion.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXi/dist/src/XGetDCtl.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XGetBMap.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XGetFCtl.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XGetProp.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XListDev.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XQueryDv.c
diff -r1.1.1.1.2.2 -r1.1.1.1.2.2.2.1 xsrc/external/mit/libXi/dist/src/XGetDProp.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXinerama/dist/src/Xinerama.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXrandr/dist/src/XrrProperty.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXrender/dist/src/Filter.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXrender/dist/src/Xrender.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXres/dist/src/XRes.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXt/dist/src/ResConfig.c
diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXt/dist/src/Selection.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXv/dist/src/Xv.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXvMC/dist/src/XvMC.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXxf86dga/dist/src/XF86DGA2.c
diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXxf86vm/dist/src/XF86VMode.c
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/MesaLib/dist/src/glx/x11/Attic/XF86dri.c (expand / switch to unified diff)

--- xsrc/external/mit/MesaLib/dist/src/glx/x11/Attic/XF86dri.c 2009/09/17 03:32:09 1.1.1.1.2.1
+++ xsrc/external/mit/MesaLib/dist/src/glx/x11/Attic/XF86dri.c 2013/06/06 16:39:18 1.1.1.1.2.1.2.1
@@ -33,26 +33,27 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN @@ -33,26 +33,27 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN
33 * Rickard E. (Rik) Faith <faith@valinux.com> 33 * Rickard E. (Rik) Faith <faith@valinux.com>
34 * 34 *
35 */ 35 */
36 36
37/* THIS IS NOT AN X CONSORTIUM STANDARD */ 37/* THIS IS NOT AN X CONSORTIUM STANDARD */
38 38
39#ifdef GLX_DIRECT_RENDERING 39#ifdef GLX_DIRECT_RENDERING
40 40
41#define NEED_REPLIES 41#define NEED_REPLIES
42#include <X11/Xlibint.h> 42#include <X11/Xlibint.h>
43#include <X11/extensions/Xext.h> 43#include <X11/extensions/Xext.h>
44#include <X11/extensions/extutil.h> 44#include <X11/extensions/extutil.h>
45#include "xf86dristr.h" 45#include "xf86dristr.h"
 46#include <limits.h>
46 47
47 48
48#if defined(__GNUC__) && (__GNUC__ * 100 + __GNUC_MINOR__) >= 303 49#if defined(__GNUC__) && (__GNUC__ * 100 + __GNUC_MINOR__) >= 303
49# define PUBLIC __attribute__((visibility("default"))) 50# define PUBLIC __attribute__((visibility("default")))
50# define USED __attribute__((used)) 51# define USED __attribute__((used))
51#else 52#else
52# define PUBLIC 53# define PUBLIC
53# define USED 54# define USED
54#endif 55#endif
55 56
56 57
57 58
58static XExtensionInfo _xf86dri_info_data; 59static XExtensionInfo _xf86dri_info_data;
@@ -202,27 +203,31 @@ XF86DRIOpenConnection(Display * dpy, int @@ -202,27 +203,31 @@ XF86DRIOpenConnection(Display * dpy, int
202 UnlockDisplay(dpy); 203 UnlockDisplay(dpy);
203 SyncHandle(); 204 SyncHandle();
204 TRACE("OpenConnection... return False"); 205 TRACE("OpenConnection... return False");
205 return False; 206 return False;
206 } 207 }
207 208
208 *hSAREA = rep.hSAREALow; 209 *hSAREA = rep.hSAREALow;
209 if (sizeof(drm_handle_t) == 8) { 210 if (sizeof(drm_handle_t) == 8) {
210 int shift = 32; /* var to prevent warning on next line */ 211 int shift = 32; /* var to prevent warning on next line */
211 *hSAREA |= ((drm_handle_t) rep.hSAREAHigh) << shift; 212 *hSAREA |= ((drm_handle_t) rep.hSAREAHigh) << shift;
212 } 213 }
213 214
214 if (rep.length) { 215 if (rep.length) {
215 if (!(*busIdString = (char *) Xcalloc(rep.busIdStringLength + 1, 1))) { 216 if (rep.busIdStringLength < INT_MAX)
 217 *busIdString = (char *) Xcalloc(rep.busIdStringLength + 1, 1);
 218 else
 219 *busIdString = NULL;
 220 if (*busIdString == NULL) {
216 _XEatData(dpy, ((rep.busIdStringLength + 3) & ~3)); 221 _XEatData(dpy, ((rep.busIdStringLength + 3) & ~3));
217 UnlockDisplay(dpy); 222 UnlockDisplay(dpy);
218 SyncHandle(); 223 SyncHandle();
219 TRACE("OpenConnection... return False"); 224 TRACE("OpenConnection... return False");
220 return False; 225 return False;
221 } 226 }
222 _XReadPad(dpy, *busIdString, rep.busIdStringLength); 227 _XReadPad(dpy, *busIdString, rep.busIdStringLength);
223 } 228 }
224 else { 229 else {
225 *busIdString = NULL; 230 *busIdString = NULL;
226 } 231 }
227 UnlockDisplay(dpy); 232 UnlockDisplay(dpy);
228 SyncHandle(); 233 SyncHandle();
@@ -301,29 +306,31 @@ XF86DRIGetClientDriverName(Display * dpy @@ -301,29 +306,31 @@ XF86DRIGetClientDriverName(Display * dpy
301 req->screen = screen; 306 req->screen = screen;
302 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) { 307 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
303 UnlockDisplay(dpy); 308 UnlockDisplay(dpy);
304 SyncHandle(); 309 SyncHandle();
305 TRACE("GetClientDriverName... return False"); 310 TRACE("GetClientDriverName... return False");
306 return False; 311 return False;
307 } 312 }
308 313
309 *ddxDriverMajorVersion = rep.ddxDriverMajorVersion; 314 *ddxDriverMajorVersion = rep.ddxDriverMajorVersion;
310 *ddxDriverMinorVersion = rep.ddxDriverMinorVersion; 315 *ddxDriverMinorVersion = rep.ddxDriverMinorVersion;
311 *ddxDriverPatchVersion = rep.ddxDriverPatchVersion; 316 *ddxDriverPatchVersion = rep.ddxDriverPatchVersion;
312 317
313 if (rep.length) { 318 if (rep.length) {
314 if (! 319 if (rep.clientDriverNameLength < INT_MAX)
315 (*clientDriverName = 320 *clientDriverName = (char *) Xcalloc(rep.clientDriverNameLength + 1, 1);
316 (char *) Xcalloc(rep.clientDriverNameLength + 1, 1))) { 321 else
 322 *clientDriverName = NULL;
 323 if (*clientDriverName == NULL) {
317 _XEatData(dpy, ((rep.clientDriverNameLength + 3) & ~3)); 324 _XEatData(dpy, ((rep.clientDriverNameLength + 3) & ~3));
318 UnlockDisplay(dpy); 325 UnlockDisplay(dpy);
319 SyncHandle(); 326 SyncHandle();
320 TRACE("GetClientDriverName... return False"); 327 TRACE("GetClientDriverName... return False");
321 return False; 328 return False;
322 } 329 }
323 _XReadPad(dpy, *clientDriverName, rep.clientDriverNameLength); 330 _XReadPad(dpy, *clientDriverName, rep.clientDriverNameLength);
324 } 331 }
325 else { 332 else {
326 *clientDriverName = NULL; 333 *clientDriverName = NULL;
327 } 334 }
328 UnlockDisplay(dpy); 335 UnlockDisplay(dpy);
329 SyncHandle(); 336 SyncHandle();
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libFS/dist/src/FSOpenServ.c (expand / switch to unified diff)

--- xsrc/external/mit/libFS/dist/src/FSOpenServ.c 2009/09/17 03:32:53 1.1.1.1.2.1
+++ xsrc/external/mit/libFS/dist/src/FSOpenServ.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -101,30 +101,30 @@ void OutOfMemory( @@ -101,30 +101,30 @@ void OutOfMemory(
101 */ 101 */
102 102
103FSServer * 103FSServer *
104FSOpenServer(char *server) 104FSOpenServer(char *server)
105{ 105{
106 FSServer *svr; 106 FSServer *svr;
107 int i; 107 int i;
108 int endian; 108 int endian;
109 fsConnClientPrefix client; 109 fsConnClientPrefix client;
110 fsConnSetup prefix; 110 fsConnSetup prefix;
111 char *setup = NULL; 111 char *setup = NULL;
112 fsConnSetupAccept conn; 112 fsConnSetupAccept conn;
113 char *auth_data = NULL; 113 char *auth_data = NULL;
114 char *alt_data = NULL, 114 unsigned char *alt_data = NULL,
115 *ad; 115 *ad;
116 AlternateServer *alts = NULL; 116 AlternateServer *alts = NULL;
117 int altlen; 117 unsigned int altlen;
118 char *vendor_string; 118 char *vendor_string;
119 unsigned long setuplength; 119 unsigned long setuplength;
120 120
121 if (server == NULL || *server == '\0') { 121 if (server == NULL || *server == '\0') {
122 if ((server = getenv("FONTSERVER")) == NULL) { 122 if ((server = getenv("FONTSERVER")) == NULL) {
123 return (FSServer *) NULL; 123 return (FSServer *) NULL;
124 } 124 }
125 } 125 }
126 126
127 if ((svr = (FSServer *) FScalloc(1, sizeof(FSServer))) == NULL) { 127 if ((svr = (FSServer *) FScalloc(1, sizeof(FSServer))) == NULL) {
128 errno = ENOMEM; 128 errno = ENOMEM;
129 return (FSServer *) NULL; 129 return (FSServer *) NULL;
130 } 130 }
@@ -148,47 +148,47 @@ FSOpenServer(char *server) @@ -148,47 +148,47 @@ FSOpenServer(char *server)
148 client.byteOrder = 'B'; 148 client.byteOrder = 'B';
149 client.major_version = FS_PROTOCOL; 149 client.major_version = FS_PROTOCOL;
150 client.minor_version = FS_PROTOCOL_MINOR; 150 client.minor_version = FS_PROTOCOL_MINOR;
151/* XXX -- fix this when we have some auths */ 151/* XXX -- fix this when we have some auths */
152 client.num_auths = 0; 152 client.num_auths = 0;
153 client.auth_len = 0; 153 client.auth_len = 0;
154 _FSSendClientPrefix(svr, &client); 154 _FSSendClientPrefix(svr, &client);
155 155
156/* see if connection was accepted */ 156/* see if connection was accepted */
157 _FSRead(svr, (char *) &prefix, (long) SIZEOF(fsConnSetup)); 157 _FSRead(svr, (char *) &prefix, (long) SIZEOF(fsConnSetup));
158 158
159 setuplength = prefix.alternate_len << 2; 159 setuplength = prefix.alternate_len << 2;
160 if (setuplength > (SIZE_MAX>>2) 160 if (setuplength > (SIZE_MAX>>2)
161 || (alt_data = (char *) 161 || (alt_data = (unsigned char *)
162 (setup = FSmalloc((unsigned) setuplength))) == NULL) { 162 (setup = FSmalloc((unsigned) setuplength))) == NULL) {
163 goto fail; 163 goto fail;
164 } 164 }
165 _FSRead(svr, (char *) alt_data, setuplength); 165 _FSRead(svr, (char *) alt_data, setuplength);
166 ad = alt_data; 166 ad = alt_data;
167 167
168#if SIZE_MAX <= UINT_MAX 168#if SIZE_MAX <= UINT_MAX
169 if (prefix.num_alternates > SIZE_MAX / sizeof(AlternateServer)) { 169 if (prefix.num_alternates > SIZE_MAX / sizeof(AlternateServer)) {
170 goto fail; 170 goto fail;
171 } 171 }
172#endif 172#endif
173 173
174 alts = (AlternateServer *) 174 alts = (AlternateServer *)
175 FSmalloc(sizeof(AlternateServer) * prefix.num_alternates); 175 FSmalloc(sizeof(AlternateServer) * prefix.num_alternates);
176 if (!alts) { 176 if (!alts) {
177 goto fail; 177 goto fail;
178 } 178 }
179 for (i = 0; i < prefix.num_alternates; i++) { 179 for (i = 0; i < prefix.num_alternates; i++) {
180 alts[i].subset = (Bool) *ad++; 180 alts[i].subset = (Bool) *ad++;
181 altlen = (int) *ad++; 181 altlen = (unsigned int) *ad++;
182 alts[i].name = (char *) FSmalloc(altlen + 1); 182 alts[i].name = (char *) FSmalloc(altlen + 1);
183 if (!alts[i].name) { 183 if (!alts[i].name) {
184 while (--i) { 184 while (--i) {
185 FSfree((char *) alts[i].name); 185 FSfree((char *) alts[i].name);
186 } 186 }
187 goto fail; 187 goto fail;
188 } 188 }
189 memmove(alts[i].name, ad, altlen); 189 memmove(alts[i].name, ad, altlen);
190 alts[i].name[altlen] = '\0'; 190 alts[i].name[altlen] = '\0';
191 ad += altlen + ((4 - (altlen + 2)) & 3); 191 ad += altlen + ((4 - (altlen + 2)) & 3);
192 } 192 }
193 FSfree((char *) alt_data); 193 FSfree((char *) alt_data);
194 alt_data = NULL; 194 alt_data = NULL;
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/modules/im/ximcp/imLcPrs.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/modules/im/ximcp/imLcPrs.c 2009/09/17 03:32:57 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/modules/im/ximcp/imLcPrs.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -33,26 +33,27 @@ OR PERFORMANCE OF THIS SOFTWARE. @@ -33,26 +33,27 @@ OR PERFORMANCE OF THIS SOFTWARE.
33/* $XFree86: xc/lib/X11/imLcPrs.c,v 1.10 2003/09/06 14:06:32 pascal Exp $ */ 33/* $XFree86: xc/lib/X11/imLcPrs.c,v 1.10 2003/09/06 14:06:32 pascal Exp $ */
34 34
35#ifdef HAVE_CONFIG_H 35#ifdef HAVE_CONFIG_H
36#include <config.h> 36#include <config.h>
37#endif 37#endif
38#include <X11/Xlib.h> 38#include <X11/Xlib.h>
39#include <X11/Xmd.h> 39#include <X11/Xmd.h>
40#include <X11/Xos.h> 40#include <X11/Xos.h>
41#include "Xlibint.h" 41#include "Xlibint.h"
42#include "Xlcint.h" 42#include "Xlcint.h"
43#include "Ximint.h" 43#include "Ximint.h"
44#include <sys/stat.h> 44#include <sys/stat.h>
45#include <stdio.h> 45#include <stdio.h>
 46#include <limits.h>
46 47
47extern int _Xmbstowcs( 48extern int _Xmbstowcs(
48 wchar_t *wstr, 49 wchar_t *wstr,
49 char *str, 50 char *str,
50 int len 51 int len
51); 52);
52 53
53extern int _Xmbstoutf8( 54extern int _Xmbstoutf8(
54 char *ustr, 55 char *ustr,
55 const char *str, 56 const char *str,
56 int len 57 int len
57); 58);
58 59
@@ -654,22 +655,24 @@ error: @@ -654,22 +655,24 @@ error:
654} 655}
655 656
656void 657void
657_XimParseStringFile( 658_XimParseStringFile(
658 FILE *fp, 659 FILE *fp,
659 Xim im) 660 Xim im)
660{ 661{
661 char tb[8192]; 662 char tb[8192];
662 char* tbp; 663 char* tbp;
663 struct stat st; 664 struct stat st;
664 665
665 if (fstat (fileno (fp), &st) != -1) { 666 if (fstat (fileno (fp), &st) != -1) {
666 unsigned long size = (unsigned long) st.st_size; 667 unsigned long size = (unsigned long) st.st_size;
 668 if (st.st_size >= INT_MAX)
 669 return;
667 if (size <= sizeof tb) tbp = tb; 670 if (size <= sizeof tb) tbp = tb;
668 else tbp = malloc (size); 671 else tbp = malloc (size);
669 672
670 if (tbp != NULL) { 673 if (tbp != NULL) {
671 while (parseline(fp, im, tbp) >= 0) {} 674 while (parseline(fp, im, tbp) >= 0) {}
672 if (tbp != tb) free (tbp); 675 if (tbp != tb) free (tbp);
673 } 676 }
674 } 677 }
675} 678}
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/modules/im/ximcp/imTrX.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/modules/im/ximcp/imTrX.c 2009/09/17 03:32:57 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/modules/im/ximcp/imTrX.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -344,27 +344,27 @@ _XimXGetReadData( @@ -344,27 +344,27 @@ _XimXGetReadData(
344 } else if ((event->type == ClientMessage) 344 } else if ((event->type == ClientMessage)
345 && (event->xclient.format == 32)) { 345 && (event->xclient.format == 32)) {
346 length = (unsigned long)event->xclient.data.l[0]; 346 length = (unsigned long)event->xclient.data.l[0];
347 prop = (Atom)event->xclient.data.l[1]; 347 prop = (Atom)event->xclient.data.l[1];
348 return_code = XGetWindowProperty(im->core.display, 348 return_code = XGetWindowProperty(im->core.display,
349 spec->lib_connect_wid, prop, 0L, 349 spec->lib_connect_wid, prop, 0L,
350 (long)((length + 3)/ 4), True, AnyPropertyType, 350 (long)((length + 3)/ 4), True, AnyPropertyType,
351 &type_ret, &format_ret, &nitems, &bytes_after_ret, &prop_ret); 351 &type_ret, &format_ret, &nitems, &bytes_after_ret, &prop_ret);
352 if (return_code != Success || format_ret == 0 || nitems == 0) { 352 if (return_code != Success || format_ret == 0 || nitems == 0) {
353 if (return_code == Success) 353 if (return_code == Success)
354 XFree(prop_ret); 354 XFree(prop_ret);
355 return False; 355 return False;
356 } 356 }
357 if (buf_len >= length) { 357 if (buf_len >= (int)nitems) {
358 (void)memcpy(buf, prop_ret, (int)nitems); 358 (void)memcpy(buf, prop_ret, (int)nitems);
359 *ret_len = (int)nitems; 359 *ret_len = (int)nitems;
360 if (bytes_after_ret > 0) { 360 if (bytes_after_ret > 0) {
361 XFree(prop_ret); 361 XFree(prop_ret);
362 XGetWindowProperty(im->core.display, 362 XGetWindowProperty(im->core.display,
363 spec->lib_connect_wid, prop, 0L, 363 spec->lib_connect_wid, prop, 0L,
364 ((length + bytes_after_ret + 3)/ 4), True, AnyPropertyType, 364 ((length + bytes_after_ret + 3)/ 4), True, AnyPropertyType,
365 &type_ret, &format_ret, &nitems, &bytes_after_ret, 365 &type_ret, &format_ret, &nitems, &bytes_after_ret,
366 &prop_ret); 366 &prop_ret);
367 XChangeProperty(im->core.display, spec->lib_connect_wid, prop, 367 XChangeProperty(im->core.display, spec->lib_connect_wid, prop,
368 XA_STRING, 8, PropModePrepend, &prop_ret[length], 368 XA_STRING, 8, PropModePrepend, &prop_ret[length],
369 (nitems - length)); 369 (nitems - length));
370 } 370 }
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libX11/dist/src/AllCells.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/AllCells.c 2008/07/30 02:43:06 1.1.1.1
+++ xsrc/external/mit/libX11/dist/src/AllCells.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -46,21 +46,26 @@ Status XAllocColorCells( @@ -46,21 +46,26 @@ Status XAllocColorCells(
46 xAllocColorCellsReply rep; 46 xAllocColorCellsReply rep;
47 register xAllocColorCellsReq *req; 47 register xAllocColorCellsReq *req;
48 LockDisplay(dpy); 48 LockDisplay(dpy);
49 GetReq(AllocColorCells, req); 49 GetReq(AllocColorCells, req);
50 50
51 req->cmap = cmap; 51 req->cmap = cmap;
52 req->colors = ncolors; 52 req->colors = ncolors;
53 req->planes = nplanes; 53 req->planes = nplanes;
54 req->contiguous = contig; 54 req->contiguous = contig;
55 55
56 status = _XReply(dpy, (xReply *)&rep, 0, xFalse); 56 status = _XReply(dpy, (xReply *)&rep, 0, xFalse);
57 57
58 if (status) { 58 if (status) {
59 _XRead32 (dpy, (long *) pixels, 4L * (long) (rep.nPixels)); 59 if ((rep.nPixels > ncolors) || (rep.nMasks > nplanes)) {
60 _XRead32 (dpy, (long *) masks, 4L * (long) (rep.nMasks)); 60 _XEatData(dpy, rep.length << 2);
 61 status = 0; /* Failure */
 62 } else {
 63 _XRead32 (dpy, (long *) pixels, 4L * (long) (rep.nPixels));
 64 _XRead32 (dpy, (long *) masks, 4L * (long) (rep.nMasks));
 65 }
61 } 66 }
62 67
63 UnlockDisplay(dpy); 68 UnlockDisplay(dpy);
64 SyncHandle(); 69 SyncHandle();
65 return(status); 70 return(status);
66} 71}
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libX11/dist/src/GetFPath.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/GetFPath.c 2008/07/30 02:43:04 1.1.1.1
+++ xsrc/external/mit/libX11/dist/src/GetFPath.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -21,73 +21,81 @@ CONNECTION WITH THE SOFTWARE OR THE USE  @@ -21,73 +21,81 @@ CONNECTION WITH THE SOFTWARE OR THE USE
21 21
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27/* $XFree86: xc/lib/X11/GetFPath.c,v 1.3 2001/01/17 19:41:36 dawes Exp $ */ 27/* $XFree86: xc/lib/X11/GetFPath.c,v 1.3 2001/01/17 19:41:36 dawes Exp $ */
28 28
29#define NEED_REPLIES 29#define NEED_REPLIES
30#ifdef HAVE_CONFIG_H 30#ifdef HAVE_CONFIG_H
31#include <config.h> 31#include <config.h>
32#endif 32#endif
33#include "Xlibint.h" 33#include "Xlibint.h"
 34#include <limits.h>
34 35
35char **XGetFontPath( 36char **XGetFontPath(
36 register Display *dpy, 37 register Display *dpy,
37 int *npaths) /* RETURN */ 38 int *npaths) /* RETURN */
38{ 39{
39 xGetFontPathReply rep; 40 xGetFontPathReply rep;
40 register long nbytes; 41 unsigned long nbytes;
41 char **flist; 42 char **flist = NULL;
42 char *ch; 43 char *ch = NULL;
 44 char *chend;
 45 int count = 0;
43 register unsigned i; 46 register unsigned i;
44 register int length; 47 register int length;
45 register xReq *req; 48 register xReq *req;
46 49
47 LockDisplay(dpy); 50 LockDisplay(dpy);
48 GetEmptyReq (GetFontPath, req); 51 GetEmptyReq (GetFontPath, req);
49 (void) _XReply (dpy, (xReply *) &rep, 0, xFalse); 52 (void) _XReply (dpy, (xReply *) &rep, 0, xFalse);
50 53
51 if (rep.nPaths) { 54 if (rep.nPaths) {
52 flist = (char **) 55 flist = Xmalloc(rep.nPaths * sizeof (char *));
53 Xmalloc((unsigned) rep.nPaths * sizeof (char *)); 56 if (rep.length < (LONG_MAX >> 2)) {
54 nbytes = (long)rep.length << 2; 57 nbytes = (unsigned long) rep.length << 2;
55 ch = (char *) Xmalloc ((unsigned) (nbytes + 1)); 58 ch = Xmalloc (nbytes + 1);
56 /* +1 to leave room for last null-terminator */ 59 /* +1 to leave room for last null-terminator */
 60 }
57 61
58 if ((! flist) || (! ch)) { 62 if ((! flist) || (! ch)) {
59 if (flist) Xfree((char *) flist); 63 if (flist) Xfree((char *) flist);
60 if (ch) Xfree(ch); 64 if (ch) Xfree(ch);
61 _XEatData(dpy, (unsigned long) nbytes); 65 _XEatData(dpy, rep.length << 2);
62 UnlockDisplay(dpy); 66 UnlockDisplay(dpy);
63 SyncHandle(); 67 SyncHandle();
64 return (char **) NULL; 68 return (char **) NULL;
65 } 69 }
66 70
67 _XReadPad (dpy, ch, nbytes); 71 _XReadPad (dpy, ch, nbytes);
68 /* 72 /*
69 * unpack into null terminated strings. 73 * unpack into null terminated strings.
70 */ 74 */
 75 chend = ch + (nbytes + 1);
71 length = *ch; 76 length = *ch;
72 for (i = 0; i < rep.nPaths; i++) { 77 for (i = 0; i < rep.nPaths; i++) {
73 flist[i] = ch+1; /* skip over length */ 78 if (ch + length < chend) {
74 ch += length + 1; /* find next length ... */ 79 flist[i] = ch+1; /* skip over length */
75 length = *ch; 80 ch += length + 1; /* find next length ... */
76 *ch = '\0'; /* and replace with null-termination */ 81 length = *ch;
 82 *ch = '\0'; /* and replace with null-termination */
 83 count++;
 84 } else
 85 flist[i] = NULL;
77 } 86 }
78 } 87 }
79 else flist = NULL; 88 *npaths = count;
80 *npaths = rep.nPaths; 
81 UnlockDisplay(dpy); 89 UnlockDisplay(dpy);
82 SyncHandle(); 90 SyncHandle();
83 return (flist); 91 return (flist);
84} 92}
85 93
86int 94int
87XFreeFontPath (char **list) 95XFreeFontPath (char **list)
88{ 96{
89 if (list != NULL) { 97 if (list != NULL) {
90 Xfree (list[0]-1); 98 Xfree (list[0]-1);
91 Xfree ((char *)list); 99 Xfree ((char *)list);
92 } 100 }
93 return 1; 101 return 1;
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libX11/dist/src/ListExt.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/ListExt.c 2008/07/30 02:43:11 1.1.1.1
+++ xsrc/external/mit/libX11/dist/src/ListExt.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -21,79 +21,87 @@ CONNECTION WITH THE SOFTWARE OR THE USE  @@ -21,79 +21,87 @@ CONNECTION WITH THE SOFTWARE OR THE USE
21 21
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27/* $XFree86: xc/lib/X11/ListExt.c,v 1.3 2001/01/17 19:41:39 dawes Exp $ */ 27/* $XFree86: xc/lib/X11/ListExt.c,v 1.3 2001/01/17 19:41:39 dawes Exp $ */
28 28
29#define NEED_REPLIES 29#define NEED_REPLIES
30#ifdef HAVE_CONFIG_H 30#ifdef HAVE_CONFIG_H
31#include <config.h> 31#include <config.h>
32#endif 32#endif
33#include "Xlibint.h" 33#include "Xlibint.h"
 34#include <limits.h>
34 35
35char **XListExtensions( 36char **XListExtensions(
36 register Display *dpy, 37 register Display *dpy,
37 int *nextensions) /* RETURN */ 38 int *nextensions) /* RETURN */
38{ 39{
39 xListExtensionsReply rep; 40 xListExtensionsReply rep;
40 char **list; 41 char **list = NULL;
41 char *ch; 42 char *ch = NULL;
 43 char *chend;
 44 int count = 0;
42 register unsigned i; 45 register unsigned i;
43 register int length; 46 register int length;
44 register xReq *req; 47 register xReq *req;
45 register long rlen; 48 unsigned long rlen;
46 49
47 LockDisplay(dpy); 50 LockDisplay(dpy);
48 GetEmptyReq (ListExtensions, req); 51 GetEmptyReq (ListExtensions, req);
49 52
50 if (! _XReply (dpy, (xReply *) &rep, 0, xFalse)) { 53 if (! _XReply (dpy, (xReply *) &rep, 0, xFalse)) {
51 UnlockDisplay(dpy); 54 UnlockDisplay(dpy);
52 SyncHandle(); 55 SyncHandle();
53 return (char **) NULL; 56 return (char **) NULL;
54 } 57 }
55 58
56 if (rep.nExtensions) { 59 if (rep.nExtensions) {
57 list = (char **) Xmalloc ( 60 list = Xmalloc (rep.nExtensions * sizeof (char *));
58 (unsigned)(rep.nExtensions * sizeof (char *))); 61 if (rep.length < (LONG_MAX >> 2)) {
59 rlen = rep.length << 2; 62 rlen = rep.length << 2;
60 ch = (char *) Xmalloc ((unsigned) rlen + 1); 63 ch = Xmalloc (rlen + 1);
61 /* +1 to leave room for last null-terminator */ 64 /* +1 to leave room for last null-terminator */
 65 }
62 66
63 if ((!list) || (!ch)) { 67 if ((!list) || (!ch)) {
64 if (list) Xfree((char *) list); 68 if (list) Xfree((char *) list);
65 if (ch) Xfree((char *) ch); 69 if (ch) Xfree((char *) ch);
66 _XEatData(dpy, (unsigned long) rlen); 70 _XEatData(dpy, rep.length << 2);
67 UnlockDisplay(dpy); 71 UnlockDisplay(dpy);
68 SyncHandle(); 72 SyncHandle();
69 return (char **) NULL; 73 return (char **) NULL;
70 } 74 }
71 75
72 _XReadPad (dpy, ch, rlen); 76 _XReadPad (dpy, ch, rlen);
73 /* 77 /*
74 * unpack into null terminated strings. 78 * unpack into null terminated strings.
75 */ 79 */
 80 chend = ch + (rlen + 1);
76 length = *ch; 81 length = *ch;
77 for (i = 0; i < rep.nExtensions; i++) { 82 for (i = 0; i < rep.nExtensions; i++) {
78 list[i] = ch+1; /* skip over length */ 83 if (ch + length < chend) {
79 ch += length + 1; /* find next length ... */ 84 list[i] = ch+1; /* skip over length */
80 length = *ch; 85 ch += length + 1; /* find next length ... */
81 *ch = '\0'; /* and replace with null-termination */ 86 length = *ch;
 87 *ch = '\0'; /* and replace with null-termination */
 88 count++;
 89 } else
 90 list[i] = NULL;
82 } 91 }
83 } 92 }
84 else list = (char **) NULL; 
85 93
86 *nextensions = rep.nExtensions; 94 *nextensions = count;
87 UnlockDisplay(dpy); 95 UnlockDisplay(dpy);
88 SyncHandle(); 96 SyncHandle();
89 return (list); 97 return (list);
90} 98}
91 99
92int 100int
93XFreeExtensionList (char **list) 101XFreeExtensionList (char **list)
94{ 102{
95 if (list != NULL) { 103 if (list != NULL) {
96 Xfree (list[0]-1); 104 Xfree (list[0]-1);
97 Xfree ((char *)list); 105 Xfree ((char *)list);
98 } 106 }
99 return 1; 107 return 1;
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/Font.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/Font.c 2009/09/17 03:33:05 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/Font.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -24,26 +24,27 @@ SOFTWARE. @@ -24,26 +24,27 @@ SOFTWARE.
24Except as contained in this notice, the name of the X Consortium or of the 24Except as contained in this notice, the name of the X Consortium or of the
25XFree86 Project shall not be used in advertising or otherwise to promote the 25XFree86 Project shall not be used in advertising or otherwise to promote the
26sale, use or other dealings in this Software without prior written 26sale, use or other dealings in this Software without prior written
27authorization from the X Consortium and the XFree86 Project. 27authorization from the X Consortium and the XFree86 Project.
28 28
29*/ 29*/
30/* $XFree86: xc/lib/X11/Font.c,v 1.17 2003/04/13 19:22:16 dawes Exp $ */ 30/* $XFree86: xc/lib/X11/Font.c,v 1.17 2003/04/13 19:22:16 dawes Exp $ */
31 31
32#define NEED_REPLIES 32#define NEED_REPLIES
33#ifdef HAVE_CONFIG_H 33#ifdef HAVE_CONFIG_H
34#include <config.h> 34#include <config.h>
35#endif 35#endif
36#include "Xlibint.h" 36#include "Xlibint.h"
 37#include <limits.h>
37 38
38#if defined(XF86BIGFONT) && !defined(MUSTCOPY) 39#if defined(XF86BIGFONT) && !defined(MUSTCOPY)
39#define USE_XF86BIGFONT 40#define USE_XF86BIGFONT
40#endif 41#endif
41#ifdef USE_XF86BIGFONT 42#ifdef USE_XF86BIGFONT
42#include <sys/types.h> 43#include <sys/types.h>
43#ifdef HAS_SHM 44#ifdef HAS_SHM
44#include <sys/ipc.h> 45#include <sys/ipc.h>
45#include <sys/shm.h> 46#include <sys/shm.h>
46#endif 47#endif
47 48
48#include <stdio.h> 49#include <stdio.h>
49#include <stdlib.h> 50#include <stdlib.h>
@@ -176,27 +177,28 @@ XFreeFont( @@ -176,27 +177,28 @@ XFreeFont(
176 Xfree ((char *) fs->properties); 177 Xfree ((char *) fs->properties);
177 Xfree ((char *) fs); 178 Xfree ((char *) fs);
178 return 1; 179 return 1;
179} 180}
180 181
181 182
182static XFontStruct * 183static XFontStruct *
183_XQueryFont ( 184_XQueryFont (
184 register Display *dpy, 185 register Display *dpy,
185 Font fid, 186 Font fid,
186 unsigned long seq) 187 unsigned long seq)
187{ 188{
188 register XFontStruct *fs; 189 register XFontStruct *fs;
189 register long nbytes; 190 unsigned long nbytes;
 191 unsigned long reply_left; /* unused data words left in reply buffer */
190 xQueryFontReply reply; 192 xQueryFontReply reply;
191 register xResourceReq *req; 193 register xResourceReq *req;
192 register _XExtension *ext; 194 register _XExtension *ext;
193 _XAsyncHandler async; 195 _XAsyncHandler async;
194 _XAsyncErrorState async_state; 196 _XAsyncErrorState async_state;
195 197
196 if (seq) { 198 if (seq) {
197 async_state.min_sequence_number = seq; 199 async_state.min_sequence_number = seq;
198 async_state.max_sequence_number = seq; 200 async_state.max_sequence_number = seq;
199 async_state.error_code = BadName; 201 async_state.error_code = BadName;
200 async_state.major_opcode = X_OpenFont; 202 async_state.major_opcode = X_OpenFont;
201 async_state.minor_opcode = 0; 203 async_state.minor_opcode = 0;
202 async_state.error_count = 0; 204 async_state.error_count = 0;
@@ -204,29 +206,30 @@ _XQueryFont ( @@ -204,29 +206,30 @@ _XQueryFont (
204 async.handler = _XAsyncErrorHandler; 206 async.handler = _XAsyncErrorHandler;
205 async.data = (XPointer)&async_state; 207 async.data = (XPointer)&async_state;
206 dpy->async_handlers = &async; 208 dpy->async_handlers = &async;
207 } 209 }
208 GetResReq(QueryFont, fid, req); 210 GetResReq(QueryFont, fid, req);
209 if (!_XReply (dpy, (xReply *) &reply, 211 if (!_XReply (dpy, (xReply *) &reply,
210 ((SIZEOF(xQueryFontReply) - SIZEOF(xReply)) >> 2), xFalse)) { 212 ((SIZEOF(xQueryFontReply) - SIZEOF(xReply)) >> 2), xFalse)) {
211 if (seq) 213 if (seq)
212 DeqAsyncHandler(dpy, &async); 214 DeqAsyncHandler(dpy, &async);
213 return (XFontStruct *)NULL; 215 return (XFontStruct *)NULL;
214 } 216 }
215 if (seq) 217 if (seq)
216 DeqAsyncHandler(dpy, &async); 218 DeqAsyncHandler(dpy, &async);
 219 reply_left = reply.length -
 220 ((SIZEOF(xQueryFontReply) - SIZEOF(xReply)) >> 2);
217 if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) { 221 if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) {
218 _XEatData(dpy, (unsigned long)(reply.nFontProps * SIZEOF(xFontProp) + 222 _XEatData(dpy, reply_left << 2);
219 reply.nCharInfos * SIZEOF(xCharInfo))); 
220 return (XFontStruct *)NULL; 223 return (XFontStruct *)NULL;
221 } 224 }
222 fs->ext_data = NULL; 225 fs->ext_data = NULL;
223 fs->fid = fid; 226 fs->fid = fid;
224 fs->direction = reply.drawDirection; 227 fs->direction = reply.drawDirection;
225 fs->min_char_or_byte2 = reply.minCharOrByte2; 228 fs->min_char_or_byte2 = reply.minCharOrByte2;
226 fs->max_char_or_byte2 = reply.maxCharOrByte2; 229 fs->max_char_or_byte2 = reply.maxCharOrByte2;
227 fs->min_byte1 = reply.minByte1; 230 fs->min_byte1 = reply.minByte1;
228 fs->max_byte1 = reply.maxByte1; 231 fs->max_byte1 = reply.maxByte1;
229 fs->default_char = reply.defaultChar; 232 fs->default_char = reply.defaultChar;
230 fs->all_chars_exist = reply.allCharsExist; 233 fs->all_chars_exist = reply.allCharsExist;
231 fs->ascent = cvtINT16toInt (reply.fontAscent); 234 fs->ascent = cvtINT16toInt (reply.fontAscent);
232 fs->descent = cvtINT16toInt (reply.fontDescent); 235 fs->descent = cvtINT16toInt (reply.fontDescent);
@@ -254,72 +257,80 @@ _XQueryFont ( @@ -254,72 +257,80 @@ _XQueryFont (
254#else 257#else
255 /* XXX the next two statements won't work if short isn't 16 bits */ 258 /* XXX the next two statements won't work if short isn't 16 bits */
256 fs->min_bounds = * (XCharStruct *) &reply.minBounds; 259 fs->min_bounds = * (XCharStruct *) &reply.minBounds;
257 fs->max_bounds = * (XCharStruct *) &reply.maxBounds; 260 fs->max_bounds = * (XCharStruct *) &reply.maxBounds;
258#endif /* MUSTCOPY */ 261#endif /* MUSTCOPY */
259 262
260 fs->n_properties = reply.nFontProps; 263 fs->n_properties = reply.nFontProps;
261 /* 264 /*
262 * if no properties defined for the font, then it is bad 265 * if no properties defined for the font, then it is bad
263 * font, but shouldn't try to read nothing. 266 * font, but shouldn't try to read nothing.
264 */ 267 */
265 fs->properties = NULL; 268 fs->properties = NULL;
266 if (fs->n_properties > 0) { 269 if (fs->n_properties > 0) {
267 nbytes = reply.nFontProps * sizeof(XFontProp); 270 /* nFontProps is a CARD16 */
268 fs->properties = (XFontProp *) Xmalloc ((unsigned) nbytes); 
269 nbytes = reply.nFontProps * SIZEOF(xFontProp); 271 nbytes = reply.nFontProps * SIZEOF(xFontProp);
 272 if ((nbytes >> 2) <= reply_left) {
 273 size_t pbytes = reply.nFontProps * sizeof(XFontProp);
 274 fs->properties = Xmalloc (pbytes);
 275 }
270 if (! fs->properties) { 276 if (! fs->properties) {
271 Xfree((char *) fs); 277 Xfree((char *) fs);
272 _XEatData(dpy, (unsigned long) 278 _XEatData(dpy, reply_left << 2);
273 (nbytes + reply.nCharInfos * SIZEOF(xCharInfo))); 
274 return (XFontStruct *)NULL; 279 return (XFontStruct *)NULL;
275 } 280 }
276 _XRead32 (dpy, (long *)fs->properties, nbytes); 281 _XRead32 (dpy, (long *)fs->properties, nbytes);
 282 reply_left -= (nbytes >> 2);
277 } 283 }
278 /* 284 /*
279 * If no characters in font, then it is a bad font, but 285 * If no characters in font, then it is a bad font, but
280 * shouldn't try to read nothing. 286 * shouldn't try to read nothing.
281 */ 287 */
282 /* have to unpack charinfos on some machines (CRAY) */ 288 /* have to unpack charinfos on some machines (CRAY) */
283 fs->per_char = NULL; 289 fs->per_char = NULL;
284 if (reply.nCharInfos > 0){ 290 if (reply.nCharInfos > 0){
285 nbytes = reply.nCharInfos * sizeof(XCharStruct); 291 /* nCharInfos is a CARD32 */
286 if (! (fs->per_char = (XCharStruct *) Xmalloc ((unsigned) nbytes))) { 292 if (reply.nCharInfos < (INT_MAX / sizeof(XCharStruct))) {
 293 nbytes = reply.nCharInfos * SIZEOF(xCharInfo);
 294 if ((nbytes >> 2) <= reply_left) {
 295 size_t cibytes = reply.nCharInfos * sizeof(XCharStruct);
 296 fs->per_char = Xmalloc (cibytes);
 297 }
 298 }
 299 if (! fs->per_char) {
287 if (fs->properties) Xfree((char *) fs->properties); 300 if (fs->properties) Xfree((char *) fs->properties);
288 Xfree((char *) fs); 301 Xfree((char *) fs);
289 _XEatData(dpy, (unsigned long) 302 _XEatData(dpy, reply_left << 2);
290 (reply.nCharInfos * SIZEOF(xCharInfo))); 
291 return (XFontStruct *)NULL; 303 return (XFontStruct *)NULL;
292 } 304 }
293 305
294#ifdef MUSTCOPY 306#ifdef MUSTCOPY
295 { 307 {
296 register XCharStruct *cs = fs->per_char; 308 register XCharStruct *cs = fs->per_char;
297 register int i; 309 register int i;
298 310
299 for (i = 0; i < reply.nCharInfos; i++, cs++) { 311 for (i = 0; i < reply.nCharInfos; i++, cs++) {
300 xCharInfo xcip; 312 xCharInfo xcip;
301 313
302 _XRead(dpy, (char *)&xcip, SIZEOF(xCharInfo)); 314 _XRead(dpy, (char *)&xcip, SIZEOF(xCharInfo));
303 cs->lbearing = cvtINT16toShort(xcip.leftSideBearing); 315 cs->lbearing = cvtINT16toShort(xcip.leftSideBearing);
304 cs->rbearing = cvtINT16toShort(xcip.rightSideBearing); 316 cs->rbearing = cvtINT16toShort(xcip.rightSideBearing);
305 cs->width = cvtINT16toShort(xcip.characterWidth); 317 cs->width = cvtINT16toShort(xcip.characterWidth);
306 cs->ascent = cvtINT16toShort(xcip.ascent); 318 cs->ascent = cvtINT16toShort(xcip.ascent);
307 cs->descent = cvtINT16toShort(xcip.descent); 319 cs->descent = cvtINT16toShort(xcip.descent);
308 cs->attributes = xcip.attributes; 320 cs->attributes = xcip.attributes;
309 } 321 }
310 } 322 }
311#else 323#else
312 nbytes = reply.nCharInfos * SIZEOF(xCharInfo); 
313 _XRead16 (dpy, (char *)fs->per_char, nbytes); 324 _XRead16 (dpy, (char *)fs->per_char, nbytes);
314#endif 325#endif
315 } 326 }
316 327
317 /* call out to any extensions interested */ 328 /* call out to any extensions interested */
318 for (ext = dpy->ext_procs; ext; ext = ext->next) 329 for (ext = dpy->ext_procs; ext; ext = ext->next)
319 if (ext->create_Font) (*ext->create_Font)(dpy, fs, &ext->codes); 330 if (ext->create_Font) (*ext->create_Font)(dpy, fs, &ext->codes);
320 return fs; 331 return fs;
321} 332}
322 333
323#ifdef USE_XF86BIGFONT 334#ifdef USE_XF86BIGFONT
324 335
325/* Magic cookie for finding the right XExtData structure on the display's 336/* Magic cookie for finding the right XExtData structure on the display's
@@ -427,27 +438,28 @@ _XF86BigfontFreeNop ( @@ -427,27 +438,28 @@ _XF86BigfontFreeNop (
427 XExtData *extension) 438 XExtData *extension)
428{ 439{
429 return 0; 440 return 0;
430} 441}
431 442
432static XFontStruct * 443static XFontStruct *
433_XF86BigfontQueryFont ( 444_XF86BigfontQueryFont (
434 register Display *dpy, 445 register Display *dpy,
435 XF86BigfontCodes *extcodes, 446 XF86BigfontCodes *extcodes,
436 Font fid, 447 Font fid,
437 unsigned long seq) 448 unsigned long seq)
438{ 449{
439 register XFontStruct *fs; 450 register XFontStruct *fs;
440 register long nbytes; 451 unsigned long nbytes;
 452 unsigned long reply_left; /* unused data left in reply buffer */
441 xXF86BigfontQueryFontReply reply; 453 xXF86BigfontQueryFontReply reply;
442 register xXF86BigfontQueryFontReq *req; 454 register xXF86BigfontQueryFontReq *req;
443 register _XExtension *ext; 455 register _XExtension *ext;
444 _XAsyncHandler async1; 456 _XAsyncHandler async1;
445 _XAsyncErrorState async1_state; 457 _XAsyncErrorState async1_state;
446 _XAsyncHandler async2; 458 _XAsyncHandler async2;
447 _XAsyncErrorState async2_state; 459 _XAsyncErrorState async2_state;
448 460
449 if (seq) { 461 if (seq) {
450 async1_state.min_sequence_number = seq; 462 async1_state.min_sequence_number = seq;
451 async1_state.max_sequence_number = seq; 463 async1_state.max_sequence_number = seq;
452 async1_state.error_code = BadName; 464 async1_state.error_code = BadName;
453 async1_state.major_opcode = X_OpenFont; 465 async1_state.major_opcode = X_OpenFont;
@@ -480,96 +492,102 @@ _XF86BigfontQueryFont ( @@ -480,96 +492,102 @@ _XF86BigfontQueryFont (
480 async2.data = (XPointer)&async2_state; 492 async2.data = (XPointer)&async2_state;
481 dpy->async_handlers = &async2; 493 dpy->async_handlers = &async2;
482 494
483 if (!_XReply (dpy, (xReply *) &reply, 495 if (!_XReply (dpy, (xReply *) &reply,
484 ((SIZEOF(xXF86BigfontQueryFontReply) - SIZEOF(xReply)) >> 2), xFalse)) { 496 ((SIZEOF(xXF86BigfontQueryFontReply) - SIZEOF(xReply)) >> 2), xFalse)) {
485 DeqAsyncHandler(dpy, &async2); 497 DeqAsyncHandler(dpy, &async2);
486 if (seq) 498 if (seq)
487 DeqAsyncHandler(dpy, &async1); 499 DeqAsyncHandler(dpy, &async1);
488 return (XFontStruct *)NULL; 500 return (XFontStruct *)NULL;
489 } 501 }
490 DeqAsyncHandler(dpy, &async2); 502 DeqAsyncHandler(dpy, &async2);
491 if (seq) 503 if (seq)
492 DeqAsyncHandler(dpy, &async1); 504 DeqAsyncHandler(dpy, &async1);
 505 reply_left = reply.length -
 506 ((SIZEOF(xXF86BigfontQueryFontReply) - SIZEOF(xReply)) >> 2);
493 if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) { 507 if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) {
494 _XEatData(dpy, 508 _XEatData(dpy, reply_left << 2);
495 reply.nFontProps * SIZEOF(xFontProp) 
496 + (reply.nCharInfos > 0 && reply.shmid == (CARD32)(-1) 
497 ? reply.nUniqCharInfos * SIZEOF(xCharInfo) 
498 + (reply.nCharInfos+1)/2 * 2 * sizeof(CARD16) 
499 : 0)); 
500 return (XFontStruct *)NULL; 509 return (XFontStruct *)NULL;
501 } 510 }
502 fs->ext_data = NULL; 511 fs->ext_data = NULL;
503 fs->fid = fid; 512 fs->fid = fid;
504 fs->direction = reply.drawDirection; 513 fs->direction = reply.drawDirection;
505 fs->min_char_or_byte2 = reply.minCharOrByte2; 514 fs->min_char_or_byte2 = reply.minCharOrByte2;
506 fs->max_char_or_byte2 = reply.maxCharOrByte2; 515 fs->max_char_or_byte2 = reply.maxCharOrByte2;
507 fs->min_byte1 = reply.minByte1; 516 fs->min_byte1 = reply.minByte1;
508 fs->max_byte1 = reply.maxByte1; 517 fs->max_byte1 = reply.maxByte1;
509 fs->default_char = reply.defaultChar; 518 fs->default_char = reply.defaultChar;
510 fs->all_chars_exist = reply.allCharsExist; 519 fs->all_chars_exist = reply.allCharsExist;
511 fs->ascent = cvtINT16toInt (reply.fontAscent); 520 fs->ascent = cvtINT16toInt (reply.fontAscent);
512 fs->descent = cvtINT16toInt (reply.fontDescent); 521 fs->descent = cvtINT16toInt (reply.fontDescent);
513 522
514 /* XXX the next two statements won't work if short isn't 16 bits */ 523 /* XXX the next two statements won't work if short isn't 16 bits */
515 fs->min_bounds = * (XCharStruct *) &reply.minBounds; 524 fs->min_bounds = * (XCharStruct *) &reply.minBounds;
516 fs->max_bounds = * (XCharStruct *) &reply.maxBounds; 525 fs->max_bounds = * (XCharStruct *) &reply.maxBounds;
517 526
518 fs->n_properties = reply.nFontProps; 527 fs->n_properties = reply.nFontProps;
519 /* 528 /*
520 * if no properties defined for the font, then it is bad 529 * if no properties defined for the font, then it is bad
521 * font, but shouldn't try to read nothing. 530 * font, but shouldn't try to read nothing.
522 */ 531 */
523 fs->properties = NULL; 532 fs->properties = NULL;
524 if (fs->n_properties > 0) { 533 if (fs->n_properties > 0) {
525 nbytes = reply.nFontProps * sizeof(XFontProp); 534 /* nFontProps is a CARD16 */
526 fs->properties = (XFontProp *) Xmalloc ((unsigned) nbytes); 
527 nbytes = reply.nFontProps * SIZEOF(xFontProp); 535 nbytes = reply.nFontProps * SIZEOF(xFontProp);
 536 if ((nbytes >> 2) <= reply_left) {
 537 size_t pbytes = reply.nFontProps * sizeof(XFontProp);
 538 fs->properties = Xmalloc (pbytes);
 539 }
528 if (! fs->properties) { 540 if (! fs->properties) {
529 Xfree((char *) fs); 541 Xfree((char *) fs);
530 _XEatData(dpy, 542 _XEatData(dpy, reply_left << 2);
531 nbytes 
532 + (reply.nCharInfos > 0 && reply.shmid == (CARD32)(-1) 
533 ? reply.nUniqCharInfos * SIZEOF(xCharInfo) 
534 + (reply.nCharInfos+1)/2 * 2 * sizeof(CARD16) 
535 : 0)); 
536 return (XFontStruct *)NULL; 543 return (XFontStruct *)NULL;
537 } 544 }
538 _XRead32 (dpy, (long *)fs->properties, nbytes); 545 _XRead32 (dpy, (long *)fs->properties, nbytes);
 546 reply_left -= (nbytes >> 2);
539 } 547 }
540 548
541 fs->per_char = NULL; 549 fs->per_char = NULL;
 550#ifndef LONG64
 551 /* compares each part to half the maximum, which should be far more than
 552 any real font needs, so the combined total doesn't overflow either */
 553 if (reply.nUniqCharInfos > ((ULONG_MAX / 2) / SIZEOF(xCharInfo)) ||
 554 reply.nCharInfos > ((ULONG_MAX / 2) / sizeof(CARD16))) {
 555 Xfree((char *) fs);
 556 _XEatData(dpy, reply_left << 2);
 557 return (XFontStruct *)NULL;
 558 }
 559#endif
542 if (reply.nCharInfos > 0) { 560 if (reply.nCharInfos > 0) {
543 /* fprintf(stderr, "received font metrics, nCharInfos = %d, nUniqCharInfos = %d, shmid = %d\n", reply.nCharInfos, reply.nUniqCharInfos, reply.shmid); */ 561 /* fprintf(stderr, "received font metrics, nCharInfos = %d, nUniqCharInfos = %d, shmid = %d\n", reply.nCharInfos, reply.nUniqCharInfos, reply.shmid); */
544 if (reply.shmid == (CARD32)(-1)) { 562 if (reply.shmid == (CARD32)(-1)) {
545 xCharInfo* pUniqCI; 563 xCharInfo* pUniqCI;
546 CARD16* pIndex2UniqIndex; 564 CARD16* pIndex2UniqIndex;
547 int i; 565 int i;
548 566
549 nbytes = reply.nUniqCharInfos * SIZEOF(xCharInfo) 567 nbytes = reply.nUniqCharInfos * SIZEOF(xCharInfo)
550 + (reply.nCharInfos+1)/2 * 2 * sizeof(CARD16); 568 + (reply.nCharInfos+1)/2 * 2 * sizeof(CARD16);
551 pUniqCI = (xCharInfo *) Xmalloc (nbytes); 569 pUniqCI = (xCharInfo *) Xmalloc (nbytes);
552 if (!pUniqCI) { 570 if (!pUniqCI) {
553 if (fs->properties) Xfree((char *) fs->properties); 571 if (fs->properties) Xfree((char *) fs->properties);
554 Xfree((char *) fs); 572 Xfree((char *) fs);
555 _XEatData(dpy, nbytes); 573 _XEatData(dpy, reply_left << 2);
556 return (XFontStruct *)NULL; 574 return (XFontStruct *)NULL;
557 } 575 }
558 if (! (fs->per_char = (XCharStruct *) Xmalloc (reply.nCharInfos * sizeof(XCharStruct)))) { 576 if (! (fs->per_char = (XCharStruct *) Xmalloc (reply.nCharInfos * sizeof(XCharStruct)))) {
559 Xfree((char *) pUniqCI); 577 Xfree((char *) pUniqCI);
560 if (fs->properties) Xfree((char *) fs->properties); 578 if (fs->properties) Xfree((char *) fs->properties);
561 Xfree((char *) fs); 579 Xfree((char *) fs);
562 _XEatData(dpy, nbytes); 580 _XEatData(dpy, reply_left << 2);
563 return (XFontStruct *)NULL; 581 return (XFontStruct *)NULL;
564 } 582 }
565 _XRead16 (dpy, (char *) pUniqCI, nbytes); 583 _XRead16 (dpy, (char *) pUniqCI, nbytes);
566 pIndex2UniqIndex = (CARD16*) (pUniqCI + reply.nUniqCharInfos); 584 pIndex2UniqIndex = (CARD16*) (pUniqCI + reply.nUniqCharInfos);
567 for (i = 0; i < reply.nCharInfos; i++) { 585 for (i = 0; i < reply.nCharInfos; i++) {
568 if (pIndex2UniqIndex[i] >= reply.nUniqCharInfos) { 586 if (pIndex2UniqIndex[i] >= reply.nUniqCharInfos) {
569 fprintf(stderr, "_XF86BigfontQueryFont: server returned wrong data\n"); 587 fprintf(stderr, "_XF86BigfontQueryFont: server returned wrong data\n");
570 Xfree((char *) pUniqCI); 588 Xfree((char *) pUniqCI);
571 if (fs->properties) Xfree((char *) fs->properties); 589 if (fs->properties) Xfree((char *) fs->properties);
572 Xfree((char *) fs); 590 Xfree((char *) fs);
573 return (XFontStruct *)NULL; 591 return (XFontStruct *)NULL;
574 } 592 }
575 /* XXX the next statement won't work if short isn't 16 bits */ 593 /* XXX the next statement won't work if short isn't 16 bits */
@@ -604,26 +622,27 @@ _XF86BigfontQueryFont ( @@ -604,26 +622,27 @@ _XF86BigfontQueryFont (
604 if (extcodes->serverCapabilities & CAP_VerifiedLocal) 622 if (extcodes->serverCapabilities & CAP_VerifiedLocal)
605 fprintf(stderr, "_XF86BigfontQueryFont: could not attach shm segment\n"); 623 fprintf(stderr, "_XF86BigfontQueryFont: could not attach shm segment\n");
606 Xfree((char *) pData); 624 Xfree((char *) pData);
607 if (fs->properties) Xfree((char *) fs->properties); 625 if (fs->properties) Xfree((char *) fs->properties);
608 Xfree((char *) fs); 626 Xfree((char *) fs);
609 /* Stop requesting shared memory transport from now on. */ 627 /* Stop requesting shared memory transport from now on. */
610 extcodes->serverCapabilities &= ~ XF86Bigfont_CAP_LocalShm; 628 extcodes->serverCapabilities &= ~ XF86Bigfont_CAP_LocalShm;
611 return (XFontStruct *)NULL; 629 return (XFontStruct *)NULL;
612 } 630 }
613 631
614 if (!(extcodes->serverCapabilities & CAP_VerifiedLocal)) { 632 if (!(extcodes->serverCapabilities & CAP_VerifiedLocal)) {
615 struct shmid_ds buf; 633 struct shmid_ds buf;
616 if (!(shmctl(reply.shmid, IPC_STAT, &buf) >= 0 634 if (!(shmctl(reply.shmid, IPC_STAT, &buf) >= 0
 635 && reply.nCharInfos < (LONG_MAX / sizeof(XCharStruct))
617 && buf.shm_segsz >= reply.shmsegoffset + reply.nCharInfos * sizeof(XCharStruct) + sizeof(CARD32) 636 && buf.shm_segsz >= reply.shmsegoffset + reply.nCharInfos * sizeof(XCharStruct) + sizeof(CARD32)
618 && *(CARD32 *)(addr + reply.shmsegoffset + reply.nCharInfos * sizeof(XCharStruct)) == extcodes->serverSignature)) { 637 && *(CARD32 *)(addr + reply.shmsegoffset + reply.nCharInfos * sizeof(XCharStruct)) == extcodes->serverSignature)) {
619 shmdt(addr); 638 shmdt(addr);
620 Xfree((char *) pData); 639 Xfree((char *) pData);
621 if (fs->properties) Xfree((char *) fs->properties); 640 if (fs->properties) Xfree((char *) fs->properties);
622 Xfree((char *) fs); 641 Xfree((char *) fs);
623 /* Stop requesting shared memory transport from now on. */ 642 /* Stop requesting shared memory transport from now on. */
624 extcodes->serverCapabilities &= ~ XF86Bigfont_CAP_LocalShm; 643 extcodes->serverCapabilities &= ~ XF86Bigfont_CAP_LocalShm;
625 return (XFontStruct *)NULL; 644 return (XFontStruct *)NULL;
626 } 645 }
627 extcodes->serverCapabilities |= CAP_VerifiedLocal; 646 extcodes->serverCapabilities |= CAP_VerifiedLocal;
628 } 647 }
629 648
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/FontInfo.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/FontInfo.c 2009/09/17 03:33:05 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/FontInfo.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -21,110 +21,105 @@ CONNECTION WITH THE SOFTWARE OR THE USE  @@ -21,110 +21,105 @@ CONNECTION WITH THE SOFTWARE OR THE USE
21 21
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27/* $XFree86: xc/lib/X11/FontInfo.c,v 1.6 2001/12/14 19:54:00 dawes Exp $ */ 27/* $XFree86: xc/lib/X11/FontInfo.c,v 1.6 2001/12/14 19:54:00 dawes Exp $ */
28 28
29#define NEED_REPLIES 29#define NEED_REPLIES
30#ifdef HAVE_CONFIG_H 30#ifdef HAVE_CONFIG_H
31#include <config.h> 31#include <config.h>
32#endif 32#endif
33#include "Xlibint.h" 33#include "Xlibint.h"
 34#include <limits.h>
34 35
35#if defined(XF86BIGFONT) && !defined(MUSTCOPY) 36#if defined(XF86BIGFONT) && !defined(MUSTCOPY)
36#define USE_XF86BIGFONT 37#define USE_XF86BIGFONT
37#endif 38#endif
38#ifdef USE_XF86BIGFONT 39#ifdef USE_XF86BIGFONT
39extern void _XF86BigfontFreeFontMetrics( 40extern void _XF86BigfontFreeFontMetrics(
40 XFontStruct* /* fs */ 41 XFontStruct* /* fs */
41); 42);
42#endif 43#endif
43 44
44char **XListFontsWithInfo( 45char **XListFontsWithInfo(
45register Display *dpy, 46register Display *dpy,
46_Xconst char *pattern, /* null-terminated */ 47_Xconst char *pattern, /* null-terminated */
47int maxNames, 48int maxNames,
48int *actualCount, /* RETURN */ 49int *actualCount, /* RETURN */
49XFontStruct **info) /* RETURN */ 50XFontStruct **info) /* RETURN */
50{ 51{
51 register long nbytes; 52 unsigned long nbytes;
 53 unsigned long reply_left; /* unused data left in reply buffer */
52 register int i; 54 register int i;
53 register XFontStruct *fs; 55 register XFontStruct *fs;
54 register int size = 0; 56 unsigned int size = 0;
55 XFontStruct *finfo = NULL; 57 XFontStruct *finfo = NULL;
56 char **flist = NULL; 58 char **flist = NULL;
57 xListFontsWithInfoReply reply; 59 xListFontsWithInfoReply reply;
58 register xListFontsReq *req; 60 register xListFontsReq *req;
59 int j; 61 int j;
60 62
61 LockDisplay(dpy); 63 LockDisplay(dpy);
62 GetReq(ListFontsWithInfo, req); 64 GetReq(ListFontsWithInfo, req);
63 req->maxNames = maxNames; 65 req->maxNames = maxNames;
64 nbytes = req->nbytes = pattern ? strlen (pattern) : 0; 66 nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
65 req->length += (nbytes + 3) >> 2; 67 req->length += (nbytes + 3) >> 2;
66 _XSend (dpy, pattern, nbytes); 68 _XSend (dpy, pattern, nbytes);
67 /* use _XSend instead of Data, since subsequent _XReply will flush buffer */ 69 /* use _XSend instead of Data, since subsequent _XReply will flush buffer */
68 70
69 for (i = 0; ; i++) { 71 for (i = 0; ; i++) {
70 if (!_XReply (dpy, (xReply *) &reply, 72 if (!_XReply (dpy, (xReply *) &reply,
71 ((SIZEOF(xListFontsWithInfoReply) - 73 ((SIZEOF(xListFontsWithInfoReply) -
72 SIZEOF(xGenericReply)) >> 2), xFalse)) { 74 SIZEOF(xGenericReply)) >> 2), xFalse)) {
73 for (j=(i-1); (j >= 0); j--) { 75 reply.nameLength = 0; /* avoid trying to read more replies */
74 Xfree(flist[j]); 76 reply_left = 0;
75 if (finfo[j].properties) Xfree((char *) finfo[j].properties); 77 goto badmem;
76 } 
77 if (flist) Xfree((char *) flist); 
78 if (finfo) Xfree((char *) finfo); 
79 UnlockDisplay(dpy); 
80 SyncHandle(); 
81 return ((char **) NULL); 
82 } 78 }
83 if (reply.nameLength == 0) 79 reply_left = reply.length -
 80 ((SIZEOF(xListFontsWithInfoReply) - SIZEOF(xGenericReply)) >> 2);
 81 if (reply.nameLength == 0) {
 82 _XEatData(dpy, reply_left << 2);
84 break; 83 break;
 84 }
 85 if (reply.nReplies >= (INT_MAX - i)) /* avoid overflowing size */
 86 goto badmem;
85 if ((i + reply.nReplies) >= size) { 87 if ((i + reply.nReplies) >= size) {
86 size = i + reply.nReplies + 1; 88 size = i + reply.nReplies + 1;
87 89
 90 if (size >= (INT_MAX / sizeof(XFontStruct)))
 91 goto badmem;
 92
88 if (finfo) { 93 if (finfo) {
89 XFontStruct * tmp_finfo = (XFontStruct *) 94 XFontStruct * tmp_finfo;
90 Xrealloc ((char *) finfo, 95 char ** tmp_flist;
91 (unsigned) (sizeof(XFontStruct) * size)); 96
92 char ** tmp_flist = (char **) 97 tmp_finfo = Xrealloc (finfo, sizeof(XFontStruct) * size);
93 Xrealloc ((char *) flist, 98 if (tmp_finfo)
94 (unsigned) (sizeof(char *) * (size+1))); 99 finfo = tmp_finfo;
95 100 else
96 if ((! tmp_finfo) || (! tmp_flist)) { 101 goto badmem;
97 /* free all the memory that we allocated */ 102
98 for (j=(i-1); (j >= 0); j--) { 103 tmp_flist = Xrealloc (flist, sizeof(char *) * (size+1));
99 Xfree(flist[j]); 104 if (tmp_flist)
100 if (finfo[j].properties) 105 flist = tmp_flist;
101 Xfree((char *) finfo[j].properties); 106 else
102 } 107 goto badmem;
103 if (tmp_flist) Xfree((char *) tmp_flist); 
104 else Xfree((char *) flist); 
105 if (tmp_finfo) Xfree((char *) tmp_finfo); 
106 else Xfree((char *) finfo); 
107 goto clearwire; 
108 } 
109 finfo = tmp_finfo; 
110 flist = tmp_flist; 
111 } 108 }
112 else { 109 else {
113 if (! (finfo = (XFontStruct *) 110 if (! (finfo = Xmalloc(sizeof(XFontStruct) * size)))
114 Xmalloc((unsigned) (sizeof(XFontStruct) * size)))) 
115 goto clearwire; 111 goto clearwire;
116 if (! (flist = (char **) 112 if (! (flist = Xmalloc(sizeof(char *) * (size+1)))) {
117 Xmalloc((unsigned) (sizeof(char *) * (size+1))))) { 
118 Xfree((char *) finfo); 113 Xfree((char *) finfo);
119 goto clearwire; 114 goto clearwire;
120 } 115 }
121 } 116 }
122 } 117 }
123 fs = &finfo[i]; 118 fs = &finfo[i];
124 119
125 fs->ext_data = NULL; 120 fs->ext_data = NULL;
126 fs->per_char = NULL; 121 fs->per_char = NULL;
127 fs->fid = None; 122 fs->fid = None;
128 fs->direction = reply.drawDirection; 123 fs->direction = reply.drawDirection;
129 fs->min_char_or_byte2 = reply.minCharOrByte2; 124 fs->min_char_or_byte2 = reply.minCharOrByte2;
130 fs->max_char_or_byte2 = reply.maxCharOrByte2; 125 fs->max_char_or_byte2 = reply.maxCharOrByte2;
@@ -152,44 +147,47 @@ XFontStruct **info) /* RETURN */ @@ -152,44 +147,47 @@ XFontStruct **info) /* RETURN */
152 fs->max_bounds.rbearing = xcip->rightSideBearing; 147 fs->max_bounds.rbearing = xcip->rightSideBearing;
153 fs->max_bounds.width = xcip->characterWidth; 148 fs->max_bounds.width = xcip->characterWidth;
154 fs->max_bounds.ascent = xcip->ascent; 149 fs->max_bounds.ascent = xcip->ascent;
155 fs->max_bounds.descent = xcip->descent; 150 fs->max_bounds.descent = xcip->descent;
156 fs->max_bounds.attributes = xcip->attributes; 151 fs->max_bounds.attributes = xcip->attributes;
157 } 152 }
158#else 153#else
159 /* XXX the next two statements won't work if short isn't 16 bits */ 154 /* XXX the next two statements won't work if short isn't 16 bits */
160 fs->min_bounds = * (XCharStruct *) &reply.minBounds; 155 fs->min_bounds = * (XCharStruct *) &reply.minBounds;
161 fs->max_bounds = * (XCharStruct *) &reply.maxBounds; 156 fs->max_bounds = * (XCharStruct *) &reply.maxBounds;
162#endif /* MUSTCOPY */ 157#endif /* MUSTCOPY */
163 158
164 fs->n_properties = reply.nFontProps; 159 fs->n_properties = reply.nFontProps;
 160 fs->properties = NULL;
165 if (fs->n_properties > 0) { 161 if (fs->n_properties > 0) {
166 nbytes = reply.nFontProps * sizeof(XFontProp); 162 /* nFontProps is a CARD16 */
167 if (! (fs->properties = (XFontProp *) Xmalloc((unsigned) nbytes))) 
168 goto badmem; 
169 nbytes = reply.nFontProps * SIZEOF(xFontProp); 163 nbytes = reply.nFontProps * SIZEOF(xFontProp);
 164 if ((nbytes >> 2) <= reply_left) {
 165 size_t pbytes = reply.nFontProps * sizeof(XFontProp);
 166 fs->properties = Xmalloc (pbytes);
 167 }
 168 if (! fs->properties)
 169 goto badmem;
170 _XRead32 (dpy, (long *)fs->properties, nbytes); 170 _XRead32 (dpy, (long *)fs->properties, nbytes);
 171 reply_left -= (nbytes >> 2);
 172 }
171 173
172 } else 174 /* nameLength is a CARD8 */
173 fs->properties = NULL; 175 nbytes = reply.nameLength + 1;
174 
175 j = reply.nameLength + 1; 
176 if (!i) 176 if (!i)
177 j++; /* make first string 1 byte longer, to match XListFonts */ 177 nbytes++; /* make first string 1 byte longer, to match XListFonts */
178 flist[i] = (char *) Xmalloc ((unsigned int) j); 178 flist[i] = Xmalloc (nbytes);
179 if (! flist[i]) { 179 if (! flist[i]) {
180 if (finfo[i].properties) Xfree((char *) finfo[i].properties); 180 if (finfo[i].properties) Xfree((char *) finfo[i].properties);
181 nbytes = (reply.nameLength + 3) & ~3; 
182 _XEatData(dpy, (unsigned long) nbytes); 
183 goto badmem; 181 goto badmem;
184 } 182 }
185 if (!i) { 183 if (!i) {
186 *flist[0] = 0; /* zero to distinguish from XListFonts */ 184 *flist[0] = 0; /* zero to distinguish from XListFonts */
187 flist[0]++; 185 flist[0]++;
188 } 186 }
189 flist[i][reply.nameLength] = '\0'; 187 flist[i][reply.nameLength] = '\0';
190 _XReadPad (dpy, flist[i], (long) reply.nameLength); 188 _XReadPad (dpy, flist[i], (long) reply.nameLength);
191 } 189 }
192 *info = finfo; 190 *info = finfo;
193 *actualCount = i; 191 *actualCount = i;
194 if (flist) 192 if (flist)
195 flist[i] = NULL; /* required in case XFreeFontNames is called */ 193 flist[i] = NULL; /* required in case XFreeFontNames is called */
@@ -199,39 +197,35 @@ XFontStruct **info) /* RETURN */ @@ -199,39 +197,35 @@ XFontStruct **info) /* RETURN */
199 197
200 198
201 badmem: 199 badmem:
202 /* Free all memory allocated by this function. */ 200 /* Free all memory allocated by this function. */
203 for (j=(i-1); (j >= 0); j--) { 201 for (j=(i-1); (j >= 0); j--) {
204 Xfree(flist[j]); 202 Xfree(flist[j]);
205 if (finfo[j].properties) Xfree((char *) finfo[j].properties); 203 if (finfo[j].properties) Xfree((char *) finfo[j].properties);
206 } 204 }
207 if (flist) Xfree((char *) flist); 205 if (flist) Xfree((char *) flist);
208 if (finfo) Xfree((char *) finfo); 206 if (finfo) Xfree((char *) finfo);
209 207
210 clearwire: 208 clearwire:
211 /* Clear the wire. */ 209 /* Clear the wire. */
212 do { 210 _XEatData(dpy, reply_left << 2);
213 if (reply.nFontProps) 211 while ((reply.nameLength != 0) &&
214 _XEatData(dpy, (unsigned long) 212 _XReply(dpy, (xReply *) &reply,
215 (reply.nFontProps * SIZEOF(xFontProp))); 213 ((SIZEOF(xListFontsWithInfoReply) - SIZEOF(xGenericReply))
216 nbytes = (reply.nameLength + 3) & ~3; 214 >> 2), xTrue));
217 _XEatData(dpy, (unsigned long) nbytes); 
218 } 
219 while (_XReply(dpy,(xReply *) &reply, ((SIZEOF(xListFontsWithInfoReply) - 
220 SIZEOF(xGenericReply)) >> 2), 
221 xFalse) && (reply.nameLength != 0)); 
222 
223 UnlockDisplay(dpy); 215 UnlockDisplay(dpy);
224 SyncHandle(); 216 SyncHandle();
 217 *info = NULL;
 218 *actualCount = 0;
225 return (char **) NULL; 219 return (char **) NULL;
226} 220}
227 221
228int 222int
229XFreeFontInfo ( 223XFreeFontInfo (
230 char **names, 224 char **names,
231 XFontStruct *info, 225 XFontStruct *info,
232 int actualCount) 226 int actualCount)
233{ 227{
234 register int i; 228 register int i;
235 if (names) { 229 if (names) {
236 Xfree (names[0]-1); 230 Xfree (names[0]-1);
237 for (i = 1; i < actualCount; i++) { 231 for (i = 1; i < actualCount; i++) {
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/FontNames.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/FontNames.c 2009/09/17 03:33:05 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/FontNames.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -22,89 +22,98 @@ CONNECTION WITH THE SOFTWARE OR THE USE  @@ -22,89 +22,98 @@ CONNECTION WITH THE SOFTWARE OR THE USE
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27 27
28/* $XFree86: xc/lib/X11/FontNames.c,v 1.6 2001/12/14 19:54:00 dawes Exp $ */ 28/* $XFree86: xc/lib/X11/FontNames.c,v 1.6 2001/12/14 19:54:00 dawes Exp $ */
29 29
30#define NEED_REPLIES 30#define NEED_REPLIES
31#ifdef HAVE_CONFIG_H 31#ifdef HAVE_CONFIG_H
32#include <config.h> 32#include <config.h>
33#endif 33#endif
34#include "Xlibint.h" 34#include "Xlibint.h"
 35#include <limits.h>
35 36
36char ** 37char **
37XListFonts( 38XListFonts(
38register Display *dpy, 39register Display *dpy,
39_Xconst char *pattern, /* null-terminated */ 40_Xconst char *pattern, /* null-terminated */
40int maxNames, 41int maxNames,
41int *actualCount) /* RETURN */ 42int *actualCount) /* RETURN */
42{ 43{
43 register long nbytes; 44 register long nbytes;
44 register unsigned i; 45 register unsigned i;
45 register int length; 46 register int length;
46 char **flist; 47 char **flist = NULL;
47 char *ch; 48 char *ch = NULL;
 49 char *chend;
 50 int count = 0;
48 xListFontsReply rep; 51 xListFontsReply rep;
49 register xListFontsReq *req; 52 register xListFontsReq *req;
50 register long rlen; 53 unsigned long rlen;
51 54
52 LockDisplay(dpy); 55 LockDisplay(dpy);
53 GetReq(ListFonts, req); 56 GetReq(ListFonts, req);
54 req->maxNames = maxNames; 57 req->maxNames = maxNames;
55 nbytes = req->nbytes = pattern ? strlen (pattern) : 0; 58 nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
56 req->length += (nbytes + 3) >> 2; 59 req->length += (nbytes + 3) >> 2;
57 _XSend (dpy, pattern, nbytes); 60 _XSend (dpy, pattern, nbytes);
58 /* use _XSend instead of Data, since following _XReply will flush buffer */ 61 /* use _XSend instead of Data, since following _XReply will flush buffer */
59 62
60 if (!_XReply (dpy, (xReply *)&rep, 0, xFalse)) { 63 if (!_XReply (dpy, (xReply *)&rep, 0, xFalse)) {
61 *actualCount = 0; 64 *actualCount = 0;
62 UnlockDisplay(dpy); 65 UnlockDisplay(dpy);
63 SyncHandle(); 66 SyncHandle();
64 return (char **) NULL; 67 return (char **) NULL;
65 } 68 }
66 69
67 if (rep.nFonts) { 70 if (rep.nFonts) {
68 flist = (char **)Xmalloc ((unsigned)rep.nFonts * sizeof(char *)); 71 flist = Xmalloc (rep.nFonts * sizeof(char *));
69 rlen = rep.length << 2; 72 if (rep.length < (LONG_MAX >> 2)) {
70 ch = (char *) Xmalloc((unsigned) (rlen + 1)); 73 rlen = rep.length << 2;
 74 ch = Xmalloc(rlen + 1);
71 /* +1 to leave room for last null-terminator */ 75 /* +1 to leave room for last null-terminator */
 76 }
72 77
73 if ((! flist) || (! ch)) { 78 if ((! flist) || (! ch)) {
74 if (flist) Xfree((char *) flist); 79 if (flist) Xfree((char *) flist);
75 if (ch) Xfree(ch); 80 if (ch) Xfree(ch);
76 _XEatData(dpy, (unsigned long) rlen); 81 _XEatData(dpy, rep.length << 2);
77 *actualCount = 0; 82 *actualCount = 0;
78 UnlockDisplay(dpy); 83 UnlockDisplay(dpy);
79 SyncHandle(); 84 SyncHandle();
80 return (char **) NULL; 85 return (char **) NULL;
81 } 86 }
82 87
83 _XReadPad (dpy, ch, rlen); 88 _XReadPad (dpy, ch, rlen);
84 /* 89 /*
85 * unpack into null terminated strings. 90 * unpack into null terminated strings.
86 */ 91 */
 92 chend = ch + (rlen + 1);
87 length = *(unsigned char *)ch; 93 length = *(unsigned char *)ch;
88 *ch = 1; /* make sure it is non-zero for XFreeFontNames */ 94 *ch = 1; /* make sure it is non-zero for XFreeFontNames */
89 for (i = 0; i < rep.nFonts; i++) { 95 for (i = 0; i < rep.nFonts; i++) {
90 flist[i] = ch + 1; /* skip over length */ 96 if (ch + length < chend) {
91 ch += length + 1; /* find next length ... */ 97 flist[i] = ch + 1; /* skip over length */
92 length = *(unsigned char *)ch; 98 ch += length + 1; /* find next length ... */
93 *ch = '\0'; /* and replace with null-termination */ 99 length = *(unsigned char *)ch;
 100 *ch = '\0'; /* and replace with null-termination */
 101 count++;
 102 } else
 103 flist[i] = NULL;
94 } 104 }
95 } 105 }
96 else flist = (char **) NULL; 106 *actualCount = count;
97 *actualCount = rep.nFonts; 
98 UnlockDisplay(dpy); 107 UnlockDisplay(dpy);
99 SyncHandle(); 108 SyncHandle();
100 return (flist); 109 return (flist);
101} 110}
102 111
103int 112int
104XFreeFontNames(char **list) 113XFreeFontNames(char **list)
105{ 114{
106 if (list) { 115 if (list) {
107 if (!*(list[0]-1)) { /* from ListFontsWithInfo */ 116 if (!*(list[0]-1)) { /* from ListFontsWithInfo */
108 register char **names; 117 register char **names;
109 for (names = list+1; *names; names++) 118 for (names = list+1; *names; names++)
110 Xfree (*names); 119 Xfree (*names);
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetImage.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/GetImage.c 2009/09/17 03:33:05 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/GetImage.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -23,78 +23,82 @@ Except as contained in this notice, the  @@ -23,78 +23,82 @@ Except as contained in this notice, the
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27/* $XFree86: xc/lib/X11/GetImage.c,v 1.4 2001/12/14 19:54:00 dawes Exp $ */ 27/* $XFree86: xc/lib/X11/GetImage.c,v 1.4 2001/12/14 19:54:00 dawes Exp $ */
28 28
29#define NEED_REPLIES 29#define NEED_REPLIES
30#ifdef HAVE_CONFIG_H 30#ifdef HAVE_CONFIG_H
31#include <config.h> 31#include <config.h>
32#endif 32#endif
33#include "Xlibint.h" 33#include "Xlibint.h"
34#include <X11/Xutil.h> /* for XDestroyImage */ 34#include <X11/Xutil.h> /* for XDestroyImage */
35#include "ImUtil.h" 35#include "ImUtil.h"
 36#include <limits.h>
36 37
37#define ROUNDUP(nbytes, pad) (((((nbytes) - 1) + (pad)) / (pad)) * (pad)) 38#define ROUNDUP(nbytes, pad) (((((nbytes) - 1) + (pad)) / (pad)) * (pad))
38 39
39static unsigned int Ones( /* HACKMEM 169 */ 40static unsigned int Ones( /* HACKMEM 169 */
40 unsigned long mask) 41 unsigned long mask)
41{ 42{
42 register unsigned long y; 43 register unsigned long y;
43 44
44 y = (mask >> 1) &033333333333; 45 y = (mask >> 1) &033333333333;
45 y = mask - y - ((y >>1) & 033333333333); 46 y = mask - y - ((y >>1) & 033333333333);
46 return ((unsigned int) (((y + (y >> 3)) & 030707070707) % 077)); 47 return ((unsigned int) (((y + (y >> 3)) & 030707070707) % 077));
47} 48}
48 49
49XImage *XGetImage ( 50XImage *XGetImage (
50 register Display *dpy, 51 register Display *dpy,
51 Drawable d, 52 Drawable d,
52 int x, 53 int x,
53 int y, 54 int y,
54 unsigned int width, 55 unsigned int width,
55 unsigned int height, 56 unsigned int height,
56 unsigned long plane_mask, 57 unsigned long plane_mask,
57 int format) /* either XYPixmap or ZPixmap */ 58 int format) /* either XYPixmap or ZPixmap */
58{ 59{
59 xGetImageReply rep; 60 xGetImageReply rep;
60 register xGetImageReq *req; 61 register xGetImageReq *req;
61 char *data; 62 char *data;
62 long nbytes; 63 unsigned long nbytes;
63 XImage *image; 64 XImage *image;
64 LockDisplay(dpy); 65 LockDisplay(dpy);
65 GetReq (GetImage, req); 66 GetReq (GetImage, req);
66 /* 67 /*
67 * first set up the standard stuff in the request 68 * first set up the standard stuff in the request
68 */ 69 */
69 req->drawable = d; 70 req->drawable = d;
70 req->x = x; 71 req->x = x;
71 req->y = y; 72 req->y = y;
72 req->width = width; 73 req->width = width;
73 req->height = height; 74 req->height = height;
74 req->planeMask = plane_mask; 75 req->planeMask = plane_mask;
75 req->format = format; 76 req->format = format;
76 77
77 if (_XReply (dpy, (xReply *) &rep, 0, xFalse) == 0 || 78 if (_XReply (dpy, (xReply *) &rep, 0, xFalse) == 0 ||
78 rep.length == 0) { 79 rep.length == 0) {
79 UnlockDisplay(dpy); 80 UnlockDisplay(dpy);
80 SyncHandle(); 81 SyncHandle();
81 return (XImage *)NULL; 82 return (XImage *)NULL;
82 } 83 }
83 84
84 nbytes = (long)rep.length << 2; 85 if (rep.length < (INT_MAX >> 2)) {
85 data = (char *) Xmalloc((unsigned) nbytes); 86 nbytes = (unsigned long)rep.length << 2;
 87 data = Xmalloc(nbytes);
 88 } else
 89 data = NULL;
86 if (! data) { 90 if (! data) {
87 _XEatData(dpy, (unsigned long) nbytes); 91 _XEatData(dpy, rep.length << 2);
88 UnlockDisplay(dpy); 92 UnlockDisplay(dpy);
89 SyncHandle(); 93 SyncHandle();
90 return (XImage *) NULL; 94 return (XImage *) NULL;
91 } 95 }
92 _XReadPad (dpy, data, nbytes); 96 _XReadPad (dpy, data, nbytes);
93 if (format == XYPixmap) 97 if (format == XYPixmap)
94 image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual), 98 image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
95 Ones (plane_mask & 99 Ones (plane_mask &
96 (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))), 100 (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
97 format, 0, data, width, height, dpy->bitmap_pad, 0); 101 format, 0, data, width, height, dpy->bitmap_pad, 0);
98 else /* format == ZPixmap */ 102 else /* format == ZPixmap */
99 image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual), 103 image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
100 rep.depth, ZPixmap, 0, data, width, height, 104 rep.depth, ZPixmap, 0, data, width, height,
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetMoEv.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/GetMoEv.c 2009/09/17 03:33:05 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/GetMoEv.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -20,68 +20,64 @@ AN ACTION OF CONTRACT, TORT OR OTHERWISE @@ -20,68 +20,64 @@ AN ACTION OF CONTRACT, TORT OR OTHERWISE
20CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 20CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
21 21
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27 27
28#define NEED_REPLIES 28#define NEED_REPLIES
29#ifdef HAVE_CONFIG_H 29#ifdef HAVE_CONFIG_H
30#include <config.h> 30#include <config.h>
31#endif 31#endif
32#include "Xlibint.h" 32#include "Xlibint.h"
 33#include <limits.h>
33 34
34XTimeCoord *XGetMotionEvents( 35XTimeCoord *XGetMotionEvents(
35 register Display *dpy, 36 register Display *dpy,
36 Window w, 37 Window w,
37 Time start, 38 Time start,
38 Time stop, 39 Time stop,
39 int *nEvents) /* RETURN */ 40 int *nEvents) /* RETURN */
40{ 41{
41 xGetMotionEventsReply rep; 42 xGetMotionEventsReply rep;
42 register xGetMotionEventsReq *req; 43 register xGetMotionEventsReq *req;
43 XTimeCoord *tc = NULL; 44 XTimeCoord *tc = NULL;
44 long nbytes; 
45 LockDisplay(dpy); 45 LockDisplay(dpy);
46 GetReq(GetMotionEvents, req); 46 GetReq(GetMotionEvents, req);
47 req->window = w; 47 req->window = w;
48/* XXX is this right for all machines? */ 48/* XXX is this right for all machines? */
49 req->start = start; 49 req->start = start;
50 req->stop = stop; 50 req->stop = stop;
51 if (!_XReply (dpy, (xReply *)&rep, 0, xFalse)) { 51 if (!_XReply (dpy, (xReply *)&rep, 0, xFalse)) {
52 UnlockDisplay(dpy); 52 UnlockDisplay(dpy);
53 SyncHandle(); 53 SyncHandle();
54 return (NULL); 54 return (NULL);
55 } 55 }
56 56
57 if (rep.nEvents) { 57 if (rep.nEvents && (rep.nEvents < (INT_MAX / sizeof(XTimeCoord))))
58 if (! (tc = (XTimeCoord *) 58 tc = Xmalloc(rep.nEvents * sizeof(XTimeCoord));
59 Xmalloc( (unsigned) 59 if (tc == NULL) {
60 (nbytes = (long) rep.nEvents * sizeof(XTimeCoord))))) { 60 /* server returned either no events or a bad event count */
61 _XEatData (dpy, (unsigned long) nbytes); 61 *nEvents = 0;
62 UnlockDisplay(dpy); 62 _XEatData (dpy, rep.length << 2);
63 SyncHandle(); 
64 return (NULL); 
65 } 
66 } 63 }
67 64 else
68 *nEvents = rep.nEvents; 
69 nbytes = SIZEOF (xTimecoord); 
70 { 65 {
71 register XTimeCoord *tcptr; 66 register XTimeCoord *tcptr;
72 register int i; 67 unsigned int i;
73 xTimecoord xtc; 68 xTimecoord xtc;
74 69
 70 *nEvents = (int) rep.nEvents;
75 for (i = rep.nEvents, tcptr = tc; i > 0; i--, tcptr++) { 71 for (i = rep.nEvents, tcptr = tc; i > 0; i--, tcptr++) {
76 _XRead (dpy, (char *) &xtc, nbytes); 72 _XRead (dpy, (char *) &xtc, SIZEOF (xTimecoord));
77 tcptr->time = xtc.time; 73 tcptr->time = xtc.time;
78 tcptr->x = cvtINT16toShort (xtc.x); 74 tcptr->x = cvtINT16toShort (xtc.x);
79 tcptr->y = cvtINT16toShort (xtc.y); 75 tcptr->y = cvtINT16toShort (xtc.y);
80 } 76 }
81 } 77 }
82 78
83 UnlockDisplay(dpy); 79 UnlockDisplay(dpy);
84 SyncHandle(); 80 SyncHandle();
85 return (tc); 81 return (tc);
86} 82}
87 83
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetPntMap.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/GetPntMap.c 2009/09/17 03:33:05 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/GetPntMap.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -22,105 +22,114 @@ CONNECTION WITH THE SOFTWARE OR THE USE  @@ -22,105 +22,114 @@ CONNECTION WITH THE SOFTWARE OR THE USE
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27 27
28/* $XFree86: xc/lib/X11/GetPntMap.c,v 1.6 2001/12/14 19:54:01 dawes Exp $ */ 28/* $XFree86: xc/lib/X11/GetPntMap.c,v 1.6 2001/12/14 19:54:01 dawes Exp $ */
29 29
30#define NEED_REPLIES 30#define NEED_REPLIES
31#ifdef HAVE_CONFIG_H 31#ifdef HAVE_CONFIG_H
32#include <config.h> 32#include <config.h>
33#endif 33#endif
34#include "Xlibint.h" 34#include "Xlibint.h"
 35#include <limits.h>
35 36
36#ifdef MIN /* some systems define this in <sys/param.h> */ 37#ifdef MIN /* some systems define this in <sys/param.h> */
37#undef MIN 38#undef MIN
38#endif 39#endif
39#define MIN(a, b) ((a) < (b) ? (a) : (b)) 40#define MIN(a, b) ((a) < (b) ? (a) : (b))
40 41
41int XGetPointerMapping ( 42int XGetPointerMapping (
42 register Display *dpy, 43 register Display *dpy,
43 unsigned char *map, /* RETURN */ 44 unsigned char *map, /* RETURN */
44 int nmaps) 45 int nmaps)
45 46
46{ 47{
47 unsigned char mapping[256]; /* known fixed size */ 48 unsigned char mapping[256]; /* known fixed size */
48 long nbytes, remainder = 0; 49 unsigned long nbytes, remainder = 0;
49 xGetPointerMappingReply rep; 50 xGetPointerMappingReply rep;
50 register xReq *req; 51 register xReq *req;
51 52
52 LockDisplay(dpy); 53 LockDisplay(dpy);
53 GetEmptyReq(GetPointerMapping, req); 54 GetEmptyReq(GetPointerMapping, req);
54 if (! _XReply(dpy, (xReply *)&rep, 0, xFalse)) { 55 if (! _XReply(dpy, (xReply *)&rep, 0, xFalse)) {
55 UnlockDisplay(dpy); 56 UnlockDisplay(dpy);
56 SyncHandle(); 57 SyncHandle();
57 return 0; 58 return 0;
58 } 59 }
59 60
60 nbytes = (long)rep.length << 2; 
61 
62 /* Don't count on the server returning a valid value */ 61 /* Don't count on the server returning a valid value */
 62 if (rep.length >= (INT_MAX >> 2)) {
 63 _XEatData(dpy, rep.length << 2);
 64 UnlockDisplay(dpy);
 65 SyncHandle();
 66 return 0;
 67 }
 68
 69 nbytes = (unsigned long) rep.length << 2;
63 if (nbytes > sizeof mapping) { 70 if (nbytes > sizeof mapping) {
64 remainder = nbytes - sizeof mapping; 71 remainder = nbytes - sizeof mapping;
65 nbytes = sizeof mapping; 72 nbytes = sizeof mapping;
66 } 73 }
67 _XRead (dpy, (char *)mapping, nbytes); 74 _XRead (dpy, (char *)mapping, nbytes);
68 /* don't return more data than the user asked for. */ 75 /* don't return more data than the user asked for. */
69 if (rep.nElts) { 76 if (rep.nElts) {
70 memcpy ((char *) map, (char *) mapping, 77 memcpy ((char *) map, (char *) mapping,
71 MIN((int)rep.nElts, nmaps) ); 78 MIN((int)rep.nElts, nmaps) );
72 } 79 }
73 80
74 if (remainder) 81 if (remainder)
75 _XEatData(dpy, (unsigned long)remainder); 82 _XEatData(dpy, remainder);
76 83
77 UnlockDisplay(dpy); 84 UnlockDisplay(dpy);
78 SyncHandle(); 85 SyncHandle();
79 return ((int) rep.nElts); 86 return ((int) rep.nElts);
80} 87}
81 88
82KeySym * 89KeySym *
83XGetKeyboardMapping (Display *dpy, 90XGetKeyboardMapping (Display *dpy,
84#if NeedWidePrototypes 91#if NeedWidePrototypes
85 unsigned int first_keycode, 92 unsigned int first_keycode,
86#else 93#else
87 KeyCode first_keycode, 94 KeyCode first_keycode,
88#endif 95#endif
89 int count, 96 int count,
90 int *keysyms_per_keycode) 97 int *keysyms_per_keycode)
91{ 98{
92 long nbytes; 99 unsigned long nbytes;
93 unsigned long nkeysyms; 100 CARD32 nkeysyms;
94 register KeySym *mapping = NULL; 101 register KeySym *mapping = NULL;
95 xGetKeyboardMappingReply rep; 102 xGetKeyboardMappingReply rep;
96 register xGetKeyboardMappingReq *req; 103 register xGetKeyboardMappingReq *req;
97 104
98 LockDisplay(dpy); 105 LockDisplay(dpy);
99 GetReq(GetKeyboardMapping, req); 106 GetReq(GetKeyboardMapping, req);
100 req->firstKeyCode = first_keycode; 107 req->firstKeyCode = first_keycode;
101 req->count = count; 108 req->count = count;
102 if (! _XReply(dpy, (xReply *)&rep, 0, xFalse)) { 109 if (! _XReply(dpy, (xReply *)&rep, 0, xFalse)) {
103 UnlockDisplay(dpy); 110 UnlockDisplay(dpy);
104 SyncHandle(); 111 SyncHandle();
105 return (KeySym *) NULL; 112 return (KeySym *) NULL;
106 } 113 }
107 114
108 nkeysyms = (unsigned long) rep.length; 115 nkeysyms = rep.length;
109 if (nkeysyms > 0) { 116 if (nkeysyms > 0) {
110 nbytes = nkeysyms * sizeof (KeySym); 117 if (nkeysyms < (INT_MAX / sizeof (KeySym))) {
111 mapping = (KeySym *) Xmalloc ((unsigned) nbytes); 118 nbytes = nkeysyms * sizeof (KeySym);
112 nbytes = nkeysyms << 2; 119 mapping = Xmalloc (nbytes);
 120 }
113 if (! mapping) { 121 if (! mapping) {
114 _XEatData(dpy, (unsigned long) nbytes); 122 _XEatData(dpy, rep.length << 2);
115 UnlockDisplay(dpy); 123 UnlockDisplay(dpy);
116 SyncHandle(); 124 SyncHandle();
117 return (KeySym *) NULL; 125 return (KeySym *) NULL;
118 } 126 }
 127 nbytes = nkeysyms << 2;
119 _XRead32 (dpy, (long *) mapping, nbytes); 128 _XRead32 (dpy, (long *) mapping, nbytes);
120 } 129 }
121 *keysyms_per_keycode = rep.keySymsPerKeyCode; 130 *keysyms_per_keycode = rep.keySymsPerKeyCode;
122 UnlockDisplay(dpy); 131 UnlockDisplay(dpy);
123 SyncHandle(); 132 SyncHandle();
124 return (mapping); 133 return (mapping);
125} 134}
126 135
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/GetProp.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/GetProp.c 2009/09/17 03:33:05 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/GetProp.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -21,26 +21,27 @@ CONNECTION WITH THE SOFTWARE OR THE USE  @@ -21,26 +21,27 @@ CONNECTION WITH THE SOFTWARE OR THE USE
21 21
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27/* $XFree86: xc/lib/X11/GetProp.c,v 1.5 2001/10/28 03:32:30 tsi Exp $ */ 27/* $XFree86: xc/lib/X11/GetProp.c,v 1.5 2001/10/28 03:32:30 tsi Exp $ */
28 28
29#define NEED_REPLIES 29#define NEED_REPLIES
30#ifdef HAVE_CONFIG_H 30#ifdef HAVE_CONFIG_H
31#include <config.h> 31#include <config.h>
32#endif 32#endif
33#include "Xlibint.h" 33#include "Xlibint.h"
 34#include <limits.h>
34 35
35int 36int
36XGetWindowProperty( 37XGetWindowProperty(
37 register Display *dpy, 38 register Display *dpy,
38 Window w, 39 Window w,
39 Atom property, 40 Atom property,
40 long offset, 41 long offset,
41 long length, 42 long length,
42 Bool delete, 43 Bool delete,
43 Atom req_type, 44 Atom req_type,
44 Atom *actual_type, /* RETURN */ 45 Atom *actual_type, /* RETURN */
45 int *actual_format, /* RETURN 8, 16, or 32 */ 46 int *actual_format, /* RETURN 8, 16, or 32 */
46 unsigned long *nitems, /* RETURN # of 8-, 16-, or 32-bit entities */ 47 unsigned long *nitems, /* RETURN # of 8-, 16-, or 32-bit entities */
@@ -59,76 +60,82 @@ XGetWindowProperty( @@ -59,76 +60,82 @@ XGetWindowProperty(
59 req->delete = delete; 60 req->delete = delete;
60 req->longOffset = offset; 61 req->longOffset = offset;
61 req->longLength = length; 62 req->longLength = length;
62 error.sequenceNumber = dpy->request; 63 error.sequenceNumber = dpy->request;
63 64
64 if (!_XReply (dpy, (xReply *) &reply, 0, xFalse)) { 65 if (!_XReply (dpy, (xReply *) &reply, 0, xFalse)) {
65 UnlockDisplay(dpy); 66 UnlockDisplay(dpy);
66 SyncHandle(); 67 SyncHandle();
67 return (1); /* not Success */ 68 return (1); /* not Success */
68 } 69 }
69 70
70 *prop = (unsigned char *) NULL; 71 *prop = (unsigned char *) NULL;
71 if (reply.propertyType != None) { 72 if (reply.propertyType != None) {
72 long nbytes, netbytes; 73 unsigned long nbytes, netbytes;
73 switch (reply.format) { 74 int format = reply.format;
 75
 76 /*
 77 * Protect against both integer overflow and just plain oversized
 78 * memory allocation - no server should ever return this many props.
 79 */
 80 if (reply.nItems >= (INT_MAX >> 4))
 81 format = -1; /* fall through to default error case */
 82
 83 switch (format) {
74 /* 84 /*
75 * One extra byte is malloced than is needed to contain the property 85 * One extra byte is malloced than is needed to contain the property
76 * data, but this last byte is null terminated and convenient for 86 * data, but this last byte is null terminated and convenient for
77 * returning string properties, so the client doesn't then have to 87 * returning string properties, so the client doesn't then have to
78 * recopy the string to make it null terminated. 88 * recopy the string to make it null terminated.
79 */ 89 */
80 case 8: 90 case 8:
81 nbytes = netbytes = reply.nItems; 91 nbytes = netbytes = reply.nItems;
82 if (nbytes + 1 > 0 && 92 if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
83 (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1))) 
84 _XReadPad (dpy, (char *) *prop, netbytes); 93 _XReadPad (dpy, (char *) *prop, netbytes);
85 break; 94 break;
86 95
87 case 16: 96 case 16:
88 nbytes = reply.nItems * sizeof (short); 97 nbytes = reply.nItems * sizeof (short);
89 netbytes = reply.nItems << 1; 98 netbytes = reply.nItems << 1;
90 if (nbytes + 1 > 0 && 99 if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
91 (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1))) 
92 _XRead16Pad (dpy, (short *) *prop, netbytes); 100 _XRead16Pad (dpy, (short *) *prop, netbytes);
93 break; 101 break;
94 102
95 case 32: 103 case 32:
96 nbytes = reply.nItems * sizeof (long); 104 nbytes = reply.nItems * sizeof (long);
97 netbytes = reply.nItems << 2; 105 netbytes = reply.nItems << 2;
98 if (nbytes + 1 > 0 && 106 if (nbytes + 1 > 0 && (*prop = Xmalloc (nbytes + 1)))
99 (*prop = (unsigned char *) Xmalloc ((unsigned)nbytes + 1))) 
100 _XRead32 (dpy, (long *) *prop, netbytes); 107 _XRead32 (dpy, (long *) *prop, netbytes);
101 break; 108 break;
102 109
103 default: 110 default:
104 /* 111 /*
105 * This part of the code should never be reached. If it is, 112 * This part of the code should never be reached. If it is,
106 * the server sent back a property with an invalid format. 113 * the server sent back a property with an invalid format.
107 * This is a BadImplementation error. 114 * This is a BadImplementation error.
108 */ 115 */
109 { 116 {
110 /* sequence number stored above */ 117 /* sequence number stored above */
111 error.type = X_Error; 118 error.type = X_Error;
112 error.majorCode = X_GetProperty; 119 error.majorCode = X_GetProperty;
113 error.minorCode = 0; 120 error.minorCode = 0;
114 error.errorCode = BadImplementation; 121 error.errorCode = BadImplementation;
115 _XError(dpy, &error); 122 _XError(dpy, &error);
116 } 123 }
117 nbytes = netbytes = 0L; 124 nbytes = netbytes = 0L;
118 break; 125 break;
119 } 126 }
120 if (! *prop) { 127 if (! *prop) {
121 _XEatData(dpy, (unsigned long) netbytes); 128 _XEatData(dpy, reply.length << 2);
122 UnlockDisplay(dpy); 129 UnlockDisplay(dpy);
123 SyncHandle(); 130 SyncHandle();
124 return(BadAlloc); /* not Success */ 131 return(BadAlloc); /* not Success */
125 } 132 }
126 (*prop)[nbytes] = '\0'; 133 (*prop)[nbytes] = '\0';
127 } 134 }
128 *actual_type = reply.propertyType; 135 *actual_type = reply.propertyType;
129 *actual_format = reply.format; 136 *actual_format = reply.format;
130 *nitems = reply.nItems; 137 *nitems = reply.nItems;
131 *bytesafter = reply.bytesAfter; 138 *bytesafter = reply.bytesAfter;
132 UnlockDisplay(dpy); 139 UnlockDisplay(dpy);
133 SyncHandle(); 140 SyncHandle();
134 return(Success); 141 return(Success);
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/LiHosts.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/LiHosts.c 2009/09/17 03:33:06 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/LiHosts.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -33,67 +33,75 @@ or other dealings in this Software witho @@ -33,67 +33,75 @@ or other dealings in this Software witho
33of the copyright holder. 33of the copyright holder.
34 34
35X Window System is a trademark of The Open Group. 35X Window System is a trademark of The Open Group.
36 36
37*/ 37*/
38 38
39/* This can really be considered an os dependent routine */ 39/* This can really be considered an os dependent routine */
40 40
41#define NEED_REPLIES 41#define NEED_REPLIES
42#ifdef HAVE_CONFIG_H 42#ifdef HAVE_CONFIG_H
43#include <config.h> 43#include <config.h>
44#endif 44#endif
45#include "Xlibint.h" 45#include "Xlibint.h"
 46#include <limits.h>
 47
46/* 48/*
47 * can be freed using XFree. 49 * can be freed using XFree.
48 */ 50 */
49 51
50XHostAddress *XListHosts ( 52XHostAddress *XListHosts (
51 register Display *dpy, 53 register Display *dpy,
52 int *nhosts, /* RETURN */ 54 int *nhosts, /* RETURN */
53 Bool *enabled) /* RETURN */ 55 Bool *enabled) /* RETURN */
54{ 56{
55 register XHostAddress *outbuf = NULL, *op; 57 register XHostAddress *outbuf = NULL, *op;
56 xListHostsReply reply; 58 xListHostsReply reply;
57 long nbytes; 
58 unsigned char *buf, *bp; 59 unsigned char *buf, *bp;
59 register unsigned i; 60 register unsigned i;
60 register xListHostsReq *req; 61 register xListHostsReq *req;
61 XServerInterpretedAddress *sip; 62 XServerInterpretedAddress *sip;
62 63
63 *nhosts = 0; 64 *nhosts = 0;
64 LockDisplay(dpy); 65 LockDisplay(dpy);
65 GetReq (ListHosts, req); 66 GetReq (ListHosts, req);
66 67
67 if (!_XReply (dpy, (xReply *) &reply, 0, xFalse)) { 68 if (!_XReply (dpy, (xReply *) &reply, 0, xFalse)) {
68 UnlockDisplay(dpy); 69 UnlockDisplay(dpy);
69 SyncHandle(); 70 SyncHandle();
70 return (XHostAddress *) NULL; 71 return (XHostAddress *) NULL;
71 } 72 }
72 73
73 if (reply.nHosts) { 74 if (reply.nHosts) {
74 nbytes = reply.length << 2; /* compute number of bytes in reply */ 75 unsigned long nbytes = reply.length << 2; /* number of bytes in reply */
75 76 const unsigned long max_hosts = INT_MAX /
76 op = outbuf = (XHostAddress *) 77 (sizeof(XHostAddress) + sizeof(XServerInterpretedAddress));
77 Xmalloc((unsigned) (nbytes + 78
78 (reply.nHosts * sizeof(XHostAddress)) + 79 if (reply.nHosts < max_hosts) {
79 (reply.nHosts * sizeof(XServerInterpretedAddress)))); 80 unsigned long hostbytes = reply.nHosts *
 81 (sizeof(XHostAddress) + sizeof(XServerInterpretedAddress));
 82
 83 if (reply.length < (INT_MAX >> 2) &&
 84 (hostbytes >> 2) < ((INT_MAX >> 2) - reply.length))
 85 outbuf = Xmalloc(nbytes + hostbytes);
 86 }
80 87
81 if (! outbuf) { 88 if (! outbuf) {
82 _XEatData(dpy, (unsigned long) nbytes); 89 _XEatData(dpy, reply.length << 2);
83 UnlockDisplay(dpy); 90 UnlockDisplay(dpy);
84 SyncHandle(); 91 SyncHandle();
85 return (XHostAddress *) NULL; 92 return (XHostAddress *) NULL;
86 } 93 }
 94 op = outbuf;
87 sip = (XServerInterpretedAddress *) 95 sip = (XServerInterpretedAddress *)
88 (((unsigned char *) outbuf) + (reply.nHosts * sizeof(XHostAddress))); 96 (((unsigned char *) outbuf) + (reply.nHosts * sizeof(XHostAddress)));
89 bp = buf = ((unsigned char *) sip) 97 bp = buf = ((unsigned char *) sip)
90 + (reply.nHosts * sizeof(XServerInterpretedAddress)); 98 + (reply.nHosts * sizeof(XServerInterpretedAddress));
91 99
92 _XRead (dpy, (char *) buf, nbytes); 100 _XRead (dpy, (char *) buf, nbytes);
93 101
94 for (i = 0; i < reply.nHosts; i++) { 102 for (i = 0; i < reply.nHosts; i++) {
95#ifdef WORD64 103#ifdef WORD64
96 xHostEntry xhe; 104 xHostEntry xhe;
97 memcpy((char *)&xhe, bp, SIZEOF(xHostEntry)); 105 memcpy((char *)&xhe, bp, SIZEOF(xHostEntry));
98 op->family = xhe.family; 106 op->family = xhe.family;
99 op->length = xhe.length; 107 op->length = xhe.length;
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/ModMap.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/ModMap.c 2009/09/17 03:33:06 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/ModMap.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -21,46 +21,51 @@ CONNECTION WITH THE SOFTWARE OR THE USE  @@ -21,46 +21,51 @@ CONNECTION WITH THE SOFTWARE OR THE USE
21 21
22Except as contained in this notice, the name of The Open Group shall not be 22Except as contained in this notice, the name of The Open Group shall not be
23used in advertising or otherwise to promote the sale, use or other dealings 23used in advertising or otherwise to promote the sale, use or other dealings
24in this Software without prior written authorization from The Open Group. 24in this Software without prior written authorization from The Open Group.
25 25
26*/ 26*/
27/* $XFree86: xc/lib/X11/ModMap.c,v 1.4 2001/12/14 19:54:03 dawes Exp $ */ 27/* $XFree86: xc/lib/X11/ModMap.c,v 1.4 2001/12/14 19:54:03 dawes Exp $ */
28 28
29#define NEED_REPLIES 29#define NEED_REPLIES
30#ifdef HAVE_CONFIG_H 30#ifdef HAVE_CONFIG_H
31#include <config.h> 31#include <config.h>
32#endif 32#endif
33#include "Xlibint.h" 33#include "Xlibint.h"
 34#include <limits.h>
34 35
35XModifierKeymap * 36XModifierKeymap *
36XGetModifierMapping(register Display *dpy) 37XGetModifierMapping(register Display *dpy)
37{ 38{
38 xGetModifierMappingReply rep; 39 xGetModifierMappingReply rep;
39 register xReq *req; 40 register xReq *req;
40 unsigned long nbytes; 41 unsigned long nbytes;
41 XModifierKeymap *res; 42 XModifierKeymap *res;
42 43
43 LockDisplay(dpy); 44 LockDisplay(dpy);
44 GetEmptyReq(GetModifierMapping, req); 45 GetEmptyReq(GetModifierMapping, req);
45 (void) _XReply (dpy, (xReply *)&rep, 0, xFalse); 46 (void) _XReply (dpy, (xReply *)&rep, 0, xFalse);
46 47
47 nbytes = (unsigned long)rep.length << 2; 48 if (rep.length < (LONG_MAX >> 2)) {
48 res = (XModifierKeymap *) Xmalloc(sizeof (XModifierKeymap)); 49 nbytes = (unsigned long)rep.length << 2;
49 if (res) res->modifiermap = (KeyCode *) Xmalloc ((unsigned) nbytes); 50 res = Xmalloc(sizeof (XModifierKeymap));
 51 if (res)
 52 res->modifiermap = Xmalloc (nbytes);
 53 } else
 54 res = NULL;
50 if ((! res) || (! res->modifiermap)) { 55 if ((! res) || (! res->modifiermap)) {
51 if (res) Xfree((char *) res); 56 if (res) Xfree((char *) res);
52 res = (XModifierKeymap *) NULL; 57 res = (XModifierKeymap *) NULL;
53 _XEatData(dpy, nbytes); 58 _XEatData(dpy, rep.length << 2);
54 } else { 59 } else {
55 _XReadPad(dpy, (char *) res->modifiermap, (long) nbytes); 60 _XReadPad(dpy, (char *) res->modifiermap, (long) nbytes);
56 res->max_keypermod = rep.numKeyPerModifier; 61 res->max_keypermod = rep.numKeyPerModifier;
57 } 62 }
58 63
59 UnlockDisplay(dpy); 64 UnlockDisplay(dpy);
60 SyncHandle(); 65 SyncHandle();
61 return (res); 66 return (res);
62} 67}
63 68
64/* 69/*
65 * Returns: 70 * Returns:
66 * 0 Success 71 * 0 Success
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/Xrm.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/Xrm.c 2009/09/17 03:33:07 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/Xrm.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -1079,33 +1079,35 @@ XrmQPutStringResource( @@ -1079,33 +1079,35 @@ XrmQPutStringResource(
1079#define QLIST_SIZE 100 1079#define QLIST_SIZE 100
1080 1080
1081/* 1081/*
1082 * This should be big enough to handle things like the XKeysymDB or biggish 1082 * This should be big enough to handle things like the XKeysymDB or biggish
1083 * ~/.Xdefaults or app-defaults files. Anything bigger will be allocated on 1083 * ~/.Xdefaults or app-defaults files. Anything bigger will be allocated on
1084 * the heap. 1084 * the heap.
1085 */ 1085 */
1086#define DEF_BUFF_SIZE 8192 1086#define DEF_BUFF_SIZE 8192
1087 1087
1088static void GetIncludeFile( 1088static void GetIncludeFile(
1089 XrmDatabase db, 1089 XrmDatabase db,
1090 _Xconst char *base, 1090 _Xconst char *base,
1091 _Xconst char *fname, 1091 _Xconst char *fname,
1092 int fnamelen); 1092 int fnamelen,
 1093 int depth);
1093 1094
1094static void GetDatabase( 1095static void GetDatabase(
1095 XrmDatabase db, 1096 XrmDatabase db,
1096 _Xconst register char *str, 1097 _Xconst register char *str,
1097 _Xconst char *filename, 1098 _Xconst char *filename,
1098 Bool doall) 1099 Bool doall,
 1100 int depth)
1099{ 1101{
1100 char *rhs; 1102 char *rhs;
1101 char *lhs, lhs_s[DEF_BUFF_SIZE]; 1103 char *lhs, lhs_s[DEF_BUFF_SIZE];
1102 XrmQuark quarks[QLIST_SIZE + 1]; /* allow for a terminal NullQuark */ 1104 XrmQuark quarks[QLIST_SIZE + 1]; /* allow for a terminal NullQuark */
1103 XrmBinding bindings[QLIST_SIZE + 1]; 1105 XrmBinding bindings[QLIST_SIZE + 1];
1104 1106
1105 register char *ptr; 1107 register char *ptr;
1106 register XrmBits bits = 0; 1108 register XrmBits bits = 0;
1107 register char c; 1109 register char c;
1108 register Signature sig; 1110 register Signature sig;
1109 register char *ptr_max; 1111 register char *ptr_max;
1110 register int num_quarks; 1112 register int num_quarks;
1111 register XrmBindingList t_bindings; 1113 register XrmBindingList t_bindings;
@@ -1195,27 +1197,28 @@ static void GetDatabase( @@ -1195,27 +1197,28 @@ static void GetDatabase(
1195 _Xconst char *fname = str+1; 1197 _Xconst char *fname = str+1;
1196 len = 0; 1198 len = 0;
1197 do { 1199 do {
1198 if (only_pcs) { 1200 if (only_pcs) {
1199 bits = next_char(c, str); 1201 bits = next_char(c, str);
1200 if (is_nonpcs(bits)) 1202 if (is_nonpcs(bits))
1201 only_pcs = False; 1203 only_pcs = False;
1202 } 1204 }
1203 if (!only_pcs) 1205 if (!only_pcs)
1204 bits = next_mbchar(c, len, str); 1206 bits = next_mbchar(c, len, str);
1205 } while (c != '"' && !is_EOL(bits)); 1207 } while (c != '"' && !is_EOL(bits));
1206 /* must have an ending " */ 1208 /* must have an ending " */
1207 if (c == '"') 1209 if (c == '"')
1208 GetIncludeFile(db, filename, fname, str - len - fname); 1210 GetIncludeFile(db, filename, fname, str - len - fname,
 1211 depth);
1209 } 1212 }
1210 } 1213 }
1211 /* spin to next newline */ 1214 /* spin to next newline */
1212 if (only_pcs) { 1215 if (only_pcs) {
1213 while (is_simple(bits)) 1216 while (is_simple(bits))
1214 bits = next_char(c, str); 1217 bits = next_char(c, str);
1215 if (is_EOL(bits)) 1218 if (is_EOL(bits))
1216 continue; 1219 continue;
1217 } 1220 }
1218 while (!is_EOL(bits)) 1221 while (!is_EOL(bits))
1219 bits = next_mbchar(c, len, str); 1222 bits = next_mbchar(c, len, str);
1220 str--; 1223 str--;
1221 continue; /* start a new line. */ 1224 continue; /* start a new line. */
@@ -1536,39 +1539,39 @@ XrmPutStringResource( @@ -1536,39 +1539,39 @@ XrmPutStringResource(
1536 _XLockMutex(&(*pdb)->linfo); 1539 _XLockMutex(&(*pdb)->linfo);
1537 PutEntry(*pdb, bindings, quarks, XrmQString, &value); 1540 PutEntry(*pdb, bindings, quarks, XrmQString, &value);
1538 _XUnlockMutex(&(*pdb)->linfo); 1541 _XUnlockMutex(&(*pdb)->linfo);
1539} 1542}
1540 1543
1541 1544
1542void 1545void
1543XrmPutLineResource( 1546XrmPutLineResource(
1544 XrmDatabase *pdb, 1547 XrmDatabase *pdb,
1545 _Xconst char*line) 1548 _Xconst char*line)
1546{ 1549{
1547 if (!*pdb) *pdb = NewDatabase(); 1550 if (!*pdb) *pdb = NewDatabase();
1548 _XLockMutex(&(*pdb)->linfo); 1551 _XLockMutex(&(*pdb)->linfo);
1549 GetDatabase(*pdb, line, (char *)NULL, False); 1552 GetDatabase(*pdb, line, (char *)NULL, False, 0);
1550 _XUnlockMutex(&(*pdb)->linfo); 1553 _XUnlockMutex(&(*pdb)->linfo);
1551} 1554}
1552 1555
1553XrmDatabase 1556XrmDatabase
1554XrmGetStringDatabase( 1557XrmGetStringDatabase(
1555 _Xconst char *data) 1558 _Xconst char *data)
1556{ 1559{
1557 XrmDatabase db; 1560 XrmDatabase db;
1558 1561
1559 db = NewDatabase(); 1562 db = NewDatabase();
1560 _XLockMutex(&db->linfo); 1563 _XLockMutex(&db->linfo);
1561 GetDatabase(db, data, (char *)NULL, True); 1564 GetDatabase(db, data, (char *)NULL, True, 0);
1562 _XUnlockMutex(&db->linfo); 1565 _XUnlockMutex(&db->linfo);
1563 return db; 1566 return db;
1564} 1567}
1565 1568
1566/* Function Name: ReadInFile 1569/* Function Name: ReadInFile
1567 * Description: Reads the file into a buffer. 1570 * Description: Reads the file into a buffer.
1568 * Arguments: filename - the name of the file. 1571 * Arguments: filename - the name of the file.
1569 * Returns: An allocated string containing the contents of the file. 1572 * Returns: An allocated string containing the contents of the file.
1570 */ 1573 */
1571 1574
1572static char * 1575static char *
1573ReadInFile(_Xconst char *filename) 1576ReadInFile(_Xconst char *filename)
1574{ 1577{
@@ -1619,88 +1622,91 @@ ReadInFile(_Xconst char *filename) @@ -1619,88 +1622,91 @@ ReadInFile(_Xconst char *filename)
1619 return (char *)NULL; 1622 return (char *)NULL;
1620 } 1623 }
1621 close (fd); 1624 close (fd);
1622 1625
1623 filebuf[size] = '\0'; /* NULL terminate it. */ 1626 filebuf[size] = '\0'; /* NULL terminate it. */
1624 return filebuf; 1627 return filebuf;
1625} 1628}
1626 1629
1627static void 1630static void
1628GetIncludeFile( 1631GetIncludeFile(
1629 XrmDatabase db, 1632 XrmDatabase db,
1630 _Xconst char *base, 1633 _Xconst char *base,
1631 _Xconst char *fname, 1634 _Xconst char *fname,
1632 int fnamelen) 1635 int fnamelen,
 1636 int depth)
1633{ 1637{
1634 int len; 1638 int len;
1635 char *str; 1639 char *str;
1636 char realfname[BUFSIZ]; 1640 char realfname[BUFSIZ];
1637 1641
1638 if (fnamelen <= 0 || fnamelen >= BUFSIZ) 1642 if (fnamelen <= 0 || fnamelen >= BUFSIZ)
1639 return; 1643 return;
 1644 if (depth >= MAXDBDEPTH)
 1645 return;
1640 if (*fname != '/' && base && (str = strrchr(base, '/'))) { 1646 if (*fname != '/' && base && (str = strrchr(base, '/'))) {
1641 len = str - base + 1; 1647 len = str - base + 1;
1642 if (len + fnamelen >= BUFSIZ) 1648 if (len + fnamelen >= BUFSIZ)
1643 return; 1649 return;
1644 strncpy(realfname, base, len); 1650 strncpy(realfname, base, len);
1645 strncpy(realfname + len, fname, fnamelen); 1651 strncpy(realfname + len, fname, fnamelen);
1646 realfname[len + fnamelen] = '\0'; 1652 realfname[len + fnamelen] = '\0';
1647 } else { 1653 } else {
1648 strncpy(realfname, fname, fnamelen); 1654 strncpy(realfname, fname, fnamelen);
1649 realfname[fnamelen] = '\0'; 1655 realfname[fnamelen] = '\0';
1650 } 1656 }
1651 if (!(str = ReadInFile(realfname))) 1657 if (!(str = ReadInFile(realfname)))
1652 return; 1658 return;
1653 GetDatabase(db, str, realfname, True); 1659 GetDatabase(db, str, realfname, True, depth + 1);
1654 Xfree(str); 1660 Xfree(str);
1655} 1661}
1656 1662
1657XrmDatabase 1663XrmDatabase
1658XrmGetFileDatabase( 1664XrmGetFileDatabase(
1659 _Xconst char *filename) 1665 _Xconst char *filename)
1660{ 1666{
1661 XrmDatabase db; 1667 XrmDatabase db;
1662 char *str; 1668 char *str;
1663 1669
1664 if (!(str = ReadInFile(filename))) 1670 if (!(str = ReadInFile(filename)))
1665 return (XrmDatabase)NULL; 1671 return (XrmDatabase)NULL;
1666 1672
1667 db = NewDatabase(); 1673 db = NewDatabase();
1668 _XLockMutex(&db->linfo); 1674 _XLockMutex(&db->linfo);
1669 GetDatabase(db, str, filename, True); 1675 GetDatabase(db, str, filename, True, 0);
1670 _XUnlockMutex(&db->linfo); 1676 _XUnlockMutex(&db->linfo);
1671 Xfree(str); 1677 Xfree(str);
1672 return db; 1678 return db;
1673} 1679}
1674 1680
1675Status 1681Status
1676XrmCombineFileDatabase( 1682XrmCombineFileDatabase(
1677 _Xconst char *filename, 1683 _Xconst char *filename,
1678 XrmDatabase *target, 1684 XrmDatabase *target,
1679 Bool override) 1685 Bool override)
1680{ 1686{
1681 XrmDatabase db; 1687 XrmDatabase db;
1682 char *str; 1688 char *str;
1683 1689
1684 if (!(str = ReadInFile(filename))) 1690 if (!(str = ReadInFile(filename)))
1685 return 0; 1691 return 0;
1686 if (override) { 1692 if (override) {
1687 db = *target; 1693 db = *target;
1688 if (!db) 1694 if (!db)
1689 *target = db = NewDatabase(); 1695 *target = db = NewDatabase();
1690 } else 1696 } else
1691 db = NewDatabase(); 1697 db = NewDatabase();
1692 _XLockMutex(&db->linfo); 1698 _XLockMutex(&db->linfo);
1693 GetDatabase(db, str, filename, True); 1699 GetDatabase(db, str, filename, True, 0);
1694 _XUnlockMutex(&db->linfo); 1700 _XUnlockMutex(&db->linfo);
1695 Xfree(str); 1701 Xfree(str);
1696 if (!override) 1702 if (!override)
1697 XrmCombineDatabase(db, target, False); 1703 XrmCombineDatabase(db, target, False);
1698 return 1; 1704 return 1;
1699} 1705}
1700 1706
1701/* call the user proc for every value in the table, arbitrary order. 1707/* call the user proc for every value in the table, arbitrary order.
1702 * stop if user proc returns True. level is current depth in database. 1708 * stop if user proc returns True. level is current depth in database.
1703 */ 1709 */
1704/*ARGSUSED*/ 1710/*ARGSUSED*/
1705static Bool EnumLTable( 1711static Bool EnumLTable(
1706 LTable table, 1712 LTable table,
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xcms/cmsColNm.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/xcms/cmsColNm.c 2009/09/17 03:33:08 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/xcms/cmsColNm.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -33,26 +33,27 @@ @@ -33,26 +33,27 @@
33 * 33 *
34 */ 34 */
35/* $XFree86: xc/lib/X11/cmsColNm.c,v 3.11 2003/04/13 19:22:20 dawes Exp $ */ 35/* $XFree86: xc/lib/X11/cmsColNm.c,v 3.11 2003/04/13 19:22:20 dawes Exp $ */
36 36
37#ifdef HAVE_CONFIG_H 37#ifdef HAVE_CONFIG_H
38#include <config.h> 38#include <config.h>
39#endif 39#endif
40#include "Xlibint.h" 40#include "Xlibint.h"
41#include "Xcmsint.h" 41#include "Xcmsint.h"
42#include <X11/Xos.h> 42#include <X11/Xos.h>
43#include <sys/stat.h> 43#include <sys/stat.h>
44#include <stdio.h> 44#include <stdio.h>
45#include <ctype.h> 45#include <ctype.h>
 46#include <limits.h>
46#define XK_LATIN1 47#define XK_LATIN1
47#include <X11/keysymdef.h> 48#include <X11/keysymdef.h>
48#include "Cv.h" 49#include "Cv.h"
49 50
50/* forwards/locals */ 51/* forwards/locals */
51static Status LoadColornameDB(void); 52static Status LoadColornameDB(void);
52 53
53 54
54/* 55/*
55 * LOCAL DEFINES 56 * LOCAL DEFINES
56 * #define declarations local to this package. 57 * #define declarations local to this package.
57 */ 58 */
58#ifndef XCMSDB 59#ifndef XCMSDB
@@ -535,27 +536,30 @@ stringSectionSize( @@ -535,27 +536,30 @@ stringSectionSize(
535 * color name strings and also the number of strings. 536 * color name strings and also the number of strings.
536 * 537 *
537 * RETURNS 538 * RETURNS
538 * XcmsSuccess if succeeded, otherwise XcmsFailure. 539 * XcmsSuccess if succeeded, otherwise XcmsFailure.
539 * 540 *
540 */ 541 */
541{ 542{
542 char buf[XCMSDB_MAXLINELEN]; 543 char buf[XCMSDB_MAXLINELEN];
543 char token[XCMSDB_MAXLINELEN]; 544 char token[XCMSDB_MAXLINELEN];
544 char token2[XCMSDB_MAXLINELEN]; 545 char token2[XCMSDB_MAXLINELEN];
545 char *pBuf; 546 char *pBuf;
546 char *f1; 547 char *f1;
547 char *f2; 548 char *f2;
548 int i; 549 size_t i;
 550
 551 unsigned int numEntries = 0;
 552 unsigned int sectionSize = 0;
549 553
550 *pNumEntries = 0; 554 *pNumEntries = 0;
551 *pSectionSize = 0; 555 *pSectionSize = 0;
552 556
553 /* 557 /*
554 * Advance to START_TOKEN 558 * Advance to START_TOKEN
555 * Anything before is just considered as comments. 559 * Anything before is just considered as comments.
556 */ 560 */
557 561
558 while((pBuf = fgets(buf, XCMSDB_MAXLINELEN, stream)) != NULL) { 562 while((pBuf = fgets(buf, XCMSDB_MAXLINELEN, stream)) != NULL) {
559 if ((sscanf(buf, "%s %s", token, token2)) 563 if ((sscanf(buf, "%s %s", token, token2))
560 && (strcmp(token, START_TOKEN) == 0)) { 564 && (strcmp(token, START_TOKEN) == 0)) {
561 if (strcmp(token2, FORMAT_VERSION) != 0) { 565 if (strcmp(token2, FORMAT_VERSION) != 0) {
@@ -569,46 +573,57 @@ stringSectionSize( @@ -569,46 +573,57 @@ stringSectionSize(
569 if (pBuf == NULL) { 573 if (pBuf == NULL) {
570 return(XcmsFailure); 574 return(XcmsFailure);
571 } 575 }
572 576
573 while((pBuf = fgets(buf, XCMSDB_MAXLINELEN, stream)) != NULL) { 577 while((pBuf = fgets(buf, XCMSDB_MAXLINELEN, stream)) != NULL) {
574 if ((sscanf(buf, "%s", token)) && (strcmp(token, END_TOKEN) == 0)) { 578 if ((sscanf(buf, "%s", token)) && (strcmp(token, END_TOKEN) == 0)) {
575 break; 579 break;
576 } 580 }
577 581
578 if (field2(buf, DELIM_CHAR, &f1, &f2) != XcmsSuccess) { 582 if (field2(buf, DELIM_CHAR, &f1, &f2) != XcmsSuccess) {
579 return(XcmsFailure); 583 return(XcmsFailure);
580 } 584 }
581 585
582 (*pNumEntries)++; 586 numEntries++;
 587 if (numEntries >= INT_MAX)
 588 return(XcmsFailure);
583 589
584 (*pSectionSize) += (i = strlen(f1)) + 1; 590 i = strlen(f1);
 591 if (i >= INT_MAX - sectionSize)
 592 return(XcmsFailure);
 593 sectionSize += i + 1;
585 for (; i; i--, f1++) { 594 for (; i; i--, f1++) {
586 /* REMOVE SPACES FROM COUNT */ 595 /* REMOVE SPACES FROM COUNT */
587 if (isspace(*f1)) { 596 if (isspace(*f1)) {
588 (*pSectionSize)--; 597 sectionSize--;
589 } 598 }
590 } 599 }
591 600
592 (*pSectionSize) += (i = strlen(f2)) + 1; 601 i = strlen(f2);
 602 if (i >= INT_MAX - sectionSize)
 603 return(XcmsFailure);
 604 sectionSize += i + 1;
593 for (; i; i--, f2++) { 605 for (; i; i--, f2++) {
594 /* REMOVE SPACES FROM COUNT */ 606 /* REMOVE SPACES FROM COUNT */
595 if (isspace(*f2)) { 607 if (isspace(*f2)) {
596 (*pSectionSize)--; 608 sectionSize--;
597 } 609 }
598 } 610 }
599 611
600 } 612 }
601 613
 614 *pNumEntries = (int) numEntries;
 615 *pSectionSize = (int) sectionSize;
 616
602 return(XcmsSuccess); 617 return(XcmsSuccess);
603} 618}
604 619
605  620
606/* 621/*
607 * NAME 622 * NAME
608 * ReadColornameDB - Read the Color Name Database 623 * ReadColornameDB - Read the Color Name Database
609 * 624 *
610 * SYNOPSIS 625 * SYNOPSIS
611 */ 626 */
612static Status 627static Status
613ReadColornameDB( 628ReadColornameDB(
614 FILE *stream, 629 FILE *stream,
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBExtDev.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/xkb/XKBExtDev.c 2009/09/17 03:33:09 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/xkb/XKBExtDev.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -175,35 +175,41 @@ _XkbReadGetDeviceInfoReply( Display * d @@ -175,35 +175,41 @@ _XkbReadGetDeviceInfoReply( Display * d
175XkbReadBufferRec buf; 175XkbReadBufferRec buf;
176XkbAction * act; 176XkbAction * act;
177int tmp; 177int tmp;
178 178
179 if (!_XkbInitReadBuffer(dpy,&buf,(int)rep->length*4)) 179 if (!_XkbInitReadBuffer(dpy,&buf,(int)rep->length*4))
180 return BadAlloc; 180 return BadAlloc;
181 181
182 if ((rep->totalBtns>0)&&(rep->totalBtns!=devi->num_btns)) { 182 if ((rep->totalBtns>0)&&(rep->totalBtns!=devi->num_btns)) {
183 tmp= XkbResizeDeviceButtonActions(devi,rep->totalBtns); 183 tmp= XkbResizeDeviceButtonActions(devi,rep->totalBtns);
184 if (tmp!=Success) 184 if (tmp!=Success)
185 return tmp; 185 return tmp;
186 } 186 }
187 if (rep->nBtnsWanted>0) { 187 if (rep->nBtnsWanted>0) {
 188 if (((unsigned short) rep->firstBtnWanted + rep->nBtnsWanted)
 189 >= devi->num_btns)
 190 goto BAILOUT;
188 act= &devi->btn_acts[rep->firstBtnWanted]; 191 act= &devi->btn_acts[rep->firstBtnWanted];
189 bzero((char *)act,(rep->nBtnsWanted*sizeof(XkbAction))); 192 bzero((char *)act,(rep->nBtnsWanted*sizeof(XkbAction)));
190 } 193 }
191 if (devi->name!=NULL) 194 if (devi->name!=NULL)
192 _XkbFree(devi->name); 195 _XkbFree(devi->name);
193 if (!_XkbGetReadBufferCountedString(&buf,&devi->name)) 196 if (!_XkbGetReadBufferCountedString(&buf,&devi->name))
194 goto BAILOUT; 197 goto BAILOUT;
195 if (rep->nBtnsRtrn>0) { 198 if (rep->nBtnsRtrn>0) {
196 int size; 199 int size;
 200 if (((unsigned short) rep->firstBtnRtrn + rep->nBtnsRtrn)
 201 >= devi->num_btns)
 202 goto BAILOUT;
197 act= &devi->btn_acts[rep->firstBtnRtrn]; 203 act= &devi->btn_acts[rep->firstBtnRtrn];
198 size= rep->nBtnsRtrn*SIZEOF(xkbActionWireDesc); 204 size= rep->nBtnsRtrn*SIZEOF(xkbActionWireDesc);
199 if (!_XkbCopyFromReadBuffer(&buf,(char *)act,size)) 205 if (!_XkbCopyFromReadBuffer(&buf,(char *)act,size))
200 goto BAILOUT; 206 goto BAILOUT;
201 } 207 }
202 if (rep->nDeviceLedFBs>0) { 208 if (rep->nDeviceLedFBs>0) {
203 register int i; 209 register int i;
204 for (i=0;i<rep->nDeviceLedFBs;i++) { 210 for (i=0;i<rep->nDeviceLedFBs;i++) {
205 if ((tmp= _XkbReadDeviceLedInfo(&buf,rep->present,devi))!=Success) 211 if ((tmp= _XkbReadDeviceLedInfo(&buf,rep->present,devi))!=Success)
206 return tmp; 212 return tmp;
207 } 213 }
208 } 214 }
209 tmp= _XkbFreeReadBuffer(&buf); 215 tmp= _XkbFreeReadBuffer(&buf);
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBGeom.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/xkb/XKBGeom.c 2009/09/17 03:33:09 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/xkb/XKBGeom.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -358,32 +358,36 @@ Status rtrn; @@ -358,32 +358,36 @@ Status rtrn;
358 return BadAlloc; 358 return BadAlloc;
359 ol->corner_radius= olWire->cornerRadius; 359 ol->corner_radius= olWire->cornerRadius;
360 for (p=0,pt=ol->points;p<olWire->nPoints;p++,pt++) { 360 for (p=0,pt=ol->points;p<olWire->nPoints;p++,pt++) {
361 xkbPointWireDesc * ptWire; 361 xkbPointWireDesc * ptWire;
362 ptWire= (xkbPointWireDesc *) 362 ptWire= (xkbPointWireDesc *)
363 _XkbGetReadBufferPtr(buf,SIZEOF(xkbPointWireDesc)); 363 _XkbGetReadBufferPtr(buf,SIZEOF(xkbPointWireDesc));
364 if (!ptWire) 364 if (!ptWire)
365 return BadLength; 365 return BadLength;
366 pt->x= ptWire->x; 366 pt->x= ptWire->x;
367 pt->y= ptWire->y; 367 pt->y= ptWire->y;
368 } 368 }
369 ol->num_points= olWire->nPoints; 369 ol->num_points= olWire->nPoints;
370 } 370 }
371 if (shapeWire->primaryNdx!=XkbNoShape) 371 if ((shapeWire->primaryNdx!=XkbNoShape) &&
 372 (shapeWire->primaryNdx < shapeWire->nOutlines))
372 shape->primary= &shape->outlines[shapeWire->primaryNdx]; 373 shape->primary= &shape->outlines[shapeWire->primaryNdx];
373 else shape->primary= NULL; 374 else
374 if (shapeWire->approxNdx!=XkbNoShape) 375 shape->primary= NULL;
 376 if ((shapeWire->approxNdx!=XkbNoShape) &&
 377 (shapeWire->approxNdx < shapeWire->nOutlines))
375 shape->approx= &shape->outlines[shapeWire->approxNdx]; 378 shape->approx= &shape->outlines[shapeWire->approxNdx];
376 else shape->approx= NULL; 379 else
 380 shape->approx= NULL;
377 XkbComputeShapeBounds(shape); 381 XkbComputeShapeBounds(shape);
378 } 382 }
379 return Success; 383 return Success;
380} 384}
381 385
382static Status 386static Status
383_XkbReadGeomDoodad( XkbReadBufferPtr buf, 387_XkbReadGeomDoodad( XkbReadBufferPtr buf,
384 XkbGeometryPtr geom, 388 XkbGeometryPtr geom,
385 XkbSectionPtr section) 389 XkbSectionPtr section)
386{ 390{
387XkbDoodadPtr doodad; 391XkbDoodadPtr doodad;
388xkbDoodadWireDesc * doodadWire; 392xkbDoodadWireDesc * doodadWire;
389 393
@@ -609,26 +613,29 @@ XkbGeometryPtr geom; @@ -609,26 +613,29 @@ XkbGeometryPtr geom;
609 if (status==Success) 613 if (status==Success)
610 status= _XkbReadGeomProperties(&buf,geom,rep); 614 status= _XkbReadGeomProperties(&buf,geom,rep);
611 if (status==Success) 615 if (status==Success)
612 status= _XkbReadGeomColors(&buf,geom,rep); 616 status= _XkbReadGeomColors(&buf,geom,rep);
613 if (status==Success) 617 if (status==Success)
614 status= _XkbReadGeomShapes(&buf,geom,rep); 618 status= _XkbReadGeomShapes(&buf,geom,rep);
615 if (status==Success) 619 if (status==Success)
616 status= _XkbReadGeomSections(&buf,geom,rep); 620 status= _XkbReadGeomSections(&buf,geom,rep);
617 if (status==Success) 621 if (status==Success)
618 status= _XkbReadGeomDoodads(&buf,geom,rep); 622 status= _XkbReadGeomDoodads(&buf,geom,rep);
619 if (status==Success) 623 if (status==Success)
620 status= _XkbReadGeomKeyAliases(&buf,geom,rep); 624 status= _XkbReadGeomKeyAliases(&buf,geom,rep);
621 left= _XkbFreeReadBuffer(&buf); 625 left= _XkbFreeReadBuffer(&buf);
 626 if ((rep->baseColorNdx > geom->num_colors) ||
 627 (rep->labelColorNdx > geom->num_colors))
 628 status = BadLength;
622 if ((status!=Success) || left || buf.error) { 629 if ((status!=Success) || left || buf.error) {
623 if (status==Success) 630 if (status==Success)
624 status= BadLength; 631 status= BadLength;
625 XkbFreeGeometry(geom,XkbGeomAllMask,True); 632 XkbFreeGeometry(geom,XkbGeomAllMask,True);
626 xkb->geom= NULL; 633 xkb->geom= NULL;
627 return status; 634 return status;
628 } 635 }
629 geom->base_color= &geom->colors[rep->baseColorNdx]; 636 geom->base_color= &geom->colors[rep->baseColorNdx];
630 geom->label_color= &geom->colors[rep->labelColorNdx]; 637 geom->label_color= &geom->colors[rep->labelColorNdx];
631 } 638 }
632 else { 639 else {
633 XkbFreeGeometry(geom,XkbGeomAllMask,True); 640 XkbFreeGeometry(geom,XkbGeomAllMask,True);
634 xkb->geom= NULL; 641 xkb->geom= NULL;
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c 2009/09/17 03:33:09 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -146,29 +146,32 @@ XkbKeyTypePtr type; @@ -146,29 +146,32 @@ XkbKeyTypePtr type;
146 } 146 }
147 return Success; 147 return Success;
148} 148}
149 149
150static Status 150static Status
151_XkbReadKeySyms(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep) 151_XkbReadKeySyms(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep)
152{ 152{
153register int i; 153register int i;
154XkbClientMapPtr map; 154XkbClientMapPtr map;
155 155
156 map= xkb->map; 156 map= xkb->map;
157 if (map->key_sym_map==NULL) { 157 if (map->key_sym_map==NULL) {
158 register int offset; 158 register int offset;
 159 int size = xkb->max_key_code + 1;
159 XkbSymMapPtr oldMap; 160 XkbSymMapPtr oldMap;
160 xkbSymMapWireDesc *newMap; 161 xkbSymMapWireDesc *newMap;
161 map->key_sym_map= _XkbTypedCalloc((xkb->max_key_code+1),XkbSymMapRec); 162 if (((unsigned short)rep->firstKeySym + rep->nKeySyms) > size)
 163 return BadLength;
 164 map->key_sym_map= _XkbTypedCalloc(size,XkbSymMapRec);
162 if (map->key_sym_map==NULL) 165 if (map->key_sym_map==NULL)
163 return BadAlloc; 166 return BadAlloc;
164 if (map->syms==NULL) { 167 if (map->syms==NULL) {
165 int sz; 168 int sz;
166 sz= (rep->totalSyms*12)/10; 169 sz= (rep->totalSyms*12)/10;
167 sz= ((sz+(unsigned)128)/128)*128; 170 sz= ((sz+(unsigned)128)/128)*128;
168 map->syms = _XkbTypedCalloc(sz,KeySym); 171 map->syms = _XkbTypedCalloc(sz,KeySym);
169 if (map->syms==NULL) 172 if (map->syms==NULL)
170 return BadAlloc; 173 return BadAlloc;
171 map->size_syms = sz; 174 map->size_syms = sz;
172 } 175 }
173 offset = 1; 176 offset = 1;
174 oldMap = &map->key_sym_map[rep->firstKeySym]; 177 oldMap = &map->key_sym_map[rep->firstKeySym];
@@ -204,26 +207,28 @@ XkbClientMapPtr map; @@ -204,26 +207,28 @@ XkbClientMapPtr map;
204 } 207 }
205 else { 208 else {
206 map->syms[offset]= 0; 209 map->syms[offset]= 0;
207 } 210 }
208 } 211 }
209 map->num_syms= offset; 212 map->num_syms= offset;
210 } 213 }
211 else { 214 else {
212 xkbSymMapWireDesc * newMap; 215 xkbSymMapWireDesc * newMap;
213 XkbSymMapPtr oldMap; 216 XkbSymMapPtr oldMap;
214 KeySym * newSyms; 217 KeySym * newSyms;
215 int tmp; 218 int tmp;
216 219
 220 if (((unsigned short)rep->firstKeySym + rep->nKeySyms) > map->num_syms)
 221 return BadLength;
217 oldMap = &map->key_sym_map[rep->firstKeySym]; 222 oldMap = &map->key_sym_map[rep->firstKeySym];
218 for (i=0;i<(int)rep->nKeySyms;i++,oldMap++) { 223 for (i=0;i<(int)rep->nKeySyms;i++,oldMap++) {
219 newMap= (xkbSymMapWireDesc *) 224 newMap= (xkbSymMapWireDesc *)
220 _XkbGetReadBufferPtr(buf,SIZEOF(xkbSymMapWireDesc)); 225 _XkbGetReadBufferPtr(buf,SIZEOF(xkbSymMapWireDesc));
221 if (newMap==NULL) 226 if (newMap==NULL)
222 return BadLength; 227 return BadLength;
223 228
224 if (newMap->nSyms>0) 229 if (newMap->nSyms>0)
225 tmp= newMap->nSyms; 230 tmp= newMap->nSyms;
226 else tmp= 0; 231 else tmp= 0;
227 232
228 newSyms = XkbResizeKeySyms(xkb,i+rep->firstKeySym,tmp); 233 newSyms = XkbResizeKeySyms(xkb,i+rep->firstKeySym,tmp);
229 if (newSyms==NULL) 234 if (newSyms==NULL)
@@ -259,26 +264,30 @@ Status ret = Success; @@ -259,26 +264,30 @@ Status ret = Success;
259 264
260 if (!_XkbCopyFromReadBuffer(buf, (char *)numDesc, nKeyActs)) { 265 if (!_XkbCopyFromReadBuffer(buf, (char *)numDesc, nKeyActs)) {
261 ret = BadLength; 266 ret = BadLength;
262 goto done; 267 goto done;
263 } 268 }
264 i= XkbPaddedSize(nKeyActs)-nKeyActs; 269 i= XkbPaddedSize(nKeyActs)-nKeyActs;
265 if ((i>0)&&(!_XkbSkipReadBufferData(buf,i))) { 270 if ((i>0)&&(!_XkbSkipReadBufferData(buf,i))) {
266 ret = BadLength; 271 ret = BadLength;
267 goto done; 272 goto done;
268 } 273 }
269 symMap = &info->map->key_sym_map[rep->firstKeyAct]; 274 symMap = &info->map->key_sym_map[rep->firstKeyAct];
270 for (i=0;i<(int)rep->nKeyActs;i++,symMap++) { 275 for (i=0;i<(int)rep->nKeyActs;i++,symMap++) {
271 if (numDesc[i]==0) { 276 if (numDesc[i]==0) {
 277 if ((i + rep->firstKeyAct) > (info->max_key_code + 1)) {
 278 ret = BadLength;
 279 goto done;
 280 }
272 info->server->key_acts[i+rep->firstKeyAct]= 0; 281 info->server->key_acts[i+rep->firstKeyAct]= 0;
273 } 282 }
274 else { 283 else {
275 XkbAction *newActs; 284 XkbAction *newActs;
276 /* 8/16/93 (ef) -- XXX! Verify size here (numdesc must be */ 285 /* 8/16/93 (ef) -- XXX! Verify size here (numdesc must be */
277 /* either zero or XkbKeyNumSyms(info,key) */ 286 /* either zero or XkbKeyNumSyms(info,key) */
278 newActs=XkbResizeKeyActions(info,i+rep->firstKeyAct, 287 newActs=XkbResizeKeyActions(info,i+rep->firstKeyAct,
279 numDesc[i]); 288 numDesc[i]);
280 if (newActs==NULL) { 289 if (newActs==NULL) {
281 ret = BadAlloc; 290 ret = BadAlloc;
282 goto done; 291 goto done;
283 } 292 }
284 if (!_XkbCopyFromReadBuffer(buf,(char *)newActs, 293 if (!_XkbCopyFromReadBuffer(buf,(char *)newActs,
@@ -291,40 +300,42 @@ Status ret = Success; @@ -291,40 +300,42 @@ Status ret = Success;
291 } 300 }
292done: 301done:
293 if (numDesc != NULL && numDesc != numDescBuf) Xfree (numDesc); 302 if (numDesc != NULL && numDesc != numDescBuf) Xfree (numDesc);
294 return ret; 303 return ret;
295} 304}
296 305
297static Status 306static Status
298_XkbReadKeyBehaviors(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep) 307_XkbReadKeyBehaviors(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep)
299{ 308{
300register int i; 309register int i;
301xkbBehaviorWireDesc *wire; 310xkbBehaviorWireDesc *wire;
302 311
303 if ( rep->totalKeyBehaviors>0 ) { 312 if ( rep->totalKeyBehaviors>0 ) {
 313 int size = xkb->max_key_code + 1;
 314 if ( ((int) rep->firstKeyBehavior + rep->nKeyBehaviors) > size)
 315 return BadLength;
304 if ( xkb->server->behaviors == NULL ) { 316 if ( xkb->server->behaviors == NULL ) {
305 int size = xkb->max_key_code+1; 
306 xkb->server->behaviors = _XkbTypedCalloc(size,XkbBehavior); 317 xkb->server->behaviors = _XkbTypedCalloc(size,XkbBehavior);
307 if (xkb->server->behaviors==NULL) 318 if (xkb->server->behaviors==NULL)
308 return BadAlloc; 319 return BadAlloc;
309 } 320 }
310 else { 321 else {
311 bzero(&xkb->server->behaviors[rep->firstKeyBehavior], 322 bzero(&xkb->server->behaviors[rep->firstKeyBehavior],
312 (rep->nKeyBehaviors*sizeof(XkbBehavior))); 323 (rep->nKeyBehaviors*sizeof(XkbBehavior)));
313 } 324 }
314 for (i=0;i<rep->totalKeyBehaviors;i++) { 325 for (i=0;i<rep->totalKeyBehaviors;i++) {
315 wire= (xkbBehaviorWireDesc *)_XkbGetReadBufferPtr(buf, 326 wire= (xkbBehaviorWireDesc *)_XkbGetReadBufferPtr(buf,
316 SIZEOF(xkbBehaviorWireDesc)); 327 SIZEOF(xkbBehaviorWireDesc));
317 if (wire==NULL) 328 if (wire==NULL || wire->key >= size)
318 return BadLength; 329 return BadLength;
319 xkb->server->behaviors[wire->key].type= wire->type; 330 xkb->server->behaviors[wire->key].type= wire->type;
320 xkb->server->behaviors[wire->key].data= wire->data; 331 xkb->server->behaviors[wire->key].data= wire->data;
321 } 332 }
322 } 333 }
323 return Success; 334 return Success;
324} 335}
325 336
326static Status 337static Status
327_XkbReadVirtualMods(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep) 338_XkbReadVirtualMods(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep)
328{ 339{
329 if ( rep->virtualMods ) { 340 if ( rep->virtualMods ) {
330 register int i,bit,nVMods; 341 register int i,bit,nVMods;
@@ -346,80 +357,92 @@ _XkbReadVirtualMods(XkbReadBufferPtr buf @@ -346,80 +357,92 @@ _XkbReadVirtualMods(XkbReadBufferPtr buf
346 } 357 }
347 return Success; 358 return Success;
348} 359}
349 360
350static Status 361static Status
351_XkbReadExplicitComponents( XkbReadBufferPtr buf, 362_XkbReadExplicitComponents( XkbReadBufferPtr buf,
352 XkbDescPtr xkb, 363 XkbDescPtr xkb,
353 xkbGetMapReply * rep) 364 xkbGetMapReply * rep)
354{ 365{
355register int i; 366register int i;
356unsigned char *wire; 367unsigned char *wire;
357 368
358 if ( rep->totalKeyExplicit>0 ) { 369 if ( rep->totalKeyExplicit>0 ) {
 370 int size = xkb->max_key_code + 1;
 371 if ( ((int) rep->firstKeyExplicit + rep->nKeyExplicit) > size)
 372 return BadLength;
359 if ( xkb->server->explicit == NULL ) { 373 if ( xkb->server->explicit == NULL ) {
360 int size = xkb->max_key_code+1; 
361 xkb->server->explicit = _XkbTypedCalloc(size,unsigned char); 374 xkb->server->explicit = _XkbTypedCalloc(size,unsigned char);
362 if (xkb->server->explicit==NULL) 375 if (xkb->server->explicit==NULL)
363 return BadAlloc; 376 return BadAlloc;
364 } 377 }
365 else { 378 else {
366 bzero(&xkb->server->explicit[rep->firstKeyExplicit], 379 bzero(&xkb->server->explicit[rep->firstKeyExplicit],
367 rep->nKeyExplicit); 380 rep->nKeyExplicit);
368 } 381 }
369 i= XkbPaddedSize(2*rep->totalKeyExplicit); 382 i= XkbPaddedSize(2*rep->totalKeyExplicit);
370 wire=(unsigned char *)_XkbGetReadBufferPtr(buf,i); 383 wire=(unsigned char *)_XkbGetReadBufferPtr(buf,i);
371 if (!wire) 384 if (!wire)
372 return BadLength; 385 return BadLength;
373 for (i=0;i<rep->totalKeyExplicit;i++,wire+=2) { 386 for (i=0;i<rep->totalKeyExplicit;i++,wire+=2) {
 387 if (wire[0] > xkb->max_key_code || wire[1] > xkb->max_key_code)
 388 return BadLength;
374 xkb->server->explicit[wire[0]]= wire[1]; 389 xkb->server->explicit[wire[0]]= wire[1];
375 } 390 }
376 } 391 }
377 return Success; 392 return Success;
378} 393}
379 394
380static Status 395static Status
381_XkbReadModifierMap(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep) 396_XkbReadModifierMap(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep)
382{ 397{
383register int i; 398register int i;
384unsigned char *wire; 399unsigned char *wire;
385 400
386 if ( rep->totalModMapKeys>0 ) { 401 if ( rep->totalModMapKeys>0 ) {
 402 if ( ((int)rep->firstModMapKey + rep->nModMapKeys) >
 403 (xkb->max_key_code + 1))
 404 return BadLength;
387 if ((xkb->map->modmap==NULL)&& 405 if ((xkb->map->modmap==NULL)&&
388 (XkbAllocClientMap(xkb,XkbModifierMapMask,0)!=Success)) { 406 (XkbAllocClientMap(xkb,XkbModifierMapMask,0)!=Success)) {
389 return BadAlloc; 407 return BadAlloc;
390 } 408 }
391 else { 409 else {
392 bzero(&xkb->map->modmap[rep->firstModMapKey],rep->nModMapKeys); 410 bzero(&xkb->map->modmap[rep->firstModMapKey],rep->nModMapKeys);
393 } 411 }
394 i= XkbPaddedSize(2*rep->totalModMapKeys); 412 i= XkbPaddedSize(2*rep->totalModMapKeys);
395 wire=(unsigned char *)_XkbGetReadBufferPtr(buf,i); 413 wire=(unsigned char *)_XkbGetReadBufferPtr(buf,i);
396 if (!wire) 414 if (!wire)
397 return BadLength; 415 return BadLength;
398 for (i=0;i<rep->totalModMapKeys;i++,wire+=2) { 416 for (i=0;i<rep->totalModMapKeys;i++,wire+=2) {
 417 if (wire[0] > xkb->max_key_code || wire[1] > xkb->max_key_code)
 418 return BadLength;
399 xkb->map->modmap[wire[0]]= wire[1]; 419 xkb->map->modmap[wire[0]]= wire[1];
400 } 420 }
401 } 421 }
402 return Success; 422 return Success;
403} 423}
404 424
405static Status 425static Status
406_XkbReadVirtualModMap(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep) 426_XkbReadVirtualModMap(XkbReadBufferPtr buf,XkbDescPtr xkb,xkbGetMapReply *rep)
407{ 427{
408register int i; 428register int i;
409xkbVModMapWireDesc * wire; 429xkbVModMapWireDesc * wire;
410XkbServerMapPtr srv; 430XkbServerMapPtr srv;
411 431
412 if ( rep->totalVModMapKeys>0 ) { 432 if ( rep->totalVModMapKeys>0 ) {
 433 if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
 434 > xkb->max_key_code)
 435 return BadLength;
413 if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&& 436 if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
414 (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) { 437 (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
415 return BadAlloc; 438 return BadAlloc;
416 } 439 }
417 else { 440 else {
418 srv= xkb->server; 441 srv= xkb->server;
419 if (rep->nVModMapKeys > rep->firstVModMapKey) 442 if (rep->nVModMapKeys > rep->firstVModMapKey)
420 bzero((char *)&srv->vmodmap[rep->firstVModMapKey], 443 bzero((char *)&srv->vmodmap[rep->firstVModMapKey],
421 (rep->nVModMapKeys - rep->firstVModMapKey) * 444 (rep->nVModMapKeys - rep->firstVModMapKey) *
422 sizeof(unsigned short)); 445 sizeof(unsigned short));
423 } 446 }
424 srv= xkb->server; 447 srv= xkb->server;
425 i= rep->totalVModMapKeys*SIZEOF(xkbVModMapWireDesc); 448 i= rep->totalVModMapKeys*SIZEOF(xkbVModMapWireDesc);
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c (expand / switch to unified diff)

--- xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c 2009/09/17 03:33:09 1.1.1.1.2.1
+++ xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -174,26 +174,28 @@ _XkbReadGetNamesReply( Display * dpy, @@ -174,26 +174,28 @@ _XkbReadGetNamesReply( Display * dpy,
174 (CARD32)rep->groupNames)!=Success) 174 (CARD32)rep->groupNames)!=Success)
175 goto BAILOUT; 175 goto BAILOUT;
176 } 176 }
177 if ( rep->which&XkbKeyNamesMask ) { 177 if ( rep->which&XkbKeyNamesMask ) {
178 if (names->keys==NULL) { 178 if (names->keys==NULL) {
179 int nKeys; 179 int nKeys;
180 if (xkb->max_key_code==0) { 180 if (xkb->max_key_code==0) {
181 xkb->min_key_code= rep->minKeyCode; 181 xkb->min_key_code= rep->minKeyCode;
182 xkb->max_key_code= rep->maxKeyCode; 182 xkb->max_key_code= rep->maxKeyCode;
183 } 183 }
184 nKeys= xkb->max_key_code+1; 184 nKeys= xkb->max_key_code+1;
185 names->keys= _XkbTypedCalloc(nKeys,XkbKeyNameRec); 185 names->keys= _XkbTypedCalloc(nKeys,XkbKeyNameRec);
186 } 186 }
 187 else if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code)
 188 goto BAILOUT;
187 if (names->keys!=NULL) { 189 if (names->keys!=NULL) {
188 if (!_XkbCopyFromReadBuffer(&buf, 190 if (!_XkbCopyFromReadBuffer(&buf,
189 (char *)&names->keys[rep->firstKey], 191 (char *)&names->keys[rep->firstKey],
190 rep->nKeys*XkbKeyNameLength)) 192 rep->nKeys*XkbKeyNameLength))
191 goto BAILOUT; 193 goto BAILOUT;
192 } 194 }
193 else _XkbSkipReadBufferData(&buf,rep->nKeys*XkbKeyNameLength); 195 else _XkbSkipReadBufferData(&buf,rep->nKeys*XkbKeyNameLength);
194 } 196 }
195 if ( rep->which&XkbKeyAliasesMask && (rep->nKeyAliases>0) ) { 197 if ( rep->which&XkbKeyAliasesMask && (rep->nKeyAliases>0) ) {
196 if (XkbAllocNames(xkb,XkbKeyAliasesMask,0,rep->nKeyAliases)!=Success) 198 if (XkbAllocNames(xkb,XkbKeyAliasesMask,0,rep->nKeyAliases)!=Success)
197 goto BAILOUT; 199 goto BAILOUT;
198 if (!_XkbCopyFromReadBuffer(&buf,(char *)names->key_aliases, 200 if (!_XkbCopyFromReadBuffer(&buf,(char *)names->key_aliases,
199 rep->nKeyAliases*XkbKeyNameLength*2)) 201 rep->nKeyAliases*XkbKeyNameLength*2))
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXcursor/dist/src/file.c (expand / switch to unified diff)

--- xsrc/external/mit/libXcursor/dist/src/file.c 2008/07/30 02:45:53 1.1.1.1
+++ xsrc/external/mit/libXcursor/dist/src/file.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -1,15 +1,15 @@ @@ -1,15 +1,15 @@
1/* 1/*
2 * $Id: file.c,v 1.1.1.1 2008/07/30 02:45:53 mrg Exp $ 2 * $Id: file.c,v 1.1.1.1.6.1 2013/06/06 16:39:19 riz Exp $
3 * 3 *
4 * Copyright © 2002 Keith Packard 4 * Copyright © 2002 Keith Packard
5 * 5 *
6 * Permission to use, copy, modify, distribute, and sell this software and its 6 * Permission to use, copy, modify, distribute, and sell this software and its
7 * documentation for any purpose is hereby granted without fee, provided that 7 * documentation for any purpose is hereby granted without fee, provided that
8 * the above copyright notice appear in all copies and that both that 8 * the above copyright notice appear in all copies and that both that
9 * copyright notice and this permission notice appear in supporting 9 * copyright notice and this permission notice appear in supporting
10 * documentation, and that the name of Keith Packard not be used in 10 * documentation, and that the name of Keith Packard not be used in
11 * advertising or publicity pertaining to distribution of the software without 11 * advertising or publicity pertaining to distribution of the software without
12 * specific, written prior permission. Keith Packard makes no 12 * specific, written prior permission. Keith Packard makes no
13 * representations about the suitability of this software for any purpose. It 13 * representations about the suitability of this software for any purpose. It
14 * is provided "as is" without express or implied warranty. 14 * is provided "as is" without express or implied warranty.
15 * 15 *
@@ -197,27 +197,27 @@ _XcursorWriteBytes (XcursorFile *file, c @@ -197,27 +197,27 @@ _XcursorWriteBytes (XcursorFile *file, c
197{ 197{
198 if (!file || !bytes || (*file->write) (file, (unsigned char *) bytes, length) != length) 198 if (!file || !bytes || (*file->write) (file, (unsigned char *) bytes, length) != length)
199 return XcursorFalse; 199 return XcursorFalse;
200 return XcursorTrue; 200 return XcursorTrue;
201} 201}
202 202
203static void 203static void
204_XcursorFileHeaderDestroy (XcursorFileHeader *fileHeader) 204_XcursorFileHeaderDestroy (XcursorFileHeader *fileHeader)
205{ 205{
206 free (fileHeader); 206 free (fileHeader);
207} 207}
208 208
209static XcursorFileHeader * 209static XcursorFileHeader *
210_XcursorFileHeaderCreate (int ntoc) 210_XcursorFileHeaderCreate (XcursorUInt ntoc)
211{ 211{
212 XcursorFileHeader *fileHeader; 212 XcursorFileHeader *fileHeader;
213 213
214 if (ntoc > 0x10000) 214 if (ntoc > 0x10000)
215 return NULL; 215 return NULL;
216 fileHeader = malloc (sizeof (XcursorFileHeader) + 216 fileHeader = malloc (sizeof (XcursorFileHeader) +
217 ntoc * sizeof (XcursorFileToc)); 217 ntoc * sizeof (XcursorFileToc));
218 if (!fileHeader) 218 if (!fileHeader)
219 return NULL; 219 return NULL;
220 fileHeader->magic = XCURSOR_MAGIC; 220 fileHeader->magic = XCURSOR_MAGIC;
221 fileHeader->header = XCURSOR_FILE_HEADER_LEN; 221 fileHeader->header = XCURSOR_FILE_HEADER_LEN;
222 fileHeader->version = XCURSOR_FILE_VERSION; 222 fileHeader->version = XCURSOR_FILE_VERSION;
223 fileHeader->ntoc = ntoc; 223 fileHeader->ntoc = ntoc;
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/XEVI.c (expand / switch to unified diff)

--- xsrc/external/mit/libXext/dist/src/XEVI.c 2008/07/30 02:47:10 1.1.1.1
+++ xsrc/external/mit/libXext/dist/src/XEVI.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -23,26 +23,27 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. @@ -23,26 +23,27 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
23********************************************************/ 23********************************************************/
24/* $XFree86$ */ 24/* $XFree86$ */
25#define NEED_EVENTS 25#define NEED_EVENTS
26#define NEED_REPLIES 26#define NEED_REPLIES
27#ifdef HAVE_CONFIG_H 27#ifdef HAVE_CONFIG_H
28#include <config.h> 28#include <config.h>
29#endif 29#endif
30#include <X11/Xlibint.h> 30#include <X11/Xlibint.h>
31#include <X11/extensions/XEVI.h> 31#include <X11/extensions/XEVI.h>
32#include <X11/extensions/XEVIstr.h> 32#include <X11/extensions/XEVIstr.h>
33#include <X11/extensions/Xext.h> 33#include <X11/extensions/Xext.h>
34#include <X11/extensions/extutil.h> 34#include <X11/extensions/extutil.h>
35#include <X11/Xutil.h> 35#include <X11/Xutil.h>
 36#include <limits.h>
36static XExtensionInfo *xevi_info;/* needs to move to globals.c */ 37static XExtensionInfo *xevi_info;/* needs to move to globals.c */
37static /* const */ char *xevi_extension_name = EVINAME; 38static /* const */ char *xevi_extension_name = EVINAME;
38#define XeviCheckExtension(dpy,i,val) \ 39#define XeviCheckExtension(dpy,i,val) \
39 XextCheckExtension (dpy, i, xevi_extension_name, val) 40 XextCheckExtension (dpy, i, xevi_extension_name, val)
40/***************************************************************************** 41/*****************************************************************************
41 * * 42 * *
42 * private utility routines * 43 * private utility routines *
43 * * 44 * *
44 *****************************************************************************/ 45 *****************************************************************************/
45static /* const */ XExtensionHooks xevi_extension_hooks = { 46static /* const */ XExtensionHooks xevi_extension_hooks = {
46 NULL, /* create_gc */ 47 NULL, /* create_gc */
47 NULL, /* copy_gc */ 48 NULL, /* copy_gc */
48 NULL, /* flush_gc */ 49 NULL, /* flush_gc */
@@ -156,49 +157,59 @@ Status XeviGetVisualInfo( @@ -156,49 +157,59 @@ Status XeviGetVisualInfo(
156 GetReq(EVIGetVisualInfo, req); 157 GetReq(EVIGetVisualInfo, req);
157 req->reqType = info->codes->major_opcode; 158 req->reqType = info->codes->major_opcode;
158 req->xeviReqType = X_EVIGetVisualInfo; 159 req->xeviReqType = X_EVIGetVisualInfo;
159 req->n_visual = n_visual; 160 req->n_visual = n_visual;
160 SetReqLen(req, n_visual, 1); 161 SetReqLen(req, n_visual, 1);
161 Data(dpy, (char *)temp_visual, n_visual * sz_VisualID32); 162 Data(dpy, (char *)temp_visual, n_visual * sz_VisualID32);
162 if (!_XReply(dpy, (xReply *)&rep, 0, xFalse)) { 163 if (!_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
163 UnlockDisplay(dpy); 164 UnlockDisplay(dpy);
164 SyncHandle(); 165 SyncHandle();
165 Xfree(temp_visual); 166 Xfree(temp_visual);
166 return BadAccess; 167 return BadAccess;
167 } 168 }
168 Xfree(temp_visual); 169 Xfree(temp_visual);
169 sz_info = rep.n_info * sizeof(ExtendedVisualInfo); 170 if ((rep.n_info < 65536) && (rep.n_conflicts < 65536)) {
170 sz_xInfo = rep.n_info * sz_xExtendedVisualInfo; 171 sz_info = rep.n_info * sizeof(ExtendedVisualInfo);
171 sz_conflict = rep.n_conflicts * sizeof(VisualID); 172 sz_xInfo = rep.n_info * sz_xExtendedVisualInfo;
172 sz_xConflict = rep.n_conflicts * sz_VisualID32; 173 sz_conflict = rep.n_conflicts * sizeof(VisualID);
173 infoPtr = *evi_return = (ExtendedVisualInfo *)Xmalloc(sz_info + sz_conflict); 174 sz_xConflict = rep.n_conflicts * sz_VisualID32;
174 xInfoPtr = temp_xInfo = (xExtendedVisualInfo *)Xmalloc(sz_xInfo); 175 *evi_return = Xmalloc(sz_info + sz_conflict);
175 xConflictPtr = temp_conflict = (VisualID32 *)Xmalloc(sz_xConflict); 176 temp_xInfo = Xmalloc(sz_xInfo);
 177 temp_conflict = Xmalloc(sz_xConflict);
 178 } else {
 179 sz_xInfo = sz_xConflict = 0;
 180 *evi_return = NULL;
 181 temp_xInfo = NULL;
 182 temp_conflict = NULL;
 183 }
176 if (!*evi_return || !temp_xInfo || !temp_conflict) { 184 if (!*evi_return || !temp_xInfo || !temp_conflict) {
177 _XEatData(dpy, (sz_xInfo + sz_xConflict + 3) & ~3); 185 _XEatData(dpy, (sz_xInfo + sz_xConflict + 3) & ~3);
178 UnlockDisplay(dpy); 186 UnlockDisplay(dpy);
179 SyncHandle(); 187 SyncHandle();
180 if (evi_return) 188 if (evi_return)
181 Xfree(evi_return); 189 Xfree(evi_return);
182 if (temp_xInfo) 190 if (temp_xInfo)
183 Xfree(temp_xInfo); 191 Xfree(temp_xInfo);
184 if (temp_conflict) 192 if (temp_conflict)
185 Xfree(temp_conflict); 193 Xfree(temp_conflict);
186 return BadAlloc; 194 return BadAlloc;
187 } 195 }
188 _XRead(dpy, (char *)temp_xInfo, sz_xInfo); 196 _XRead(dpy, (char *)temp_xInfo, sz_xInfo);
189 _XRead(dpy, (char *)temp_conflict, sz_xConflict); 197 _XRead(dpy, (char *)temp_conflict, sz_xConflict);
190 UnlockDisplay(dpy); 198 UnlockDisplay(dpy);
191 SyncHandle(); 199 SyncHandle();
 200 infoPtr = *evi_return;
 201 xInfoPtr = temp_xInfo;
 202 xConflictPtr = temp_conflict;
192 n_data = rep.n_info; 203 n_data = rep.n_info;
193 conflict = (VisualID *)(infoPtr + n_data); 204 conflict = (VisualID *)(infoPtr + n_data);
194 while (n_data-- > 0) { 205 while (n_data-- > 0) {
195 infoPtr->core_visual_id = xInfoPtr->core_visual_id; 206 infoPtr->core_visual_id = xInfoPtr->core_visual_id;
196 infoPtr->screen = xInfoPtr->screen; 207 infoPtr->screen = xInfoPtr->screen;
197 infoPtr->level = xInfoPtr->level; 208 infoPtr->level = xInfoPtr->level;
198 infoPtr->transparency_type = xInfoPtr->transparency_type; 209 infoPtr->transparency_type = xInfoPtr->transparency_type;
199 infoPtr->transparency_value = xInfoPtr->transparency_value; 210 infoPtr->transparency_value = xInfoPtr->transparency_value;
200 infoPtr->min_hw_colormaps = xInfoPtr->min_hw_colormaps; 211 infoPtr->min_hw_colormaps = xInfoPtr->min_hw_colormaps;
201 infoPtr->max_hw_colormaps = xInfoPtr->max_hw_colormaps; 212 infoPtr->max_hw_colormaps = xInfoPtr->max_hw_colormaps;
202 infoPtr->num_colormap_conflicts = xInfoPtr->num_colormap_conflicts; 213 infoPtr->num_colormap_conflicts = xInfoPtr->num_colormap_conflicts;
203 infoPtr->colormap_conflicts = conflict; 214 infoPtr->colormap_conflicts = conflict;
204 conflict += infoPtr->num_colormap_conflicts; 215 conflict += infoPtr->num_colormap_conflicts;
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/XShape.c (expand / switch to unified diff)

--- xsrc/external/mit/libXext/dist/src/XShape.c 2008/07/30 02:47:11 1.1.1.1
+++ xsrc/external/mit/libXext/dist/src/XShape.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -27,26 +27,27 @@ in this Software without prior written a @@ -27,26 +27,27 @@ in this Software without prior written a
27 */ 27 */
28/* $XFree86: xc/lib/Xext/XShape.c,v 1.3 2002/10/16 00:37:27 dawes Exp $ */ 28/* $XFree86: xc/lib/Xext/XShape.c,v 1.3 2002/10/16 00:37:27 dawes Exp $ */
29#define NEED_EVENTS 29#define NEED_EVENTS
30#define NEED_REPLIES 30#define NEED_REPLIES
31#ifdef HAVE_CONFIG_H 31#ifdef HAVE_CONFIG_H
32#include <config.h> 32#include <config.h>
33#endif 33#endif
34#include <X11/Xlibint.h> 34#include <X11/Xlibint.h>
35#include <X11/Xutil.h> 35#include <X11/Xutil.h>
36#include <X11/Xregion.h> 36#include <X11/Xregion.h>
37#include <X11/extensions/Xext.h> 37#include <X11/extensions/Xext.h>
38#include <X11/extensions/extutil.h> 38#include <X11/extensions/extutil.h>
39#include <X11/extensions/shapestr.h> 39#include <X11/extensions/shapestr.h>
 40#include <limits.h>
40 41
41static XExtensionInfo _shape_info_data; 42static XExtensionInfo _shape_info_data;
42static XExtensionInfo *shape_info = &_shape_info_data; 43static XExtensionInfo *shape_info = &_shape_info_data;
43static /* const */ char *shape_extension_name = SHAPENAME; 44static /* const */ char *shape_extension_name = SHAPENAME;
44 45
45#define ShapeCheckExtension(dpy,i,val) \ 46#define ShapeCheckExtension(dpy,i,val) \
46 XextCheckExtension (dpy, i, shape_extension_name, val) 47 XextCheckExtension (dpy, i, shape_extension_name, val)
47#define ShapeSimpleCheckExtension(dpy,i) \ 48#define ShapeSimpleCheckExtension(dpy,i) \
48 XextSimpleCheckExtension (dpy, i, shape_extension_name) 49 XextSimpleCheckExtension (dpy, i, shape_extension_name)
49 50
50 51
51/***************************************************************************** 52/*****************************************************************************
52 * * 53 * *
@@ -434,57 +435,60 @@ unsigned long XShapeInputSelected (regis @@ -434,57 +435,60 @@ unsigned long XShapeInputSelected (regis
434 435
435XRectangle *XShapeGetRectangles ( 436XRectangle *XShapeGetRectangles (
436 register Display *dpy, 437 register Display *dpy,
437 Window window, 438 Window window,
438 int kind, 439 int kind,
439 int *count, /* RETURN */ 440 int *count, /* RETURN */
440 int *ordering /* RETURN */) 441 int *ordering /* RETURN */)
441{ 442{
442 XExtDisplayInfo *info = find_display (dpy); 443 XExtDisplayInfo *info = find_display (dpy);
443 register xShapeGetRectanglesReq *req; 444 register xShapeGetRectanglesReq *req;
444 xShapeGetRectanglesReply rep; 445 xShapeGetRectanglesReply rep;
445 XRectangle *rects; 446 XRectangle *rects;
446 xRectangle *xrects; 447 xRectangle *xrects;
447 int i; 448 unsigned int i;
448 449
449 ShapeCheckExtension (dpy, info, (XRectangle *)NULL); 450 ShapeCheckExtension (dpy, info, (XRectangle *)NULL);
450 451
451 LockDisplay (dpy); 452 LockDisplay (dpy);
452 GetReq (ShapeGetRectangles, req); 453 GetReq (ShapeGetRectangles, req);
453 req->reqType = info->codes->major_opcode; 454 req->reqType = info->codes->major_opcode;
454 req->shapeReqType = X_ShapeGetRectangles; 455 req->shapeReqType = X_ShapeGetRectangles;
455 req->window = window; 456 req->window = window;
456 req->kind = kind; 457 req->kind = kind;
457 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 458 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
458 UnlockDisplay (dpy); 459 UnlockDisplay (dpy);
459 SyncHandle (); 460 SyncHandle ();
460 return (XRectangle *)NULL; 461 return (XRectangle *)NULL;
461 } 462 }
462 *count = rep.nrects; 463 *count = rep.nrects;
463 *ordering = rep.ordering; 464 *ordering = rep.ordering;
464 rects = NULL; 465 rects = NULL;
465 if (*count) { 466 if (rep.nrects) {
466 xrects = (xRectangle *) Xmalloc (*count * sizeof (xRectangle)); 467 if (rep.nrects < (INT_MAX / sizeof (XRectangle))) {
467 rects = (XRectangle *) Xmalloc (*count * sizeof (XRectangle)); 468 xrects = Xmalloc (rep.nrects * sizeof (xRectangle));
 469 rects = Xmalloc (rep.nrects * sizeof (XRectangle));
 470 } else {
 471 xrects = NULL;
 472 rects = NULL;
 473 }
468 if (!xrects || !rects) { 474 if (!xrects || !rects) {
469 if (xrects) 475 Xfree (xrects);
470 Xfree (xrects); 476 Xfree (rects);
471 if (rects) 477 _XEatData(dpy, rep.length << 2);
472 Xfree (rects); 
473 _XEatData (dpy, *count * sizeof (xRectangle)); 
474 rects = NULL; 478 rects = NULL;
475 *count = 0; 479 *count = 0;
476 } else { 480 } else {
477 _XRead (dpy, (char *) xrects, *count * sizeof (xRectangle)); 481 _XRead (dpy, (char *) xrects, rep.nrects * sizeof (xRectangle));
478 for (i = 0; i < *count; i++) { 482 for (i = 0; i < rep.nrects; i++) {
479 rects[i].x = (short) cvtINT16toInt (xrects[i].x); 483 rects[i].x = (short) cvtINT16toInt (xrects[i].x);
480 rects[i].y = (short) cvtINT16toInt (xrects[i].y); 484 rects[i].y = (short) cvtINT16toInt (xrects[i].y);
481 rects[i].width = xrects[i].width; 485 rects[i].width = xrects[i].width;
482 rects[i].height = xrects[i].height; 486 rects[i].height = xrects[i].height;
483 } 487 }
484 Xfree (xrects); 488 Xfree (xrects);
485 } 489 }
486 } 490 }
487 UnlockDisplay (dpy); 491 UnlockDisplay (dpy);
488 SyncHandle (); 492 SyncHandle ();
489 return rects; 493 return rects;
490} 494}
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/XSync.c (expand / switch to unified diff)

--- xsrc/external/mit/libXext/dist/src/XSync.c 2008/07/30 02:47:11 1.1.1.1
+++ xsrc/external/mit/libXext/dist/src/XSync.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -52,26 +52,27 @@ PERFORMANCE OF THIS SOFTWARE. @@ -52,26 +52,27 @@ PERFORMANCE OF THIS SOFTWARE.
52******************************************************************/ 52******************************************************************/
53/* $XFree86: xc/lib/Xext/XSync.c,v 1.7tsi Exp $ */ 53/* $XFree86: xc/lib/Xext/XSync.c,v 1.7tsi Exp $ */
54 54
55#ifdef HAVE_CONFIG_H 55#ifdef HAVE_CONFIG_H
56#include <config.h> 56#include <config.h>
57#endif 57#endif
58#include <stdio.h> 58#include <stdio.h>
59#define NEED_EVENTS 59#define NEED_EVENTS
60#define NEED_REPLIES 60#define NEED_REPLIES
61#include <X11/Xlibint.h> 61#include <X11/Xlibint.h>
62#include <X11/extensions/Xext.h> 62#include <X11/extensions/Xext.h>
63#include <X11/extensions/extutil.h> 63#include <X11/extensions/extutil.h>
64#include <X11/extensions/syncstr.h> 64#include <X11/extensions/syncstr.h>
 65#include <limits.h>
65 66
66static XExtensionInfo _sync_info_data; 67static XExtensionInfo _sync_info_data;
67static XExtensionInfo *sync_info = &_sync_info_data; 68static XExtensionInfo *sync_info = &_sync_info_data;
68static char *sync_extension_name = SYNC_NAME; 69static char *sync_extension_name = SYNC_NAME;
69 70
70#define SyncCheckExtension(dpy,i,val) \ 71#define SyncCheckExtension(dpy,i,val) \
71 XextCheckExtension(dpy, i, sync_extension_name, val) 72 XextCheckExtension(dpy, i, sync_extension_name, val)
72#define SyncSimpleCheckExtension(dpy,i) \ 73#define SyncSimpleCheckExtension(dpy,i) \
73 XextSimpleCheckExtension(dpy, i, sync_extension_name) 74 XextSimpleCheckExtension(dpy, i, sync_extension_name)
74 75
75static int close_display(Display *dpy, XExtCodes *codes); 76static int close_display(Display *dpy, XExtCodes *codes);
76static Bool wire_to_event(Display *dpy, XEvent *event, xEvent *wire); 77static Bool wire_to_event(Display *dpy, XEvent *event, xEvent *wire);
77static Status event_to_wire(Display *dpy, XEvent *event, xEvent *wire); 78static Status event_to_wire(Display *dpy, XEvent *event, xEvent *wire);
@@ -273,35 +274,43 @@ XSyncListSystemCounters(Display *dpy, in @@ -273,35 +274,43 @@ XSyncListSystemCounters(Display *dpy, in
273 SyncCheckExtension(dpy, info, NULL); 274 SyncCheckExtension(dpy, info, NULL);
274 275
275 LockDisplay(dpy); 276 LockDisplay(dpy);
276 GetReq(SyncListSystemCounters, req); 277 GetReq(SyncListSystemCounters, req);
277 req->reqType = info->codes->major_opcode; 278 req->reqType = info->codes->major_opcode;
278 req->syncReqType = X_SyncListSystemCounters; 279 req->syncReqType = X_SyncListSystemCounters;
279 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) 280 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
280 goto bail; 281 goto bail;
281 282
282 *n_counters_return = rep.nCounters; 283 *n_counters_return = rep.nCounters;
283 if (rep.nCounters > 0) 284 if (rep.nCounters > 0)
284 { 285 {
285 xSyncSystemCounter *pWireSysCounter, *pNextWireSysCounter; 286 xSyncSystemCounter *pWireSysCounter, *pNextWireSysCounter;
 287 xSyncSystemCounter *pLastWireSysCounter;
286 XSyncCounter counter; 288 XSyncCounter counter;
287 int replylen; 289 int replylen;
288 int i; 290 int i;
289 291
290 list = (XSyncSystemCounter *)Xmalloc( 292 if (rep.nCounters < (INT_MAX / sizeof(XSyncSystemCounter)))
291 rep.nCounters * sizeof(XSyncSystemCounter)); 293 list = Xmalloc(rep.nCounters * sizeof(XSyncSystemCounter));
292 replylen = rep.length << 2; 294 if (rep.length < (INT_MAX >> 2)) {
293 pWireSysCounter = (xSyncSystemCounter *) Xmalloc ((unsigned) replylen + 1); 295 replylen = rep.length << 2;
294 /* +1 to leave room for last null-terminator */ 296 pWireSysCounter = Xmalloc (replylen + sizeof(XSyncCounter));
 297 /* +1 to leave room for last counter read-ahead */
 298 pLastWireSysCounter = (xSyncSystemCounter *)
 299 ((char *)pWireSysCounter) + replylen;
 300 } else {
 301 replylen = 0;
 302 pWireSysCounter = NULL;
 303 }
295 304
296 if ((!list) || (!pWireSysCounter)) 305 if ((!list) || (!pWireSysCounter))
297 { 306 {
298 if (list) Xfree((char *) list); 307 if (list) Xfree((char *) list);
299 if (pWireSysCounter) Xfree((char *) pWireSysCounter); 308 if (pWireSysCounter) Xfree((char *) pWireSysCounter);
300 _XEatData(dpy, (unsigned long) replylen); 309 _XEatData(dpy, (unsigned long) replylen);
301 list = NULL; 310 list = NULL;
302 goto bail; 311 goto bail;
303 } 312 }
304 313
305 _XReadPad(dpy, (char *)pWireSysCounter, replylen); 314 _XReadPad(dpy, (char *)pWireSysCounter, replylen);
306 315
307 counter = pWireSysCounter->counter; 316 counter = pWireSysCounter->counter;
@@ -310,26 +319,34 @@ XSyncListSystemCounters(Display *dpy, in @@ -310,26 +319,34 @@ XSyncListSystemCounters(Display *dpy, in
310 list[i].counter = counter; 319 list[i].counter = counter;
311 XSyncIntsToValue(&list[i].resolution, 320 XSyncIntsToValue(&list[i].resolution,
312 pWireSysCounter->resolution_lo, 321 pWireSysCounter->resolution_lo,
313 pWireSysCounter->resolution_hi); 322 pWireSysCounter->resolution_hi);
314 323
315 /* we may be about to clobber the counter field of the 324 /* we may be about to clobber the counter field of the
316 * next syscounter because we have to add a null terminator 325 * next syscounter because we have to add a null terminator
317 * to the counter name string. So we save the next counter 326 * to the counter name string. So we save the next counter
318 * here. 327 * here.
319 */ 328 */
320 pNextWireSysCounter = (xSyncSystemCounter *) 329 pNextWireSysCounter = (xSyncSystemCounter *)
321 (((char *)pWireSysCounter) + ((SIZEOF(xSyncSystemCounter) + 330 (((char *)pWireSysCounter) + ((SIZEOF(xSyncSystemCounter) +
322 pWireSysCounter->name_length + 3) & ~3)); 331 pWireSysCounter->name_length + 3) & ~3));
 332 /* Make sure we haven't gone too far */
 333 if (pNextWireSysCounter > pLastWireSysCounter) {
 334 Xfree(list);
 335 Xfree(pWireSysCounter);
 336 list = NULL;
 337 goto bail;
 338 }
 339
323 counter = pNextWireSysCounter->counter; 340 counter = pNextWireSysCounter->counter;
324 341
325 list[i].name = ((char *)pWireSysCounter) + 342 list[i].name = ((char *)pWireSysCounter) +
326 SIZEOF(xSyncSystemCounter); 343 SIZEOF(xSyncSystemCounter);
327 /* null-terminate the string */ 344 /* null-terminate the string */
328 *(list[i].name + pWireSysCounter->name_length) = '\0'; 345 *(list[i].name + pWireSysCounter->name_length) = '\0';
329 pWireSysCounter = pNextWireSysCounter; 346 pWireSysCounter = pNextWireSysCounter;
330 } 347 }
331 } 348 }
332 349
333bail: 350bail:
334 UnlockDisplay(dpy); 351 UnlockDisplay(dpy);
335 SyncHandle(); 352 SyncHandle();
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/Xcup.c (expand / switch to unified diff)

--- xsrc/external/mit/libXext/dist/src/Xcup.c 2008/07/30 02:47:11 1.1.1.1
+++ xsrc/external/mit/libXext/dist/src/Xcup.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -29,26 +29,27 @@ in this Software without prior written a @@ -29,26 +29,27 @@ in this Software without prior written a
29#ifdef HAVE_CONFIG_H 29#ifdef HAVE_CONFIG_H
30#include <config.h> 30#include <config.h>
31#endif 31#endif
32#ifdef WIN32 32#ifdef WIN32
33#include <X11/Xwindows.h> 33#include <X11/Xwindows.h>
34#endif 34#endif
35 35
36#define NEED_EVENTS 36#define NEED_EVENTS
37#define NEED_REPLIES 37#define NEED_REPLIES
38#include <X11/Xlibint.h> 38#include <X11/Xlibint.h>
39#include <X11/extensions/Xcupstr.h> 39#include <X11/extensions/Xcupstr.h>
40#include <X11/extensions/Xext.h> 40#include <X11/extensions/Xext.h>
41#include <X11/extensions/extutil.h> 41#include <X11/extensions/extutil.h>
 42#include <limits.h>
42 43
43static XExtensionInfo _xcup_info_data; 44static XExtensionInfo _xcup_info_data;
44static XExtensionInfo *xcup_info = &_xcup_info_data; 45static XExtensionInfo *xcup_info = &_xcup_info_data;
45static char *xcup_extension_name = XCUPNAME; 46static char *xcup_extension_name = XCUPNAME;
46 47
47/***************************************************************************** 48/*****************************************************************************
48 * * 49 * *
49 * private utility routines * 50 * private utility routines *
50 * * 51 * *
51 *****************************************************************************/ 52 *****************************************************************************/
52 53
53static int close_display(Display *dpy, XExtCodes *codes); 54static int close_display(Display *dpy, XExtCodes *codes);
54static /* const */ XExtensionHooks xcup_extension_hooks = { 55static /* const */ XExtensionHooks xcup_extension_hooks = {
@@ -126,35 +127,39 @@ XcupGetReservedColormapEntries( @@ -126,35 +127,39 @@ XcupGetReservedColormapEntries(
126 xXcupGetReservedColormapEntriesReq *req; 127 xXcupGetReservedColormapEntriesReq *req;
127 xColorItem rbuf[TYP_RESERVED_ENTRIES]; 128 xColorItem rbuf[TYP_RESERVED_ENTRIES];
128 129
129 *ncolors = 0; 130 *ncolors = 0;
130 131
131 XextCheckExtension (dpy, info, xcup_extension_name, False); 132 XextCheckExtension (dpy, info, xcup_extension_name, False);
132 133
133 LockDisplay(dpy); 134 LockDisplay(dpy);
134 GetReq(XcupGetReservedColormapEntries, req); 135 GetReq(XcupGetReservedColormapEntries, req);
135 req->reqType = info->codes->major_opcode; 136 req->reqType = info->codes->major_opcode;
136 req->xcupReqType = X_XcupGetReservedColormapEntries; 137 req->xcupReqType = X_XcupGetReservedColormapEntries;
137 req->screen = screen; 138 req->screen = screen;
138 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) { 139 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
139 long nbytes; 140 unsigned long nbytes;
140 xColorItem* rbufp; 141 xColorItem* rbufp;
141 int nentries = rep.length / 3; 142 unsigned int nentries = rep.length / 3;
142 143
143 nbytes = nentries * SIZEOF (xColorItem); 144 if (nentries < (INT_MAX / SIZEOF (xColorItem))) {
144 if (nentries > TYP_RESERVED_ENTRIES) 145 nbytes = nentries * SIZEOF (xColorItem);
145 rbufp = (xColorItem*) Xmalloc (nbytes); 146
146 else 147 if (nentries > TYP_RESERVED_ENTRIES)
147 rbufp = rbuf; 148 rbufp = Xmalloc (nbytes);
 149 else
 150 rbufp = rbuf;
 151 } else
 152 rbufp = NULL;
148 153
149 if (rbufp == NULL) { 154 if (rbufp == NULL) {
150 _XEatData (dpy, (unsigned long) nbytes); 155 _XEatData (dpy, (unsigned long) nbytes);
151 UnlockDisplay (dpy); 156 UnlockDisplay (dpy);
152 SyncHandle (); 157 SyncHandle ();
153 return False; 158 return False;
154 } 159 }
155 _XRead (dpy, (char*) rbufp, nbytes); 160 _XRead (dpy, (char*) rbufp, nbytes);
156 161
157 *colors_out = (XColor*) Xmalloc (nentries * sizeof (XColor)); 162 *colors_out = (XColor*) Xmalloc (nentries * sizeof (XColor));
158 if (*colors_out) { 163 if (*colors_out) {
159 xColorItem* cs = (xColorItem *) rbufp; 164 xColorItem* cs = (xColorItem *) rbufp;
160 XColor* cd = *colors_out; 165 XColor* cd = *colors_out;
@@ -206,44 +211,41 @@ XcupStoreColors( @@ -206,44 +211,41 @@ XcupStoreColors(
206 211
207 for (i = 0, xcp = colors_in_out; i < ncolors; i++, xcp++) { 212 for (i = 0, xcp = colors_in_out; i < ncolors; i++, xcp++) {
208 citem.pixel = xcp->pixel; 213 citem.pixel = xcp->pixel;
209 citem.red = xcp->red; 214 citem.red = xcp->red;
210 citem.green = xcp->green; 215 citem.green = xcp->green;
211 citem.blue = xcp->blue; 216 citem.blue = xcp->blue;
212 217
213 /* note that xColorItem doesn't contain all 16-bit quantities, so 218 /* note that xColorItem doesn't contain all 16-bit quantities, so
214 we can't use Data16 */ 219 we can't use Data16 */
215 Data(dpy, (char *)&citem, (long) SIZEOF(xColorItem)); 220 Data(dpy, (char *)&citem, (long) SIZEOF(xColorItem));
216 } 221 }
217 222
218 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) { 223 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
219 long nbytes; 224 unsigned long nbytes;
220 xColorItem* rbufp; 225 xColorItem* rbufp;
221 xColorItem* cs; 226 xColorItem* cs;
222 int nentries = rep.length / 3; 227 unsigned int nentries = rep.length / 3;
223 
224 nbytes = nentries * SIZEOF (xColorItem); 
225 
226 if (nentries != ncolors) { 
227 _XEatData (dpy, (unsigned long) nbytes); 
228 UnlockDisplay (dpy); 
229 SyncHandle (); 
230 return False; 
231 } 
232 228
233 if (ncolors > 256) 229 if ((nentries == ncolors) &&
234 rbufp = (xColorItem*) Xmalloc (nbytes); 230 (nentries < (INT_MAX / SIZEOF (xColorItem)))) {
235 else 231 nbytes = nentries * SIZEOF (xColorItem);
236 rbufp = rbuf; 232
 233 if (ncolors > 256)
 234 rbufp = Xmalloc (nbytes);
 235 else
 236 rbufp = rbuf;
 237 } else
 238 rbufp = NULL;
237 239
238 if (rbufp == NULL) { 240 if (rbufp == NULL) {
239 _XEatData (dpy, (unsigned long) nbytes); 241 _XEatData (dpy, (unsigned long) nbytes);
240 UnlockDisplay (dpy); 242 UnlockDisplay (dpy);
241 SyncHandle (); 243 SyncHandle ();
242 return False; 244 return False;
243 245
244 } 246 }
245 247
246 _XRead (dpy, (char*) rbufp, nbytes); 248 _XRead (dpy, (char*) rbufp, nbytes);
247 249
248 for (i = 0, xcp = colors_in_out, cs = rbufp; i < ncolors; i++, xcp++, cs++) { 250 for (i = 0, xcp = colors_in_out, cs = rbufp; i < ncolors; i++, xcp++, cs++) {
249 xcp->pixel = cs->pixel; 251 xcp->pixel = cs->pixel;
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXext/dist/src/Xdbe.c (expand / switch to unified diff)

--- xsrc/external/mit/libXext/dist/src/Xdbe.c 2008/07/30 02:47:11 1.1.1.1
+++ xsrc/external/mit/libXext/dist/src/Xdbe.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -349,55 +349,60 @@ XdbeScreenVisualInfo *XdbeGetVisualInfo  @@ -349,55 +349,60 @@ XdbeScreenVisualInfo *XdbeGetVisualInfo
349 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 349 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
350 UnlockDisplay (dpy); 350 UnlockDisplay (dpy);
351 SyncHandle (); 351 SyncHandle ();
352 return NULL; 352 return NULL;
353 } 353 }
354 354
355 /* return the number of screens actually found if we 355 /* return the number of screens actually found if we
356 * requested information about all screens (*num_screens == 0) 356 * requested information about all screens (*num_screens == 0)
357 */ 357 */
358 if (*num_screens == 0) 358 if (*num_screens == 0)
359 *num_screens = rep.m; 359 *num_screens = rep.m;
360 360
361 /* allocate list of visual information to be returned */ 361 /* allocate list of visual information to be returned */
362 if (!(scrVisInfo = 362 if ((*num_screens > 0) && (*num_screens < 65536))
363 (XdbeScreenVisualInfo *)Xmalloc( 363 scrVisInfo = Xmalloc(*num_screens * sizeof(XdbeScreenVisualInfo));
364 (unsigned)(*num_screens * sizeof(XdbeScreenVisualInfo))))) { 364 else
 365 scrVisInfo = NULL;
 366 if (scrVisInfo == NULL) {
 367 _XEatData(dpy, rep.length << 2);
365 UnlockDisplay (dpy); 368 UnlockDisplay (dpy);
366 SyncHandle (); 369 SyncHandle ();
367 return NULL; 370 return NULL;
368 } 371 }
369 372
370 for (i = 0; i < *num_screens; i++) 373 for (i = 0; i < *num_screens; i++)
371 { 374 {
372 int nbytes; 
373 int j; 375 int j;
374 long c; 376 unsigned long c;
375 377
376 _XRead32 (dpy, &c, sizeof(CARD32)); 378 _XRead32 (dpy, (long *) &c, sizeof(CARD32));
377 scrVisInfo[i].count = c; 
378 379
379 nbytes = scrVisInfo[i].count * sizeof(XdbeVisualInfo); 380 if (c < 65536) {
 381 scrVisInfo[i].count = c;
 382 scrVisInfo[i].visinfo = Xmalloc(c * sizeof(XdbeVisualInfo));
 383 } else
 384 scrVisInfo[i].visinfo = NULL;
380 385
381 /* if we can not allocate the list of visual/depth info 386 /* if we can not allocate the list of visual/depth info
382 * then free the lists that we already allocate as well 387 * then free the lists that we already allocate as well
383 * as the visual info list itself 388 * as the visual info list itself
384 */ 389 */
385 if (!(scrVisInfo[i].visinfo = (XdbeVisualInfo *)Xmalloc( 390 if (scrVisInfo[i].visinfo == NULL) {
386 (unsigned)nbytes))) { 
387 for (j = 0; j < i; j++) { 391 for (j = 0; j < i; j++) {
388 Xfree ((char *)scrVisInfo[j].visinfo); 392 Xfree ((char *)scrVisInfo[j].visinfo);
389 } 393 }
390 Xfree ((char *)scrVisInfo); 394 Xfree ((char *)scrVisInfo);
 395 _XEatData(dpy, rep.length << 2);
391 UnlockDisplay (dpy); 396 UnlockDisplay (dpy);
392 SyncHandle (); 397 SyncHandle ();
393 return NULL; 398 return NULL;
394 } 399 }
395  400
396 /* Read the visual info item into the wire structure. Then copy each 401 /* Read the visual info item into the wire structure. Then copy each
397 * element into the library structure. The element sizes and/or 402 * element into the library structure. The element sizes and/or
398 * padding may be different in the two structures. 403 * padding may be different in the two structures.
399 */ 404 */
400 for (j = 0; j < scrVisInfo[i].count; j++) { 405 for (j = 0; j < scrVisInfo[i].count; j++) {
401 xDbeVisInfo xvi; 406 xDbeVisInfo xvi;
402 407
403 _XRead (dpy, (char *)&xvi, sizeof(xDbeVisInfo)); 408 _XRead (dpy, (char *)&xvi, sizeof(xDbeVisInfo));
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXfixes/dist/src/Cursor.c (expand / switch to unified diff)

--- xsrc/external/mit/libXfixes/dist/src/Cursor.c 2008/07/30 02:48:24 1.1.1.1
+++ xsrc/external/mit/libXfixes/dist/src/Cursor.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -36,26 +36,27 @@ @@ -36,26 +36,27 @@
36 * KEITH PACKARD DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, 36 * KEITH PACKARD DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
37 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO 37 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
38 * EVENT SHALL KEITH PACKARD BE LIABLE FOR ANY SPECIAL, INDIRECT OR 38 * EVENT SHALL KEITH PACKARD BE LIABLE FOR ANY SPECIAL, INDIRECT OR
39 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, 39 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
40 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER 40 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
41 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 41 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
42 * PERFORMANCE OF THIS SOFTWARE. 42 * PERFORMANCE OF THIS SOFTWARE.
43 */ 43 */
44 44
45#ifdef HAVE_CONFIG_H 45#ifdef HAVE_CONFIG_H
46#include <config.h> 46#include <config.h>
47#endif 47#endif
48#include "Xfixesint.h" 48#include "Xfixesint.h"
 49#include <limits.h>
49 50
50void 51void
51XFixesSelectCursorInput (Display *dpy, 52XFixesSelectCursorInput (Display *dpy,
52 Window win, 53 Window win,
53 unsigned long eventMask) 54 unsigned long eventMask)
54{ 55{
55 XFixesExtDisplayInfo *info = XFixesFindDisplay (dpy); 56 XFixesExtDisplayInfo *info = XFixesFindDisplay (dpy);
56 xXFixesSelectCursorInputReq *req; 57 xXFixesSelectCursorInputReq *req;
57 58
58 XFixesSimpleCheckExtension (dpy, info); 59 XFixesSimpleCheckExtension (dpy, info);
59 60
60 LockDisplay (dpy); 61 LockDisplay (dpy);
61 GetReq (XFixesSelectCursorInput, req); 62 GetReq (XFixesSelectCursorInput, req);
@@ -63,63 +64,68 @@ XFixesSelectCursorInput (Display *dpy, @@ -63,63 +64,68 @@ XFixesSelectCursorInput (Display *dpy,
63 req->xfixesReqType = X_XFixesSelectCursorInput; 64 req->xfixesReqType = X_XFixesSelectCursorInput;
64 req->window = win; 65 req->window = win;
65 req->eventMask = eventMask; 66 req->eventMask = eventMask;
66 UnlockDisplay (dpy); 67 UnlockDisplay (dpy);
67 SyncHandle (); 68 SyncHandle ();
68} 69}
69 70
70XFixesCursorImage * 71XFixesCursorImage *
71XFixesGetCursorImage (Display *dpy) 72XFixesGetCursorImage (Display *dpy)
72{ 73{
73 XFixesExtDisplayInfo *info = XFixesFindDisplay (dpy); 74 XFixesExtDisplayInfo *info = XFixesFindDisplay (dpy);
74 xXFixesGetCursorImageAndNameReq *req; 75 xXFixesGetCursorImageAndNameReq *req;
75 xXFixesGetCursorImageAndNameReply rep; 76 xXFixesGetCursorImageAndNameReply rep;
76 int npixels; 77 size_t npixels;
77 int nbytes_name; 78 size_t nbytes_name;
78 int nbytes, nread, rlength; 79 size_t nbytes, nread, rlength;
79 XFixesCursorImage *image; 80 XFixesCursorImage *image;
80 char *name; 81 char *name;
81 82
82 XFixesCheckExtension (dpy, info, 0); 83 XFixesCheckExtension (dpy, info, 0);
83 LockDisplay (dpy); 84 LockDisplay (dpy);
84 GetReq (XFixesGetCursorImageAndName, req); 85 GetReq (XFixesGetCursorImageAndName, req);
85 req->reqType = info->codes->major_opcode; 86 req->reqType = info->codes->major_opcode;
86 if (info->major_version >= 2) 87 if (info->major_version >= 2)
87 req->xfixesReqType = X_XFixesGetCursorImageAndName; 88 req->xfixesReqType = X_XFixesGetCursorImageAndName;
88 else 89 else
89 req->xfixesReqType = X_XFixesGetCursorImage; 90 req->xfixesReqType = X_XFixesGetCursorImage;
90 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) 91 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
91 { 92 {
92 UnlockDisplay (dpy); 93 UnlockDisplay (dpy);
93 SyncHandle (); 94 SyncHandle ();
94 return 0; 95 return 0;
95 } 96 }
96 if (info->major_version < 2) 97 if (info->major_version < 2)
97 { 98 {
98 rep.cursorName = None; 99 rep.cursorName = None;
99 rep.nbytes = 0; 100 rep.nbytes = 0;
100 } 101 }
101 npixels = rep.width * rep.height; 102 npixels = rep.width * rep.height;
102 nbytes_name = rep.nbytes; 103 nbytes_name = rep.nbytes;
103 /* reply data length */ 104 if ((rep.length < (INT_MAX >> 2)) &&
104 nbytes = (long) rep.length << 2; 105 npixels < (((INT_MAX >> 3) - sizeof (XFixesCursorImage) - 1)
105 /* bytes of actual data in the reply */ 106 - nbytes_name)) {
106 nread = (npixels << 2) + nbytes_name; 107 /* reply data length */
107 /* size of data returned to application */ 108 nbytes = (size_t) rep.length << 2;
108 rlength = (sizeof (XFixesCursorImage) +  109 /* bytes of actual data in the reply */
109 npixels * sizeof (unsigned long) + 110 nread = (npixels << 2) + nbytes_name;
110 nbytes_name + 1); 111 /* size of data returned to application */
111 112 rlength = (sizeof (XFixesCursorImage) +
112 image = (XFixesCursorImage *) Xmalloc (rlength); 113 npixels * sizeof (unsigned long) +
 114 nbytes_name + 1);
 115
 116 image = Xmalloc (rlength);
 117 } else
 118 image = NULL;
113 if (!image) 119 if (!image)
114 { 120 {
115 _XEatData (dpy, nbytes); 121 _XEatData (dpy, nbytes);
116 UnlockDisplay (dpy); 122 UnlockDisplay (dpy);
117 SyncHandle (); 123 SyncHandle ();
118 return 0; 124 return 0;
119 } 125 }
120 image->x = rep.x; 126 image->x = rep.x;
121 image->y = rep.y; 127 image->y = rep.y;
122 image->width = rep.width; 128 image->width = rep.width;
123 image->height = rep.height; 129 image->height = rep.height;
124 image->xhot = rep.xhot; 130 image->xhot = rep.xhot;
125 image->yhot = rep.yhot; 131 image->yhot = rep.yhot;
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXi/dist/src/XGMotion.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XGMotion.c 2009/09/17 03:33:17 1.1.1.1.2.1
+++ xsrc/external/mit/libXi/dist/src/XGMotion.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -49,48 +49,49 @@ SOFTWARE. @@ -49,48 +49,49 @@ SOFTWARE.
49 49
50/*********************************************************************** 50/***********************************************************************
51 * 51 *
52 * XGetDeviceMotionEvents - Get the motion history of an input device. 52 * XGetDeviceMotionEvents - Get the motion history of an input device.
53 * 53 *
54 */ 54 */
55 55
56#include <X11/extensions/XI.h> 56#include <X11/extensions/XI.h>
57#include <X11/extensions/XIproto.h> 57#include <X11/extensions/XIproto.h>
58#include <X11/Xlibint.h> 58#include <X11/Xlibint.h>
59#include <X11/extensions/XInput.h> 59#include <X11/extensions/XInput.h>
60#include <X11/extensions/extutil.h> 60#include <X11/extensions/extutil.h>
61#include "XIint.h" 61#include "XIint.h"
 62#include <limits.h>
62 63
63XDeviceTimeCoord 64XDeviceTimeCoord
64 * XGetDeviceMotionEvents(dpy, dev, start, stop, nEvents, mode, axis_count) 65 * XGetDeviceMotionEvents(dpy, dev, start, stop, nEvents, mode, axis_count)
65 register Display * 66 register Display *
66 dpy; 67 dpy;
67 XDevice * 68 XDevice *
68 dev; 69 dev;
69 70
70Time start; 71Time start;
71Time stop; 72Time stop;
72 int * 73 int *
73 nEvents; 74 nEvents;
74 int * 75 int *
75 mode; 76 mode;
76 int * 77 int *
77 axis_count; 78 axis_count;
78{ 79{
79 xGetDeviceMotionEventsReq *req; 80 xGetDeviceMotionEventsReq *req;
80 xGetDeviceMotionEventsReply rep; 81 xGetDeviceMotionEventsReply rep;
81 XDeviceTimeCoord *tc; 82 XDeviceTimeCoord *tc;
82 int *data, *bufp, *readp, *savp; 83 int *data, *bufp, *readp, *savp;
83 long size, size2; 84 unsigned long size;
84 int i, j; 85 int i, j;
85 XExtDisplayInfo *info = XInput_find_display(dpy); 86 XExtDisplayInfo *info = XInput_find_display(dpy);
86 87
87 LockDisplay(dpy); 88 LockDisplay(dpy);
88 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1) 89 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
89 return ((XDeviceTimeCoord *) NoSuchExtension); 90 return ((XDeviceTimeCoord *) NoSuchExtension);
90 91
91 GetReq(GetDeviceMotionEvents, req); 92 GetReq(GetDeviceMotionEvents, req);
92 req->reqType = info->codes->major_opcode; 93 req->reqType = info->codes->major_opcode;
93 req->ReqType = X_GetDeviceMotionEvents; 94 req->ReqType = X_GetDeviceMotionEvents;
94 req->start = start; 95 req->start = start;
95 req->stop = stop; 96 req->stop = stop;
96 req->deviceid = dev->device_id; 97 req->deviceid = dev->device_id;
@@ -100,30 +101,41 @@ Time stop; @@ -100,30 +101,41 @@ Time stop;
100 SyncHandle(); 101 SyncHandle();
101 *nEvents = 0; 102 *nEvents = 0;
102 return (NULL); 103 return (NULL);
103 } 104 }
104 105
105 *mode = rep.mode; 106 *mode = rep.mode;
106 *axis_count = rep.axes; 107 *axis_count = rep.axes;
107 *nEvents = rep.nEvents; 108 *nEvents = rep.nEvents;
108 if (!rep.nEvents) { 109 if (!rep.nEvents) {
109 UnlockDisplay(dpy); 110 UnlockDisplay(dpy);
110 SyncHandle(); 111 SyncHandle();
111 return (NULL); 112 return (NULL);
112 } 113 }
113 size = rep.length << 2; 114 if (rep.length < (INT_MAX >> 2)) {
114 size2 = rep.nEvents * (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int))); 115 size = rep.length << 2;
115 savp = readp = (int *)Xmalloc(size); 116 savp = readp = Xmalloc(size);
116 bufp = (int *)Xmalloc(size2); 117 } else {
 118 size = 0;
 119 savp = readp = NULL;
 120 }
 121 /* rep.axes is a CARD8, so assume max number of axes for bounds check */
 122 if (rep.nEvents <
 123 (INT_MAX / (sizeof(XDeviceTimeCoord) + (UCHAR_MAX * sizeof(int))))) {
 124 size_t bsize = rep.nEvents *
 125 (sizeof(XDeviceTimeCoord) + (rep.axes * sizeof(int)));
 126 bufp = Xmalloc(bsize);
 127 } else
 128 bufp = NULL;
117 if (!bufp || !savp) { 129 if (!bufp || !savp) {
118 Xfree(bufp); 130 Xfree(bufp);
119 Xfree(savp); 131 Xfree(savp);
120 *nEvents = 0; 132 *nEvents = 0;
121 _XEatData(dpy, (unsigned long)size); 133 _XEatData(dpy, (unsigned long)size);
122 UnlockDisplay(dpy); 134 UnlockDisplay(dpy);
123 SyncHandle(); 135 SyncHandle();
124 return (NULL); 136 return (NULL);
125 } 137 }
126 _XRead(dpy, (char *)readp, size); 138 _XRead(dpy, (char *)readp, size);
127 139
128 tc = (XDeviceTimeCoord *) bufp; 140 tc = (XDeviceTimeCoord *) bufp;
129 data = (int *)(tc + rep.nEvents); 141 data = (int *)(tc + rep.nEvents);
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXi/dist/src/XGetDCtl.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XGetDCtl.c 2009/09/17 03:33:17 1.1.1.1.2.1
+++ xsrc/external/mit/libXi/dist/src/XGetDCtl.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -50,61 +50,64 @@ SOFTWARE. @@ -50,61 +50,64 @@ SOFTWARE.
50/*********************************************************************** 50/***********************************************************************
51 * 51 *
52 * XGetDeviceControl - get the Device control state of an extension device. 52 * XGetDeviceControl - get the Device control state of an extension device.
53 * 53 *
54 */ 54 */
55 55
56#include <X11/extensions/XI.h> 56#include <X11/extensions/XI.h>
57#include <X11/extensions/XIproto.h> 57#include <X11/extensions/XIproto.h>
58#include <X11/Xlibint.h> 58#include <X11/Xlibint.h>
59#include <X11/Xlib.h> 59#include <X11/Xlib.h>
60#include <X11/extensions/XInput.h> 60#include <X11/extensions/XInput.h>
61#include <X11/extensions/extutil.h> 61#include <X11/extensions/extutil.h>
62#include "XIint.h" 62#include "XIint.h"
 63#include <limits.h>
63 64
64XDeviceControl * 65XDeviceControl *
65XGetDeviceControl(dpy, dev, control) 66XGetDeviceControl(dpy, dev, control)
66 register Display *dpy; 67 register Display *dpy;
67 XDevice *dev; 68 XDevice *dev;
68 int control; 69 int control;
69{ 70{
70 int size = 0; 
71 int nbytes, i; 
72 XDeviceControl *Device = NULL; 71 XDeviceControl *Device = NULL;
73 XDeviceControl *Sav = NULL; 72 XDeviceControl *Sav = NULL;
74 xDeviceState *d = NULL; 73 xDeviceState *d = NULL;
75 xDeviceState *sav = NULL; 74 xDeviceState *sav = NULL;
76 xGetDeviceControlReq *req; 75 xGetDeviceControlReq *req;
77 xGetDeviceControlReply rep; 76 xGetDeviceControlReply rep;
78 XExtDisplayInfo *info = XInput_find_display(dpy); 77 XExtDisplayInfo *info = XInput_find_display(dpy);
79 78
80 LockDisplay(dpy); 79 LockDisplay(dpy);
81 if (_XiCheckExtInit(dpy, XInput_Add_XChangeDeviceControl, info) == -1) 80 if (_XiCheckExtInit(dpy, XInput_Add_XChangeDeviceControl, info) == -1)
82 return ((XDeviceControl *) NoSuchExtension); 81 return ((XDeviceControl *) NoSuchExtension);
83 82
84 GetReq(GetDeviceControl, req); 83 GetReq(GetDeviceControl, req);
85 req->reqType = info->codes->major_opcode; 84 req->reqType = info->codes->major_opcode;
86 req->ReqType = X_GetDeviceControl; 85 req->ReqType = X_GetDeviceControl;
87 req->deviceid = dev->device_id; 86 req->deviceid = dev->device_id;
88 req->control = control; 87 req->control = control;
89 88
90 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) { 89 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
91 UnlockDisplay(dpy); 90 UnlockDisplay(dpy);
92 SyncHandle(); 91 SyncHandle();
93 return (XDeviceControl *) NULL; 92 return (XDeviceControl *) NULL;
94 } 93 }
95 if (rep.length > 0) { 94 if (rep.length > 0) {
96 nbytes = (long)rep.length << 2; 95 unsigned long nbytes;
97 d = (xDeviceState *) Xmalloc((unsigned)nbytes); 96 size_t size = 0;
 97 if (rep.length < (INT_MAX >> 2)) {
 98 nbytes = (unsigned long) rep.length << 2;
 99 d = Xmalloc(nbytes);
 100 }
98 if (!d) { 101 if (!d) {
99 _XEatData(dpy, (unsigned long)nbytes); 102 _XEatData(dpy, (unsigned long)nbytes);
100 UnlockDisplay(dpy); 103 UnlockDisplay(dpy);
101 SyncHandle(); 104 SyncHandle();
102 return (XDeviceControl *) NULL; 105 return (XDeviceControl *) NULL;
103 } 106 }
104 sav = d; 107 sav = d;
105 _XRead(dpy, (char *)d, nbytes); 108 _XRead(dpy, (char *)d, nbytes);
106 109
107 /* In theory, we should just be able to use d->length to get the size. 110 /* In theory, we should just be able to use d->length to get the size.
108 * Turns out that a number of X servers (up to and including server 111 * Turns out that a number of X servers (up to and including server
109 * 1.4) sent the wrong length value down the wire. So to not break 112 * 1.4) sent the wrong length value down the wire. So to not break
110 * apps that run against older servers, we have to calculate the size 113 * apps that run against older servers, we have to calculate the size
@@ -145,26 +148,27 @@ XGetDeviceControl(dpy, dev, control) @@ -145,26 +148,27 @@ XGetDeviceControl(dpy, dev, control)
145 UnlockDisplay(dpy); 148 UnlockDisplay(dpy);
146 SyncHandle(); 149 SyncHandle();
147 return (XDeviceControl *) NULL; 150 return (XDeviceControl *) NULL;
148 } 151 }
149 Sav = Device; 152 Sav = Device;
150 153
151 d = sav; 154 d = sav;
152 switch (control) { 155 switch (control) {
153 case DEVICE_RESOLUTION: 156 case DEVICE_RESOLUTION:
154 { 157 {
155 int *iptr, *iptr2; 158 int *iptr, *iptr2;
156 xDeviceResolutionState *r; 159 xDeviceResolutionState *r;
157 XDeviceResolutionState *R; 160 XDeviceResolutionState *R;
 161 unsigned int i;
158 162
159 r = (xDeviceResolutionState *) d; 163 r = (xDeviceResolutionState *) d;
160 R = (XDeviceResolutionState *) Device; 164 R = (XDeviceResolutionState *) Device;
161 165
162 R->control = DEVICE_RESOLUTION; 166 R->control = DEVICE_RESOLUTION;
163 R->length = sizeof(XDeviceResolutionState); 167 R->length = sizeof(XDeviceResolutionState);
164 R->num_valuators = r->num_valuators; 168 R->num_valuators = r->num_valuators;
165 iptr = (int *)(R + 1); 169 iptr = (int *)(R + 1);
166 iptr2 = (int *)(r + 1); 170 iptr2 = (int *)(r + 1);
167 R->resolutions = iptr; 171 R->resolutions = iptr;
168 R->min_resolutions = iptr + R->num_valuators; 172 R->min_resolutions = iptr + R->num_valuators;
169 R->max_resolutions = iptr + (2 * R->num_valuators); 173 R->max_resolutions = iptr + (2 * R->num_valuators);
170 for (i = 0; i < (3 * R->num_valuators); i++) 174 for (i = 0; i < (3 * R->num_valuators); i++)
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XGetBMap.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XGetBMap.c 2008/07/30 02:50:11 1.1.1.1
+++ xsrc/external/mit/libXi/dist/src/XGetBMap.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -49,58 +49,63 @@ SOFTWARE. @@ -49,58 +49,63 @@ SOFTWARE.
49 49
50/*********************************************************************** 50/***********************************************************************
51 * 51 *
52 * XGetDeviceButtonMapping - Get the button mapping of an extension device. 52 * XGetDeviceButtonMapping - Get the button mapping of an extension device.
53 * 53 *
54 */ 54 */
55 55
56#include <X11/extensions/XI.h> 56#include <X11/extensions/XI.h>
57#include <X11/extensions/XIproto.h> 57#include <X11/extensions/XIproto.h>
58#include <X11/Xlibint.h> 58#include <X11/Xlibint.h>
59#include <X11/extensions/XInput.h> 59#include <X11/extensions/XInput.h>
60#include <X11/extensions/extutil.h> 60#include <X11/extensions/extutil.h>
61#include "XIint.h" 61#include "XIint.h"
 62#include <limits.h>
62 63
63#ifdef MIN /* some systems define this in <sys/param.h> */ 64#ifdef MIN /* some systems define this in <sys/param.h> */
64#undef MIN 65#undef MIN
65#endif 66#endif
66#define MIN(a, b) ((a) < (b) ? (a) : (b)) 67#define MIN(a, b) ((a) < (b) ? (a) : (b))
67 68
68int 69int
69XGetDeviceButtonMapping(dpy, device, map, nmap) 70XGetDeviceButtonMapping(dpy, device, map, nmap)
70 register Display *dpy; 71 register Display *dpy;
71 XDevice *device; 72 XDevice *device;
72 unsigned char map[]; 73 unsigned char map[];
73 unsigned int nmap; 74 unsigned int nmap;
74{ 75{
75 int status = 0; 76 int status = 0;
76 unsigned char mapping[256]; /* known fixed size */ 77 unsigned char mapping[256]; /* known fixed size */
77 long nbytes; 
78 XExtDisplayInfo *info = XInput_find_display(dpy); 78 XExtDisplayInfo *info = XInput_find_display(dpy);
79 79
80 register xGetDeviceButtonMappingReq *req; 80 register xGetDeviceButtonMappingReq *req;
81 xGetDeviceButtonMappingReply rep; 81 xGetDeviceButtonMappingReply rep;
82 82
83 LockDisplay(dpy); 83 LockDisplay(dpy);
84 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1) 84 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
85 return (NoSuchExtension); 85 return (NoSuchExtension);
86 GetReq(GetDeviceButtonMapping, req); 86 GetReq(GetDeviceButtonMapping, req);
87 87
88 req->reqType = info->codes->major_opcode; 88 req->reqType = info->codes->major_opcode;
89 req->ReqType = X_GetDeviceButtonMapping; 89 req->ReqType = X_GetDeviceButtonMapping;
90 req->deviceid = device->device_id; 90 req->deviceid = device->device_id;
91 91
92 status = _XReply(dpy, (xReply *) & rep, 0, xFalse); 92 status = _XReply(dpy, (xReply *) & rep, 0, xFalse);
93 if (status == 1) { 93 if (status == 1) {
94 nbytes = (long)rep.length << 2; 94 if (rep.length <= (sizeof(mapping) >> 2)) {
95 _XRead(dpy, (char *)mapping, nbytes); 95 unsigned long nbytes = rep.length << 2;
96 96 _XRead(dpy, (char *)mapping, nbytes);
97 /* don't return more data than the user asked for. */ 97
98 if (rep.nElts) 98 /* don't return more data than the user asked for. */
99 memcpy((char *)map, (char *)mapping, MIN((int)rep.nElts, nmap)); 99 if (rep.nElts)
100 status = rep.nElts; 100 memcpy(map, mapping, MIN((int)rep.nElts, nmap));
 101 status = rep.nElts;
 102 } else {
 103 _XEatData(dpy, rep.length << 2);
 104 status = 0;
 105 }
101 } else 106 } else
102 status = 0; 107 status = 0;
103 UnlockDisplay(dpy); 108 UnlockDisplay(dpy);
104 SyncHandle(); 109 SyncHandle();
105 return (status); 110 return (status);
106} 111}
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XGetFCtl.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XGetFCtl.c 2008/07/30 02:50:11 1.1.1.1
+++ xsrc/external/mit/libXi/dist/src/XGetFCtl.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -50,108 +50,116 @@ SOFTWARE. @@ -50,108 +50,116 @@ SOFTWARE.
50/*********************************************************************** 50/***********************************************************************
51 * 51 *
52 * XGetFeedbackControl - get the feedback attributes of an extension device. 52 * XGetFeedbackControl - get the feedback attributes of an extension device.
53 * 53 *
54 */ 54 */
55 55
56#include <X11/extensions/XI.h> 56#include <X11/extensions/XI.h>
57#include <X11/extensions/XIproto.h> 57#include <X11/extensions/XIproto.h>
58#include <X11/Xlibint.h> 58#include <X11/Xlibint.h>
59#include <X11/Xlib.h> 59#include <X11/Xlib.h>
60#include <X11/extensions/XInput.h> 60#include <X11/extensions/XInput.h>
61#include <X11/extensions/extutil.h> 61#include <X11/extensions/extutil.h>
62#include "XIint.h" 62#include "XIint.h"
 63#include <limits.h>
63 64
64XFeedbackState * 65XFeedbackState *
65XGetFeedbackControl(dpy, dev, num_feedbacks) 66XGetFeedbackControl(dpy, dev, num_feedbacks)
66 register Display *dpy; 67 register Display *dpy;
67 XDevice *dev; 68 XDevice *dev;
68 int *num_feedbacks; 69 int *num_feedbacks;
69{ 70{
70 int size = 0; 
71 int nbytes, i; 
72 XFeedbackState *Feedback = NULL; 71 XFeedbackState *Feedback = NULL;
73 XFeedbackState *Sav = NULL; 72 XFeedbackState *Sav = NULL;
74 xFeedbackState *f = NULL; 73 xFeedbackState *f = NULL;
75 xFeedbackState *sav = NULL; 74 xFeedbackState *sav = NULL;
76 xGetFeedbackControlReq *req; 75 xGetFeedbackControlReq *req;
77 xGetFeedbackControlReply rep; 76 xGetFeedbackControlReply rep;
78 XExtDisplayInfo *info = XInput_find_display(dpy); 77 XExtDisplayInfo *info = XInput_find_display(dpy);
79 78
80 LockDisplay(dpy); 79 LockDisplay(dpy);
81 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1) 80 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
82 return ((XFeedbackState *) NoSuchExtension); 81 return ((XFeedbackState *) NoSuchExtension);
83 82
84 GetReq(GetFeedbackControl, req); 83 GetReq(GetFeedbackControl, req);
85 req->reqType = info->codes->major_opcode; 84 req->reqType = info->codes->major_opcode;
86 req->ReqType = X_GetFeedbackControl; 85 req->ReqType = X_GetFeedbackControl;
87 req->deviceid = dev->device_id; 86 req->deviceid = dev->device_id;
88 87
89 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) { 88 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
90 UnlockDisplay(dpy); 89 goto out;
91 SyncHandle(); 90
92 return (XFeedbackState *) NULL; 
93 } 
94 if (rep.length > 0) { 91 if (rep.length > 0) {
 92 unsigned long nbytes;
 93 size_t size = 0;
 94 int i;
 95
95 *num_feedbacks = rep.num_feedbacks; 96 *num_feedbacks = rep.num_feedbacks;
96 nbytes = (long)rep.length << 2; 97
97 f = (xFeedbackState *) Xmalloc((unsigned)nbytes); 98 if (rep.length < (INT_MAX >> 2)) {
 99 nbytes = rep.length << 2;
 100 f = Xmalloc(nbytes);
 101 }
98 if (!f) { 102 if (!f) {
99 _XEatData(dpy, (unsigned long)nbytes); 103 _XEatData(dpy, (unsigned long)nbytes);
100 UnlockDisplay(dpy); 104 goto out;
101 SyncHandle(); 
102 return (XFeedbackState *) NULL; 
103 } 105 }
104 sav = f; 106 sav = f;
105 _XRead(dpy, (char *)f, nbytes); 107 _XRead(dpy, (char *)f, nbytes);
106 108
107 for (i = 0; i < *num_feedbacks; i++) { 109 for (i = 0; i < *num_feedbacks; i++) {
 110 if (f->length > nbytes)
 111 goto out;
 112 nbytes -= f->length;
 113
108 switch (f->class) { 114 switch (f->class) {
109 case KbdFeedbackClass: 115 case KbdFeedbackClass:
110 size += sizeof(XKbdFeedbackState); 116 size += sizeof(XKbdFeedbackState);
111 break; 117 break;
112 case PtrFeedbackClass: 118 case PtrFeedbackClass:
113 size += sizeof(XPtrFeedbackState); 119 size += sizeof(XPtrFeedbackState);
114 break; 120 break;
115 case IntegerFeedbackClass: 121 case IntegerFeedbackClass:
116 size += sizeof(XIntegerFeedbackState); 122 size += sizeof(XIntegerFeedbackState);
117 break; 123 break;
118 case StringFeedbackClass: 124 case StringFeedbackClass:
119 { 125 {
120 xStringFeedbackState *strf = (xStringFeedbackState *) f; 126 xStringFeedbackState *strf = (xStringFeedbackState *) f;
121 127
 128 if (strf->num_syms_supported >= (INT_MAX / sizeof(KeySym)))
 129 goto out;
122 size += sizeof(XStringFeedbackState) + 130 size += sizeof(XStringFeedbackState) +
123 (strf->num_syms_supported * sizeof(KeySym)); 131 (strf->num_syms_supported * sizeof(KeySym));
124 } 132 }
125 break; 133 break;
126 case LedFeedbackClass: 134 case LedFeedbackClass:
127 size += sizeof(XLedFeedbackState); 135 size += sizeof(XLedFeedbackState);
128 break; 136 break;
129 case BellFeedbackClass: 137 case BellFeedbackClass:
130 size += sizeof(XBellFeedbackState); 138 size += sizeof(XBellFeedbackState);
131 break; 139 break;
132 default: 140 default:
133 size += f->length; 141 size += f->length;
134 break; 142 break;
135 } 143 }
 144 if (size > INT_MAX)
 145 goto out;
136 f = (xFeedbackState *) ((char *)f + f->length); 146 f = (xFeedbackState *) ((char *)f + f->length);
137 } 147 }
138 148
139 Feedback = (XFeedbackState *) Xmalloc((unsigned)size); 149 Feedback = (XFeedbackState *) Xmalloc((unsigned)size);
140 if (!Feedback) { 150 if (!Feedback)
141 UnlockDisplay(dpy); 151 goto out;
142 SyncHandle(); 152
143 return (XFeedbackState *) NULL; 
144 } 
145 Sav = Feedback; 153 Sav = Feedback;
146 154
147 f = sav; 155 f = sav;
148 for (i = 0; i < *num_feedbacks; i++) { 156 for (i = 0; i < *num_feedbacks; i++) {
149 switch (f->class) { 157 switch (f->class) {
150 case KbdFeedbackClass: 158 case KbdFeedbackClass:
151 { 159 {
152 xKbdFeedbackState *k; 160 xKbdFeedbackState *k;
153 XKbdFeedbackState *K; 161 XKbdFeedbackState *K;
154 162
155 k = (xKbdFeedbackState *) f; 163 k = (xKbdFeedbackState *) f;
156 K = (XKbdFeedbackState *) Feedback; 164 K = (XKbdFeedbackState *) Feedback;
157 165
@@ -246,27 +254,28 @@ XGetFeedbackControl(dpy, dev, num_feedba @@ -246,27 +254,28 @@ XGetFeedbackControl(dpy, dev, num_feedba
246 B->length = sizeof(XBellFeedbackState); 254 B->length = sizeof(XBellFeedbackState);
247 B->id = b->id; 255 B->id = b->id;
248 B->percent = b->percent; 256 B->percent = b->percent;
249 B->pitch = b->pitch; 257 B->pitch = b->pitch;
250 B->duration = b->duration; 258 B->duration = b->duration;
251 break; 259 break;
252 } 260 }
253 default: 261 default:
254 break; 262 break;
255 } 263 }
256 f = (xFeedbackState *) ((char *)f + f->length); 264 f = (xFeedbackState *) ((char *)f + f->length);
257 Feedback = (XFeedbackState *) ((char *)Feedback + Feedback->length); 265 Feedback = (XFeedbackState *) ((char *)Feedback + Feedback->length);
258 } 266 }
259 XFree((char *)sav); 
260 } 267 }
 268out:
 269 XFree((char *)sav);
261 270
262 UnlockDisplay(dpy); 271 UnlockDisplay(dpy);
263 SyncHandle(); 272 SyncHandle();
264 return (Sav); 273 return (Sav);
265} 274}
266 275
267void 276void
268XFreeFeedbackList(list) 277XFreeFeedbackList(list)
269 XFeedbackState *list; 278 XFeedbackState *list;
270{ 279{
271 XFree((char *)list); 280 XFree((char *)list);
272} 281}
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XGetProp.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XGetProp.c 2008/07/30 02:50:11 1.1.1.1
+++ xsrc/external/mit/libXi/dist/src/XGetProp.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -50,26 +50,27 @@ SOFTWARE. @@ -50,26 +50,27 @@ SOFTWARE.
50/*********************************************************************** 50/***********************************************************************
51 * 51 *
52 * XGetDeviceDontPropagateList - Get the dont_propagate_list for a 52 * XGetDeviceDontPropagateList - Get the dont_propagate_list for a
53 * window. 53 * window.
54 * 54 *
55 */ 55 */
56 56
57#include <X11/extensions/XI.h> 57#include <X11/extensions/XI.h>
58#include <X11/extensions/XIproto.h> 58#include <X11/extensions/XIproto.h>
59#include <X11/Xlibint.h> 59#include <X11/Xlibint.h>
60#include <X11/extensions/XInput.h> 60#include <X11/extensions/XInput.h>
61#include <X11/extensions/extutil.h> 61#include <X11/extensions/extutil.h>
62#include "XIint.h" 62#include "XIint.h"
 63#include <limits.h>
63 64
64XEventClass * 65XEventClass *
65XGetDeviceDontPropagateList(dpy, window, count) 66XGetDeviceDontPropagateList(dpy, window, count)
66 register Display *dpy; 67 register Display *dpy;
67 68
68Window window; 69Window window;
69 int *count; 70 int *count;
70{ 71{
71 XEventClass *list = NULL; 72 XEventClass *list = NULL;
72 int rlen; 73 int rlen;
73 xGetDeviceDontPropagateListReq *req; 74 xGetDeviceDontPropagateListReq *req;
74 xGetDeviceDontPropagateListReply rep; 75 xGetDeviceDontPropagateListReply rep;
75 XExtDisplayInfo *info = XInput_find_display(dpy); 76 XExtDisplayInfo *info = XInput_find_display(dpy);
@@ -80,31 +81,33 @@ Window window; @@ -80,31 +81,33 @@ Window window;
80 81
81 GetReq(GetDeviceDontPropagateList, req); 82 GetReq(GetDeviceDontPropagateList, req);
82 req->reqType = info->codes->major_opcode; 83 req->reqType = info->codes->major_opcode;
83 req->ReqType = X_GetDeviceDontPropagateList; 84 req->ReqType = X_GetDeviceDontPropagateList;
84 req->window = window; 85 req->window = window;
85 86
86 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) { 87 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
87 UnlockDisplay(dpy); 88 UnlockDisplay(dpy);
88 SyncHandle(); 89 SyncHandle();
89 return (XEventClass *) NULL; 90 return (XEventClass *) NULL;
90 } 91 }
91 *count = rep.count; 92 *count = rep.count;
92 93
93 if (*count) { 94 if (rep.length != 0) {
 95 if ((rep.count != 0) && (rep.length < (INT_MAX / sizeof(XEventClass))))
 96 list = Xmalloc(rep.length * sizeof(XEventClass));
94 rlen = rep.length << 2; 97 rlen = rep.length << 2;
95 list = (XEventClass *) Xmalloc(rep.length * sizeof(XEventClass)); 98 list = (XEventClass *) Xmalloc(rep.length * sizeof(XEventClass));
96 if (list) { 99 if (list) {
97 int i; 100 unsigned int i;
98 CARD32 ec; 101 CARD32 ec;
99 102
100 /* read and assign each XEventClass separately because 103 /* read and assign each XEventClass separately because
101 * the library representation may not be the same size 104 * the library representation may not be the same size
102 * as the wire representation (64 bit machines) 105 * as the wire representation (64 bit machines)
103 */ 106 */
104 for (i = 0; i < rep.length; i++) { 107 for (i = 0; i < rep.length; i++) {
105 _XRead(dpy, (char *)(&ec), sizeof(CARD32)); 108 _XRead(dpy, (char *)(&ec), sizeof(CARD32));
106 list[i] = (XEventClass) ec; 109 list[i] = (XEventClass) ec;
107 } 110 }
108 } else 111 } else
109 _XEatData(dpy, (unsigned long)rlen); 112 _XEatData(dpy, (unsigned long)rlen);
110 } 113 }
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XListDev.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XListDev.c 2008/07/30 02:50:11 1.1.1.1
+++ xsrc/external/mit/libXi/dist/src/XListDev.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -52,33 +52,34 @@ SOFTWARE. @@ -52,33 +52,34 @@ SOFTWARE.
52 * XListInputDevices - Request the server to return a list of  52 * XListInputDevices - Request the server to return a list of
53 * available input devices. 53 * available input devices.
54 * 54 *
55 */ 55 */
56 56
57#define NEED_REPLIES 57#define NEED_REPLIES
58#define NEED_EVENTS 58#define NEED_EVENTS
59#include <X11/extensions/XI.h> 59#include <X11/extensions/XI.h>
60#include <X11/extensions/XIproto.h> 60#include <X11/extensions/XIproto.h>
61#include <X11/Xlibint.h> 61#include <X11/Xlibint.h>
62#include <X11/extensions/XInput.h> 62#include <X11/extensions/XInput.h>
63#include <X11/extensions/extutil.h> 63#include <X11/extensions/extutil.h>
64#include "XIint.h" 64#include "XIint.h"
 65#include <limits.h>
65 66
66XDeviceInfo * 67XDeviceInfo *
67XListInputDevices(dpy, ndevices) 68XListInputDevices(dpy, ndevices)
68 register Display *dpy; 69 register Display *dpy;
69 int *ndevices; 70 int *ndevices;
70{ 71{
71 int size; 72 size_t size;
72 xListInputDevicesReq *req; 73 xListInputDevicesReq *req;
73 xListInputDevicesReply rep; 74 xListInputDevicesReply rep;
74 xDeviceInfo *list, *slist = NULL; 75 xDeviceInfo *list, *slist = NULL;
75 XDeviceInfo *sclist = NULL; 76 XDeviceInfo *sclist = NULL;
76 XDeviceInfo *clist = NULL; 77 XDeviceInfo *clist = NULL;
77 xAnyClassPtr any, sav_any; 78 xAnyClassPtr any, sav_any;
78 XAnyClassPtr Any; 79 XAnyClassPtr Any;
79 char *nptr, *Nptr; 80 char *nptr, *Nptr;
80 register int i, j, k; 81 register int i, j, k;
81 register long rlen; 82 register long rlen;
82 XExtDisplayInfo *info = XInput_find_display(dpy); 83 XExtDisplayInfo *info = XInput_find_display(dpy);
83 84
84 LockDisplay(dpy); 85 LockDisplay(dpy);
@@ -87,29 +88,30 @@ XListInputDevices(dpy, ndevices) @@ -87,29 +88,30 @@ XListInputDevices(dpy, ndevices)
87 88
88 GetReq(ListInputDevices, req); 89 GetReq(ListInputDevices, req);
89 req->reqType = info->codes->major_opcode; 90 req->reqType = info->codes->major_opcode;
90 req->ReqType = X_ListInputDevices; 91 req->ReqType = X_ListInputDevices;
91 92
92 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) { 93 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) {
93 UnlockDisplay(dpy); 94 UnlockDisplay(dpy);
94 SyncHandle(); 95 SyncHandle();
95 return (XDeviceInfo *) NULL; 96 return (XDeviceInfo *) NULL;
96 } 97 }
97 98
98 if ((*ndevices = rep.ndevices)) { /* at least 1 input device */ 99 if ((*ndevices = rep.ndevices)) { /* at least 1 input device */
99 size = *ndevices * sizeof(XDeviceInfo); 100 size = *ndevices * sizeof(XDeviceInfo);
100 rlen = rep.length << 2; /* multiply length by 4 */ 101 if (rep.length < (INT_MAX >> 2)) {
101 list = (xDeviceInfo *) Xmalloc(rlen); 102 rlen = rep.length << 2; /* multiply length by 4 */
102 slist = list; 103 slist = list = Xmalloc(rlen);
 104 }
103 if (!slist) { 105 if (!slist) {
104 _XEatData(dpy, (unsigned long)rlen); 106 _XEatData(dpy, (unsigned long)rlen);
105 UnlockDisplay(dpy); 107 UnlockDisplay(dpy);
106 SyncHandle(); 108 SyncHandle();
107 return (XDeviceInfo *) NULL; 109 return (XDeviceInfo *) NULL;
108 } 110 }
109 _XRead(dpy, (char *)list, rlen); 111 _XRead(dpy, (char *)list, rlen);
110 112
111 any = (xAnyClassPtr) ((char *)list + (*ndevices * sizeof(xDeviceInfo))); 113 any = (xAnyClassPtr) ((char *)list + (*ndevices * sizeof(xDeviceInfo)));
112 sav_any = any; 114 sav_any = any;
113 for (i = 0; i < *ndevices; i++, list++) { 115 for (i = 0; i < *ndevices; i++, list++) {
114 for (j = 0; j < (int)list->num_classes; j++) { 116 for (j = 0; j < (int)list->num_classes; j++) {
115 switch (any->class) { 117 switch (any->class) {
@@ -125,29 +127,32 @@ XListInputDevices(dpy, ndevices) @@ -125,29 +127,32 @@ XListInputDevices(dpy, ndevices)
125 127
126 v = (xValuatorInfoPtr) any; 128 v = (xValuatorInfoPtr) any;
127 size += sizeof(XValuatorInfo) + 129 size += sizeof(XValuatorInfo) +
128 (v->num_axes * sizeof(XAxisInfo)); 130 (v->num_axes * sizeof(XAxisInfo));
129 break; 131 break;
130 } 132 }
131 default: 133 default:
132 break; 134 break;
133 } 135 }
134 any = (xAnyClassPtr) ((char *)any + any->length); 136 any = (xAnyClassPtr) ((char *)any + any->length);
135 } 137 }
136 } 138 }
137 139
138 for (i = 0, nptr = (char *)any; i < *ndevices; i++) { 140 Nptr = ((unsigned char *)list) + rlen + 1;
 141 for (i = 0, nptr = (unsigned char *)any; i < *ndevices; i++) {
139 size += *nptr + 1; 142 size += *nptr + 1;
140 nptr += (*nptr + 1); 143 nptr += (*nptr + 1);
 144 if (nptr > Nptr)
 145 goto out;
141 } 146 }
142 147
143 clist = (XDeviceInfoPtr) Xmalloc(size); 148 clist = (XDeviceInfoPtr) Xmalloc(size);
144 if (!clist) { 149 if (!clist) {
145 XFree((char *)slist); 150 XFree((char *)slist);
146 UnlockDisplay(dpy); 151 UnlockDisplay(dpy);
147 SyncHandle(); 152 SyncHandle();
148 return (XDeviceInfo *) NULL; 153 return (XDeviceInfo *) NULL;
149 } 154 }
150 sclist = clist; 155 sclist = clist;
151 Any = (XAnyClassPtr) ((char *)clist + 156 Any = (XAnyClassPtr) ((char *)clist +
152 (*ndevices * sizeof(XDeviceInfo))); 157 (*ndevices * sizeof(XDeviceInfo)));
153 list = slist; 158 list = slist;
@@ -204,37 +209,38 @@ XListInputDevices(dpy, ndevices) @@ -204,37 +209,38 @@ XListInputDevices(dpy, ndevices)
204 A->resolution = a->resolution; 209 A->resolution = a->resolution;
205 } 210 }
206 break; 211 break;
207 } 212 }
208 default: 213 default:
209 break; 214 break;
210 } 215 }
211 any = (xAnyClassPtr) ((char *)any + any->length); 216 any = (xAnyClassPtr) ((char *)any + any->length);
212 Any = (XAnyClassPtr) ((char *)Any + Any->length); 217 Any = (XAnyClassPtr) ((char *)Any + Any->length);
213 } 218 }
214 } 219 }
215 220
216 clist = sclist; 221 clist = sclist;
217 nptr = (char *)any; 222 nptr = (unsigned char *)any;
218 Nptr = (char *)Any; 223 Nptr = (unsigned char *)Any;
219 for (i = 0; i < *ndevices; i++, clist++) { 224 for (i = 0; i < *ndevices; i++, clist++) {
220 clist->name = (char *)Nptr; 225 clist->name = (char *)Nptr;
221 memcpy(Nptr, nptr + 1, *nptr); 226 memcpy(Nptr, nptr + 1, *nptr);
222 Nptr += (*nptr); 227 Nptr += (*nptr);
223 *Nptr++ = '\0'; 228 *Nptr++ = '\0';
224 nptr += (*nptr + 1); 229 nptr += (*nptr + 1);
225 } 230 }
226 } 231 }
227 232
 233 out:
228 XFree((char *)slist); 234 XFree((char *)slist);
229 UnlockDisplay(dpy); 235 UnlockDisplay(dpy);
230 SyncHandle(); 236 SyncHandle();
231 return (sclist); 237 return (sclist);
232} 238}
233 239
234/*********************************************************************** 240/***********************************************************************
235 * 241 *
236 * Free the list of input devices. 242 * Free the list of input devices.
237 * 243 *
238 */ 244 */
239 245
240void 246void
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXi/dist/src/XQueryDv.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XQueryDv.c 2008/07/30 02:50:11 1.1.1.1
+++ xsrc/external/mit/libXi/dist/src/XQueryDv.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -49,92 +49,92 @@ SOFTWARE. @@ -49,92 +49,92 @@ SOFTWARE.
49 49
50/*********************************************************************** 50/***********************************************************************
51 * 51 *
52 * XQueryDeviceState - Query the state of an extension input device. 52 * XQueryDeviceState - Query the state of an extension input device.
53 * 53 *
54 */ 54 */
55 55
56#include <X11/extensions/XI.h> 56#include <X11/extensions/XI.h>
57#include <X11/extensions/XIproto.h> 57#include <X11/extensions/XIproto.h>
58#include <X11/Xlibint.h> 58#include <X11/Xlibint.h>
59#include <X11/extensions/XInput.h> 59#include <X11/extensions/XInput.h>
60#include <X11/extensions/extutil.h> 60#include <X11/extensions/extutil.h>
61#include "XIint.h" 61#include "XIint.h"
 62#include <limits.h>
62 63
63XDeviceState * 64XDeviceState *
64XQueryDeviceState(dpy, dev) 65XQueryDeviceState(dpy, dev)
65 register Display *dpy; 66 register Display *dpy;
66 XDevice *dev; 67 XDevice *dev;
67{ 68{
68 int i, j; 69 int i, j;
69 int rlen; 70 unsigned long rlen;
70 int size = 0; 71 size_t size = 0;
71 xQueryDeviceStateReq *req; 72 xQueryDeviceStateReq *req;
72 xQueryDeviceStateReply rep; 73 xQueryDeviceStateReply rep;
73 XDeviceState *state = NULL; 74 XDeviceState *state = NULL;
74 XInputClass *any, *Any; 75 XInputClass *any, *Any;
75 char *data; 76 char *data = NULL;
76 XExtDisplayInfo *info = XInput_find_display(dpy); 77 XExtDisplayInfo *info = XInput_find_display(dpy);
77 78
78 LockDisplay(dpy); 79 LockDisplay(dpy);
79 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1) 80 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
80 return ((XDeviceState *) NoSuchExtension); 81 return ((XDeviceState *) NoSuchExtension);
81 82
82 GetReq(QueryDeviceState, req); 83 GetReq(QueryDeviceState, req);
83 req->reqType = info->codes->major_opcode; 84 req->reqType = info->codes->major_opcode;
84 req->ReqType = X_QueryDeviceState; 85 req->ReqType = X_QueryDeviceState;
85 req->deviceid = dev->device_id; 86 req->deviceid = dev->device_id;
86 87
87 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse)) { 88 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse))
88 UnlockDisplay(dpy); 89 goto out;
89 SyncHandle(); 
90 return (XDeviceState *) NULL; 
91 } 
92 90
93 rlen = rep.length << 2; 91 if (rep.length > 0) {
94 if (rlen > 0) { 92 if (rep.length < (INT_MAX >> 2)) {
95 data = Xmalloc(rlen); 93 rlen = (unsigned long) rep.length << 2;
 94 data = Xmalloc(rlen);
 95 }
96 if (!data) { 96 if (!data) {
97 _XEatData(dpy, (unsigned long)rlen); 97 _XEatData(dpy, (unsigned long)rlen);
98 UnlockDisplay(dpy); 98 goto out;
99 SyncHandle(); 
100 return ((XDeviceState *) NULL); 
101 } 99 }
102 _XRead(dpy, data, rlen); 100 _XRead(dpy, data, rlen);
103 101
104 for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) { 102 for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) {
 103 if (any->length > rlen)
 104 goto out;
 105 rlen -= any->length;
 106
105 switch (any->class) { 107 switch (any->class) {
106 case KeyClass: 108 case KeyClass:
107 size += sizeof(XKeyState); 109 size += sizeof(XKeyState);
108 break; 110 break;
109 case ButtonClass: 111 case ButtonClass:
110 size += sizeof(XButtonState); 112 size += sizeof(XButtonState);
111 break; 113 break;
112 case ValuatorClass: 114 case ValuatorClass:
113 { 115 {
114 xValuatorState *v = (xValuatorState *) any; 116 xValuatorState *v = (xValuatorState *) any;
115 size += (sizeof(XValuatorState) + 117 size += (sizeof(XValuatorState) +
116 (v->num_valuators * sizeof(int))); 118 (v->num_valuators * sizeof(int)));
117 } 119 }
118 break; 120 break;
119 } 121 }
120 any = (XInputClass *) ((char *)any + any->length); 122 any = (XInputClass *) ((char *)any + any->length);
121 } 123 }
122 state = (XDeviceState *) Xmalloc(size + sizeof(XDeviceState)); 124 state = (XDeviceState *) Xmalloc(size + sizeof(XDeviceState));
123 if (!state) { 125 if (!state)
124 UnlockDisplay(dpy); 126 goto out;
125 SyncHandle(); 127
126 return ((XDeviceState *) NULL); 
127 } 
128 state->device_id = dev->device_id; 128 state->device_id = dev->device_id;
129 state->num_classes = rep.num_classes; 129 state->num_classes = rep.num_classes;
130 state->data = (XInputClass *) (state + 1); 130 state->data = (XInputClass *) (state + 1);
131 131
132 Any = state->data; 132 Any = state->data;
133 for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) { 133 for (i = 0, any = (XInputClass *) data; i < (int)rep.num_classes; i++) {
134 switch (any->class) { 134 switch (any->class) {
135 case KeyClass: 135 case KeyClass:
136 { 136 {
137 xKeyState *k = (xKeyState *) any; 137 xKeyState *k = (xKeyState *) any;
138 XKeyState *K = (XKeyState *) Any; 138 XKeyState *K = (XKeyState *) Any;
139 139
140 K->class = k->class; 140 K->class = k->class;
@@ -153,41 +153,43 @@ XQueryDeviceState(dpy, dev) @@ -153,41 +153,43 @@ XQueryDeviceState(dpy, dev)
153 B->length = sizeof(XButtonState); 153 B->length = sizeof(XButtonState);
154 B->num_buttons = b->num_buttons; 154 B->num_buttons = b->num_buttons;
155 memcpy((char *)&B->buttons[0], (char *)&b->buttons[0], 32); 155 memcpy((char *)&B->buttons[0], (char *)&b->buttons[0], 32);
156 Any = (XInputClass *) (B + 1); 156 Any = (XInputClass *) (B + 1);
157 } 157 }
158 break; 158 break;
159 case ValuatorClass: 159 case ValuatorClass:
160 { 160 {
161 xValuatorState *v = (xValuatorState *) any; 161 xValuatorState *v = (xValuatorState *) any;
162 XValuatorState *V = (XValuatorState *) Any; 162 XValuatorState *V = (XValuatorState *) Any;
163 CARD32 *valuators = (CARD32 *) (v + 1); 163 CARD32 *valuators = (CARD32 *) (v + 1);
164 164
165 V->class = v->class; 165 V->class = v->class;
166 V->length = sizeof(XValuatorState); 166 V->length = sizeof(XValuatorState) +
 167 v->num_valuators * sizeof(int);
167 V->num_valuators = v->num_valuators; 168 V->num_valuators = v->num_valuators;
168 V->mode = v->mode; 169 V->mode = v->mode;
169 Any = (XInputClass *) (V + 1); 170 Any = (XInputClass *) (V + 1);
170 V->valuators = (int *)Any; 171 V->valuators = (int *)Any;
171 for (j = 0; j < (int)V->num_valuators; j++) 172 for (j = 0; j < (int)V->num_valuators; j++)
172 *(V->valuators + j) = *valuators++; 173 *(V->valuators + j) = *valuators++;
173 Any = (XInputClass *) ((char *)Any + 174 Any = (XInputClass *) ((char *)Any +
174 V->num_valuators * sizeof(int)); 175 V->num_valuators * sizeof(int));
175 } 176 }
176 break; 177 break;
177 } 178 }
178 any = (XInputClass *) ((char *)any + any->length); 179 any = (XInputClass *) ((char *)any + any->length);
179 } 180 }
180 Xfree(data); 
181 } 181 }
 182out:
 183 Xfree(data);
182 184
183 UnlockDisplay(dpy); 185 UnlockDisplay(dpy);
184 SyncHandle(); 186 SyncHandle();
185 return (state); 187 return (state);
186} 188}
187 189
188void 190void
189XFreeDeviceState(list) 191XFreeDeviceState(list)
190 XDeviceState *list; 192 XDeviceState *list;
191{ 193{
192 XFree((char *)list); 194 XFree((char *)list);
193} 195}
cvs diff -r1.1.1.1.2.2 -r1.1.1.1.2.2.2.1 xsrc/external/mit/libXi/dist/src/XGetDProp.c (expand / switch to unified diff)

--- xsrc/external/mit/libXi/dist/src/XGetDProp.c 2009/09/17 03:33:17 1.1.1.1.2.2
+++ xsrc/external/mit/libXi/dist/src/XGetDProp.c 2013/06/06 16:39:19 1.1.1.1.2.2.2.1
@@ -28,37 +28,39 @@ in this Software without prior written a @@ -28,37 +28,39 @@ in this Software without prior written a
28 * XGetDeviceProperties - get an input device's properties. 28 * XGetDeviceProperties - get an input device's properties.
29 */ 29 */
30 30
31#ifdef HAVE_CONFIG_H 31#ifdef HAVE_CONFIG_H
32#include <config.h> 32#include <config.h>
33#endif 33#endif
34 34
35#include <X11/Xlibint.h> 35#include <X11/Xlibint.h>
36#include <X11/extensions/XI.h> 36#include <X11/extensions/XI.h>
37#include <X11/extensions/XIproto.h> 37#include <X11/extensions/XIproto.h>
38#include <X11/extensions/XInput.h> 38#include <X11/extensions/XInput.h>
39#include <X11/extensions/extutil.h> 39#include <X11/extensions/extutil.h>
40#include "XIint.h" 40#include "XIint.h"
 41#include <limits.h>
41 42
42int 43int
43XGetDeviceProperty(Display* dpy, XDevice* dev, 44XGetDeviceProperty(Display* dpy, XDevice* dev,
44 Atom property, long offset, long length, Bool delete, 45 Atom property, long offset, long length, Bool delete,
45 Atom req_type, Atom *actual_type, int *actual_format, 46 Atom req_type, Atom *actual_type, int *actual_format,
46 unsigned long *nitems, unsigned long *bytes_after, 47 unsigned long *nitems, unsigned long *bytes_after,
47 unsigned char **prop) 48 unsigned char **prop)
48{ 49{
49 xGetDevicePropertyReq *req; 50 xGetDevicePropertyReq *req;
50 xGetDevicePropertyReply rep; 51 xGetDevicePropertyReply rep;
51 long nbytes, rbytes; 52 unsigned long nbytes, rbytes;
 53 int ret = Success;
52 54
53 XExtDisplayInfo *info = XInput_find_display(dpy); 55 XExtDisplayInfo *info = XInput_find_display(dpy);
54 56
55 LockDisplay(dpy); 57 LockDisplay(dpy);
56 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1) 58 if (_XiCheckExtInit(dpy, XInput_Initial_Release, info) == -1)
57 return 1; 59 return 1;
58 60
59 GetReq(GetDeviceProperty, req); 61 GetReq(GetDeviceProperty, req);
60 req->reqType = info->codes->major_opcode; 62 req->reqType = info->codes->major_opcode;
61 req->ReqType = X_GetDeviceProperty; 63 req->ReqType = X_GetDeviceProperty;
62 req->deviceid = dev->device_id; 64 req->deviceid = dev->device_id;
63 req->property = property; 65 req->property = property;
64 req->type = req_type; 66 req->type = req_type;
@@ -71,69 +73,79 @@ XGetDeviceProperty(Display* dpy, XDevice @@ -71,69 +73,79 @@ XGetDeviceProperty(Display* dpy, XDevice
71 UnlockDisplay (dpy); 73 UnlockDisplay (dpy);
72 SyncHandle (); 74 SyncHandle ();
73 return 1; 75 return 1;
74 } 76 }
75 77
76 *prop = (unsigned char *) NULL; 78 *prop = (unsigned char *) NULL;
77 79
78 if (rep.propertyType != None) { 80 if (rep.propertyType != None) {
79 /* 81 /*
80 * One extra byte is malloced than is needed to contain the property 82 * One extra byte is malloced than is needed to contain the property
81 * data, but this last byte is null terminated and convenient for 83 * data, but this last byte is null terminated and convenient for
82 * returning string properties, so the client doesn't then have to 84 * returning string properties, so the client doesn't then have to
83 * recopy the string to make it null terminated. 85 * recopy the string to make it null terminated.
 86 *
 87 * Maximum item limits are set to both prevent integer overflow when
 88 * calculating the amount of memory to malloc, and to limit how much
 89 * memory will be used if a server provides an insanely high count.
84 */ 90 */
85 switch (rep.format) { 91 switch (rep.format) {
86 case 8: 92 case 8:
87 nbytes = rep.nItems; 93 if (rep.nItems < INT_MAX) {
88 rbytes = rep.nItems + 1; 94 nbytes = rep.nItems;
89 if (rbytes > 0 && 95 rbytes = rep.nItems + 1;
90 (*prop = (unsigned char *) Xmalloc ((unsigned)rbytes))) 96 if ((*prop = Xmalloc (rbytes)))
91 _XReadPad (dpy, (char *) *prop, nbytes); 97 _XReadPad (dpy, (char *) *prop, nbytes);
 98 else
 99 ret = BadAlloc;
 100 }
92 break; 101 break;
93 102
94 case 16: 103 case 16:
95 nbytes = rep.nItems << 1; 104 if (rep.nItems < (INT_MAX / sizeof (short))) {
96 rbytes = rep.nItems * sizeof (short) + 1; 105 nbytes = rep.nItems << 1;
97 if (rbytes > 0 && 106 rbytes = rep.nItems * sizeof (short) + 1;
98 (*prop = (unsigned char *) Xmalloc ((unsigned)rbytes))) 107 if ((*prop = Xmalloc (rbytes)))
99 _XRead16Pad (dpy, (short *) *prop, nbytes); 108 _XRead16Pad (dpy, (short *) *prop, nbytes);
 109 else
 110 ret = BadAlloc;
 111 }
100 break; 112 break;
101 113
102 case 32: 114 case 32:
103 nbytes = rep.nItems << 2; 115 if (rep.nItems < (INT_MAX / sizeof (long))) {
104 rbytes = rep.nItems * sizeof (long) + 1; 116 nbytes = rep.nItems << 2;
105 if (rbytes > 0 && 117 rbytes = rep.nItems * sizeof (long) + 1;
106 (*prop = (unsigned char *) Xmalloc ((unsigned)rbytes))) 118 if ((*prop = Xmalloc (rbytes)))
107 _XRead32 (dpy, (long *) *prop, nbytes); 119 _XRead32 (dpy, (long *) *prop, nbytes);
 120 else
 121 ret = BadAlloc;
 122 }
108 break; 123 break;
109 124
110 default: 125 default:
111 /* 126 /*
112 * This part of the code should never be reached. If it is, 127 * This part of the code should never be reached. If it is,
113 * the server sent back a property with an invalid format. 128 * the server sent back a property with an invalid format.
114 */ 129 */
115 nbytes = rep.length << 2; 130 ret = BadImplementation;
116 _XEatData(dpy, (unsigned long) nbytes); 
117 UnlockDisplay(dpy); 
118 SyncHandle(); 
119 return(BadImplementation); 
120 } 131 }
121 if (! *prop) { 132 if (! *prop) {
122 _XEatData(dpy, (unsigned long) nbytes); 133 _XEatData(dpy, rep.length << 2);
123 UnlockDisplay(dpy); 134 if (ret == Success)
124 SyncHandle(); 135 ret = BadAlloc;
125 return(BadAlloc); 136 goto out;
126 } 137 }
127 (*prop)[rbytes - 1] = '\0'; 138 (*prop)[rbytes - 1] = '\0';
128 } 139 }
129 140
130 *actual_type = rep.propertyType; 141 *actual_type = rep.propertyType;
131 *actual_format = rep.format; 142 *actual_format = rep.format;
132 *nitems = rep.nItems; 143 *nitems = rep.nItems;
133 *bytes_after = rep.bytesAfter; 144 *bytes_after = rep.bytesAfter;
 145 out:
134 UnlockDisplay (dpy); 146 UnlockDisplay (dpy);
135 SyncHandle (); 147 SyncHandle ();
136 148
137 return Success; 149 return ret;
138} 150}
139 151
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXinerama/dist/src/Xinerama.c (expand / switch to unified diff)

--- xsrc/external/mit/libXinerama/dist/src/Xinerama.c 2008/07/30 02:50:19 1.1.1.1
+++ xsrc/external/mit/libXinerama/dist/src/Xinerama.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -280,38 +280,50 @@ XineramaQueryScreens( @@ -280,38 +280,50 @@ XineramaQueryScreens(
280 280
281 PanoramiXCheckExtension (dpy, info, NULL); 281 PanoramiXCheckExtension (dpy, info, NULL);
282 282
283 LockDisplay (dpy); 283 LockDisplay (dpy);
284 GetReq (XineramaQueryScreens, req); 284 GetReq (XineramaQueryScreens, req);
285 req->reqType = info->codes->major_opcode; 285 req->reqType = info->codes->major_opcode;
286 req->panoramiXReqType = X_XineramaQueryScreens; 286 req->panoramiXReqType = X_XineramaQueryScreens;
287 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 287 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
288 UnlockDisplay (dpy); 288 UnlockDisplay (dpy);
289 SyncHandle (); 289 SyncHandle ();
290 return NULL; 290 return NULL;
291 } 291 }
292 292
293 if(rep.number) { 293 /*
294 if((scrnInfo = Xmalloc(sizeof(XineramaScreenInfo) * rep.number))) { 294 * rep.number is a CARD32 so could be as large as 2^32
 295 * The X11 protocol limits the total screen size to 64k x 64k,
 296 * and no screen can be smaller than a pixel. While technically
 297 * that means we could theoretically reach 2^32 screens, and that's
 298 * not even taking overlap into account, Xorg is currently limited
 299 * to 16 screens, and few known servers have a much higher limit,
 300 * so 1024 seems more than enough to prevent both integer overflow
 301 * and insane X server responses causing massive memory allocation.
 302 */
 303 if ((rep.number > 0) && (rep.number <= 1024))
 304 scrnInfo = Xmalloc(sizeof(XineramaScreenInfo) * rep.number);
 305 if (scrnInfo != NULL) {
 306 int i;
 307
 308 for (i = 0; i < rep.number; i++) {
295 xXineramaScreenInfo scratch; 309 xXineramaScreenInfo scratch;
296 int i; 
297 310
298 for(i = 0; i < rep.number; i++) { 311 _XRead(dpy, (char*)(&scratch), sz_XineramaScreenInfo);
299 _XRead(dpy, (char*)(&scratch), sz_XineramaScreenInfo); 312
300 scrnInfo[i].screen_number = i; 313 scrnInfo[i].screen_number = i;
301 scrnInfo[i].x_org = scratch.x_org; 314 scrnInfo[i].x_org = scratch.x_org;
302 scrnInfo[i].y_org = scratch.y_org; 315 scrnInfo[i].y_org = scratch.y_org;
303 scrnInfo[i].width = scratch.width; 316 scrnInfo[i].width = scratch.width;
304 scrnInfo[i].height = scratch.height; 317 scrnInfo[i].height = scratch.height;
305 } 318 }
306 319
307 *number = rep.number; 320 *number = rep.number;
308 } else 
309 _XEatData(dpy, rep.length << 2); 
310 } else { 321 } else {
 322 _XEatData(dpy, rep.length << 2);
311 *number = 0; 323 *number = 0;
312 } 324 }
313 325
314 UnlockDisplay (dpy); 326 UnlockDisplay (dpy);
315 SyncHandle (); 327 SyncHandle ();
316 return scrnInfo; 328 return scrnInfo;
317} 329}
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXrandr/dist/src/XrrProperty.c (expand / switch to unified diff)

--- xsrc/external/mit/libXrandr/dist/src/XrrProperty.c 2009/09/17 03:33:18 1.1.1.1.2.1
+++ xsrc/external/mit/libXrandr/dist/src/XrrProperty.c 2013/06/06 16:39:19 1.1.1.1.2.1.2.1
@@ -21,26 +21,27 @@ @@ -21,26 +21,27 @@
21 */ 21 */
22 22
23#ifdef HAVE_CONFIG_H 23#ifdef HAVE_CONFIG_H
24#include <config.h> 24#include <config.h>
25#endif 25#endif
26 26
27#include <stdio.h> 27#include <stdio.h>
28#include <X11/Xlib.h> 28#include <X11/Xlib.h>
29/* we need to be able to manipulate the Display structure on events */ 29/* we need to be able to manipulate the Display structure on events */
30#include <X11/Xlibint.h> 30#include <X11/Xlibint.h>
31#include <X11/extensions/render.h> 31#include <X11/extensions/render.h>
32#include <X11/extensions/Xrender.h> 32#include <X11/extensions/Xrender.h>
33#include "Xrandrint.h" 33#include "Xrandrint.h"
 34#include <limits.h>
34 35
35Atom * 36Atom *
36XRRListOutputProperties (Display *dpy, RROutput output, int *nprop) 37XRRListOutputProperties (Display *dpy, RROutput output, int *nprop)
37{ 38{
38 XExtDisplayInfo *info = XRRFindDisplay(dpy); 39 XExtDisplayInfo *info = XRRFindDisplay(dpy);
39 xRRListOutputPropertiesReply rep; 40 xRRListOutputPropertiesReply rep;
40 xRRListOutputPropertiesReq *req; 41 xRRListOutputPropertiesReq *req;
41 int nbytes, rbytes; 42 int nbytes, rbytes;
42 Atom *props = NULL; 43 Atom *props = NULL;
43 44
44 RRCheckExtension (dpy, info, NULL); 45 RRCheckExtension (dpy, info, NULL);
45 46
46 LockDisplay (dpy); 47 LockDisplay (dpy);
@@ -74,48 +75,52 @@ XRRListOutputProperties (Display *dpy, R @@ -74,48 +75,52 @@ XRRListOutputProperties (Display *dpy, R
74 75
75 *nprop = rep.nAtoms; 76 *nprop = rep.nAtoms;
76 UnlockDisplay (dpy); 77 UnlockDisplay (dpy);
77 SyncHandle (); 78 SyncHandle ();
78 return props; 79 return props;
79} 80}
80 81
81XRRPropertyInfo * 82XRRPropertyInfo *
82XRRQueryOutputProperty (Display *dpy, RROutput output, Atom property) 83XRRQueryOutputProperty (Display *dpy, RROutput output, Atom property)
83{ 84{
84 XExtDisplayInfo *info = XRRFindDisplay(dpy); 85 XExtDisplayInfo *info = XRRFindDisplay(dpy);
85 xRRQueryOutputPropertyReply rep; 86 xRRQueryOutputPropertyReply rep;
86 xRRQueryOutputPropertyReq *req; 87 xRRQueryOutputPropertyReq *req;
87 int rbytes, nbytes; 88 unsigned int rbytes, nbytes;
88 XRRPropertyInfo *prop_info; 89 XRRPropertyInfo *prop_info;
89 90
90 RRCheckExtension (dpy, info, NULL); 91 RRCheckExtension (dpy, info, NULL);
91 92
92 LockDisplay (dpy); 93 LockDisplay (dpy);
93 GetReq (RRQueryOutputProperty, req); 94 GetReq (RRQueryOutputProperty, req);
94 req->reqType = info->codes->major_opcode; 95 req->reqType = info->codes->major_opcode;
95 req->randrReqType = X_RRQueryOutputProperty; 96 req->randrReqType = X_RRQueryOutputProperty;
96 req->output = output; 97 req->output = output;
97 req->property = property; 98 req->property = property;
98 99
99 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 100 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
100 UnlockDisplay (dpy); 101 UnlockDisplay (dpy);
101 SyncHandle (); 102 SyncHandle ();
102 return NULL; 103 return NULL;
103 } 104 }
104 105
105 rbytes = sizeof (XRRPropertyInfo) + rep.length * sizeof (long); 106 if (rep.length < ((INT_MAX / sizeof(long)) - sizeof (XRRPropertyInfo))) {
106 nbytes = rep.length << 2; 107 rbytes = sizeof (XRRPropertyInfo) + (rep.length * sizeof (long));
 108 nbytes = rep.length << 2;
 109
 110 prop_info = Xmalloc (rbytes);
 111 } else
 112 prop_info = NULL;
107 113
108 prop_info = (XRRPropertyInfo *) Xmalloc (rbytes); 
109 if (prop_info == NULL) { 114 if (prop_info == NULL) {
110 _XEatData (dpy, nbytes); 115 _XEatData (dpy, nbytes);
111 UnlockDisplay (dpy); 116 UnlockDisplay (dpy);
112 SyncHandle (); 117 SyncHandle ();
113 return NULL; 118 return NULL;
114 } 119 }
115 120
116 prop_info->pending = rep.pending; 121 prop_info->pending = rep.pending;
117 prop_info->range = rep.range; 122 prop_info->range = rep.range;
118 prop_info->immutable = rep.immutable; 123 prop_info->immutable = rep.immutable;
119 prop_info->num_values = rep.length; 124 prop_info->num_values = rep.length;
120 if (rep.length != 0) { 125 if (rep.length != 0) {
121 prop_info->values = (long *) (prop_info + 1); 126 prop_info->values = (long *) (prop_info + 1);
@@ -242,79 +247,85 @@ XRRDeleteOutputProperty (Display *dpy, R @@ -242,79 +247,85 @@ XRRDeleteOutputProperty (Display *dpy, R
242} 247}
243 248
244int 249int
245XRRGetOutputProperty (Display *dpy, RROutput output, 250XRRGetOutputProperty (Display *dpy, RROutput output,
246 Atom property, long offset, long length, 251 Atom property, long offset, long length,
247 Bool delete, Bool pending, Atom req_type,  252 Bool delete, Bool pending, Atom req_type,
248 Atom *actual_type, int *actual_format, 253 Atom *actual_type, int *actual_format,
249 unsigned long *nitems, unsigned long *bytes_after, 254 unsigned long *nitems, unsigned long *bytes_after,
250 unsigned char **prop) 255 unsigned char **prop)
251{ 256{
252 XExtDisplayInfo *info = XRRFindDisplay(dpy); 257 XExtDisplayInfo *info = XRRFindDisplay(dpy);
253 xRRGetOutputPropertyReply rep; 258 xRRGetOutputPropertyReply rep;
254 xRRGetOutputPropertyReq *req; 259 xRRGetOutputPropertyReq *req;
255 long nbytes, rbytes; 260 unsigned long nbytes, rbytes;
256 261
257 RRCheckExtension (dpy, info, 1); 262 RRCheckExtension (dpy, info, 1);
258 263
259 LockDisplay (dpy); 264 LockDisplay (dpy);
260 GetReq (RRGetOutputProperty, req); 265 GetReq (RRGetOutputProperty, req);
261 req->reqType = info->codes->major_opcode; 266 req->reqType = info->codes->major_opcode;
262 req->randrReqType = X_RRGetOutputProperty; 267 req->randrReqType = X_RRGetOutputProperty;
263 req->output = output; 268 req->output = output;
264 req->property = property; 269 req->property = property;
265 req->type = req_type; 270 req->type = req_type;
266 req->longOffset = offset; 271 req->longOffset = offset;
267 req->longLength = length; 272 req->longLength = length;
268 req->delete = delete; 273 req->delete = delete;
269 req->pending = pending; 274 req->pending = pending;
270 275
271 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) 276 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
272 { 277 {
273 UnlockDisplay (dpy); 278 UnlockDisplay (dpy);
274 SyncHandle (); 279 SyncHandle ();
275 return 1; 280 return 1;
276 } 281 }
277 282
278 *prop = (unsigned char *) NULL; 283 *prop = (unsigned char *) NULL;
279 if (rep.propertyType != None) { 284 if (rep.propertyType != None) {
 285 int format = rep.format;
 286
 287 /*
 288 * Protect against both integer overflow and just plain oversized
 289 * memory allocation - no server should ever return this many props.
 290 */
 291 if (rep.nItems >= (INT_MAX >> 4))
 292 format = -1; /* fall through to default error case */
 293
280 /* 294 /*
281 * One extra byte is malloced than is needed to contain the property 295 * One extra byte is malloced than is needed to contain the property
282 * data, but this last byte is null terminated and convenient for 296 * data, but this last byte is null terminated and convenient for
283 * returning string properties, so the client doesn't then have to 297 * returning string properties, so the client doesn't then have to
284 * recopy the string to make it null terminated. 298 * recopy the string to make it null terminated.
285 */ 299 */
286 switch (rep.format) { 300 switch (format) {
287 case 8: 301 case 8:
288 nbytes = rep.nItems; 302 nbytes = rep.nItems;
289 rbytes = rep.nItems + 1; 303 rbytes = rep.nItems + 1;
290 if (rbytes > 0 && 304 if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
291 (*prop = (unsigned char *) Xmalloc ((unsigned)rbytes))) 
292 _XReadPad (dpy, (char *) *prop, nbytes); 305 _XReadPad (dpy, (char *) *prop, nbytes);
293 break; 306 break;
294 307
295 case 16: 308 case 16:
296 nbytes = rep.nItems << 1; 309 nbytes = rep.nItems << 1;
297 rbytes = rep.nItems * sizeof (short) + 1; 310 rbytes = rep.nItems * sizeof (short) + 1;
298 if (rbytes > 0 && 311 if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
299 (*prop = (unsigned char *) Xmalloc ((unsigned)rbytes))) 
300 _XRead16Pad (dpy, (short *) *prop, nbytes); 312 _XRead16Pad (dpy, (short *) *prop, nbytes);
301 break; 313 break;
302 314
303 case 32: 315 case 32:
304 nbytes = rep.nItems << 2; 316 nbytes = rep.nItems << 2;
305 rbytes = rep.nItems * sizeof (long) + 1; 317 rbytes = rep.nItems * sizeof (long) + 1;
306 if (rbytes > 0 && 318 if (rbytes > 0 && (*prop = Xmalloc (rbytes)))
307 (*prop = (unsigned char *) Xmalloc ((unsigned)rbytes))) 
308 _XRead32 (dpy, (long *) *prop, nbytes); 319 _XRead32 (dpy, (long *) *prop, nbytes);
309 break; 320 break;
310 321
311 default: 322 default:
312 /* 323 /*
313 * This part of the code should never be reached. If it is, 324 * This part of the code should never be reached. If it is,
314 * the server sent back a property with an invalid format. 325 * the server sent back a property with an invalid format.
315 */ 326 */
316 nbytes = rep.length << 2; 327 nbytes = rep.length << 2;
317 _XEatData(dpy, (unsigned long) nbytes); 328 _XEatData(dpy, (unsigned long) nbytes);
318 UnlockDisplay(dpy); 329 UnlockDisplay(dpy);
319 SyncHandle(); 330 SyncHandle();
320 return(BadImplementation); 331 return(BadImplementation);
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXrender/dist/src/Filter.c (expand / switch to unified diff)

--- xsrc/external/mit/libXrender/dist/src/Filter.c 2008/07/30 02:56:06 1.1.1.1
+++ xsrc/external/mit/libXrender/dist/src/Filter.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -15,77 +15,88 @@ @@ -15,77 +15,88 @@
15 * KEITH PACKARD DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, 15 * KEITH PACKARD DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
16 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO 16 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
17 * EVENT SHALL KEITH PACKARD BE LIABLE FOR ANY SPECIAL, INDIRECT OR 17 * EVENT SHALL KEITH PACKARD BE LIABLE FOR ANY SPECIAL, INDIRECT OR
18 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, 18 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
19 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER 19 * DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
20 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 20 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
21 * PERFORMANCE OF THIS SOFTWARE. 21 * PERFORMANCE OF THIS SOFTWARE.
22 */ 22 */
23 23
24#ifdef HAVE_CONFIG_H 24#ifdef HAVE_CONFIG_H
25#include <config.h> 25#include <config.h>
26#endif 26#endif
27#include "Xrenderint.h" 27#include "Xrenderint.h"
 28#include <limits.h>
28  29
29XFilters * 30XFilters *
30XRenderQueryFilters (Display *dpy, Drawable drawable) 31XRenderQueryFilters (Display *dpy, Drawable drawable)
31{ 32{
32 XRenderExtDisplayInfo *info = XRenderFindDisplay (dpy); 33 XRenderExtDisplayInfo *info = XRenderFindDisplay (dpy);
33 XRenderInfo *xri; 34 XRenderInfo *xri;
34 xRenderQueryFiltersReq *req; 35 xRenderQueryFiltersReq *req;
35 xRenderQueryFiltersReply rep; 36 xRenderQueryFiltersReply rep;
36 XFilters *filters; 37 XFilters *filters;
37 char *name; 38 char *name;
38 char len; 39 char len;
39 int i; 40 int i;
40 long nbytes, nbytesAlias, nbytesName; 41 unsigned long nbytes, nbytesAlias, nbytesName;
41  42
42 if (!RenderHasExtension (info)) 43 if (!RenderHasExtension (info))
43 return 0; 44 return 0;
44 45
45 if (!XRenderQueryFormats (dpy)) 46 if (!XRenderQueryFormats (dpy))
46 return 0; 47 return 0;
47 48
48 xri = info->info; 49 xri = info->info;
49 if (xri->minor_version < 6) 50 if (xri->minor_version < 6)
50 return 0; 51 return 0;
51  52
52 LockDisplay (dpy); 53 LockDisplay (dpy);
53 GetReq (RenderQueryFilters, req); 54 GetReq (RenderQueryFilters, req);
54 req->reqType = info->codes->major_opcode; 55 req->reqType = info->codes->major_opcode;
55 req->renderReqType = X_RenderQueryFilters; 56 req->renderReqType = X_RenderQueryFilters;
56 req->drawable = drawable; 57 req->drawable = drawable;
57 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) 58 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
58 { 59 {
59 UnlockDisplay (dpy); 60 UnlockDisplay (dpy);
60 SyncHandle (); 61 SyncHandle ();
61 return 0; 62 return 0;
62 } 63 }
63 /* 
64 * Compute total number of bytes for filter names 
65 */ 
66 nbytes = (long)rep.length << 2; 
67 nbytesAlias = rep.numAliases * 2; 
68 if (rep.numAliases & 1) 
69 nbytesAlias += 2; 
70 nbytesName = nbytes - nbytesAlias; 
71  64
72 /* 65 /*
73 * Allocate one giant block for the whole data structure 66 * Limit each component of combined size to 1/4 the max, which is far
 67 * more than they should ever possibly need.
74 */ 68 */
75 filters = Xmalloc (sizeof (XFilters) + 69 if ((rep.length < (INT_MAX >> 2)) &&
76 rep.numFilters * sizeof (char *) + 70 (rep.numFilters < ((INT_MAX / 4) / sizeof (char *))) &&
77 rep.numAliases * sizeof (short) + 71 (rep.numAliases < ((INT_MAX / 4) / sizeof (short)))) {
78 nbytesName); 72 /*
 73 * Compute total number of bytes for filter names
 74 */
 75 nbytes = (unsigned long)rep.length << 2;
 76 nbytesAlias = rep.numAliases * 2;
 77 if (rep.numAliases & 1)
 78 nbytesAlias += 2;
 79 nbytesName = nbytes - nbytesAlias;
 80
 81 /*
 82 * Allocate one giant block for the whole data structure
 83 */
 84 filters = Xmalloc (sizeof (XFilters) +
 85 (rep.numFilters * sizeof (char *)) +
 86 (rep.numAliases * sizeof (short)) +
 87 nbytesName);
 88 } else
 89 filters = NULL;
79 90
80 if (!filters) 91 if (!filters)
81 { 92 {
82 _XEatData (dpy, (unsigned long) rep.length << 2); 93 _XEatData (dpy, (unsigned long) rep.length << 2);
83 UnlockDisplay (dpy); 94 UnlockDisplay (dpy);
84 SyncHandle (); 95 SyncHandle ();
85 return 0; 96 return 0;
86 } 97 }
87 98
88 /* 99 /*
89 * Layout: 100 * Layout:
90 * XFilters 101 * XFilters
91 * numFilters char * pointers to filter names 102 * numFilters char * pointers to filter names
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXrender/dist/src/Xrender.c (expand / switch to unified diff)

--- xsrc/external/mit/libXrender/dist/src/Xrender.c 2008/07/30 02:56:07 1.1.1.1
+++ xsrc/external/mit/libXrender/dist/src/Xrender.c 2013/06/06 16:39:19 1.1.1.1.6.1
@@ -16,26 +16,27 @@ @@ -16,26 +16,27 @@
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL SuSE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL SuSE
17 * BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 17 * BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION 18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
19 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN  19 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
20 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 * 21 *
22 * Author: Keith Packard, SuSE, Inc. 22 * Author: Keith Packard, SuSE, Inc.
23 */ 23 */
24 24
25#ifdef HAVE_CONFIG_H 25#ifdef HAVE_CONFIG_H
26#include <config.h> 26#include <config.h>
27#endif 27#endif
28#include "Xrenderint.h" 28#include "Xrenderint.h"
 29#include <limits.h>
29 30
30XRenderExtInfo XRenderExtensionInfo; 31XRenderExtInfo XRenderExtensionInfo;
31char XRenderExtensionName[] = RENDER_NAME; 32char XRenderExtensionName[] = RENDER_NAME;
32 33
33static int XRenderCloseDisplay (Display *dpy, XExtCodes *codes); 34static int XRenderCloseDisplay (Display *dpy, XExtCodes *codes);
34 35
35/* 36/*
36 * XRenderExtFindDisplay - look for a display in this extension; keeps a 37 * XRenderExtFindDisplay - look for a display in this extension; keeps a
37 * cache of the most-recently used for efficiency. (Replaces 38 * cache of the most-recently used for efficiency. (Replaces
38 * XextFindDisplay.) 39 * XextFindDisplay.)
39 */ 40 */
40static XRenderExtDisplayInfo * 41static XRenderExtDisplayInfo *
41XRenderExtFindDisplay (XRenderExtInfo *extinfo,  42XRenderExtFindDisplay (XRenderExtInfo *extinfo,
@@ -401,28 +402,28 @@ XRenderQueryFormats (Display *dpy) @@ -401,28 +402,28 @@ XRenderQueryFormats (Display *dpy)
401 xRenderQueryPictFormatsReq *req; 402 xRenderQueryPictFormatsReq *req;
402 XRenderInfo *xri; 403 XRenderInfo *xri;
403 XRenderPictFormat *format; 404 XRenderPictFormat *format;
404 XRenderScreen *screen; 405 XRenderScreen *screen;
405 XRenderDepth *depth; 406 XRenderDepth *depth;
406 XRenderVisual *visual; 407 XRenderVisual *visual;
407 xPictFormInfo *xFormat; 408 xPictFormInfo *xFormat;
408 xPictScreen *xScreen; 409 xPictScreen *xScreen;
409 xPictDepth *xDepth; 410 xPictDepth *xDepth;
410 xPictVisual *xVisual; 411 xPictVisual *xVisual;
411 CARD32 *xSubpixel; 412 CARD32 *xSubpixel;
412 void *xData; 413 void *xData;
413 int nf, ns, nd, nv; 414 int nf, ns, nd, nv;
414 int rlength; 415 unsigned long rlength;
415 int nbytes; 416 unsigned long nbytes;
416  417
417 RenderCheckExtension (dpy, info, 0); 418 RenderCheckExtension (dpy, info, 0);
418 LockDisplay (dpy); 419 LockDisplay (dpy);
419 if (info->info) 420 if (info->info)
420 { 421 {
421 UnlockDisplay (dpy); 422 UnlockDisplay (dpy);
422 return 1; 423 return 1;
423 } 424 }
424 GetReq (RenderQueryVersion, vreq); 425 GetReq (RenderQueryVersion, vreq);
425 vreq->reqType = info->codes->major_opcode; 426 vreq->reqType = info->codes->major_opcode;
426 vreq->renderReqType = X_RenderQueryVersion; 427 vreq->renderReqType = X_RenderQueryVersion;
427 vreq->majorVersion = RENDER_MAJOR; 428 vreq->majorVersion = RENDER_MAJOR;
428 vreq->minorVersion = RENDER_MINOR; 429 vreq->minorVersion = RENDER_MINOR;
@@ -447,39 +448,49 @@ XRenderQueryFormats (Display *dpy) @@ -447,39 +448,49 @@ XRenderQueryFormats (Display *dpy)
447 } 448 }
448 DeqAsyncHandler (dpy, &async); 449 DeqAsyncHandler (dpy, &async);
449 if (async_state.error) 450 if (async_state.error)
450 { 451 {
451 UnlockDisplay(dpy); 452 UnlockDisplay(dpy);
452 SyncHandle(); 453 SyncHandle();
453 return 0; 454 return 0;
454 } 455 }
455 /* 456 /*
456 * Check for the lack of sub-pixel data 457 * Check for the lack of sub-pixel data
457 */ 458 */
458 if (async_state.major_version == 0 && async_state.minor_version < 6) 459 if (async_state.major_version == 0 && async_state.minor_version < 6)
459 rep.numSubpixel = 0; 460 rep.numSubpixel = 0;
460  461 if ((rep.numFormats < ((INT_MAX / 4) / sizeof (XRenderPictFormat))) &&
461 xri = (XRenderInfo *) Xmalloc (sizeof (XRenderInfo) + 462 (rep.numScreens < ((INT_MAX / 4) / sizeof (XRenderScreen))) &&
462 rep.numFormats * sizeof (XRenderPictFormat) + 463 (rep.numDepths < ((INT_MAX / 4) / sizeof (XRenderDepth))) &&
463 rep.numScreens * sizeof (XRenderScreen) + 464 (rep.numVisuals < ((INT_MAX / 4) / sizeof (XRenderVisual))) &&
464 rep.numDepths * sizeof (XRenderDepth) + 465 (rep.numSubpixel < ((INT_MAX / 4) / 4)) &&
465 rep.numVisuals * sizeof (XRenderVisual)); 466 (rep.length < (INT_MAX >> 2)) ) {
466 rlength = (rep.numFormats * sizeof (xPictFormInfo) + 467 xri = Xmalloc (sizeof (XRenderInfo) +
467 rep.numScreens * sizeof (xPictScreen) + 468 (rep.numFormats * sizeof (XRenderPictFormat)) +
468 rep.numDepths * sizeof (xPictDepth) + 469 (rep.numScreens * sizeof (XRenderScreen)) +
469 rep.numVisuals * sizeof (xPictVisual) + 470 (rep.numDepths * sizeof (XRenderDepth)) +
470 rep.numSubpixel * 4); 471 (rep.numVisuals * sizeof (XRenderVisual)));
471 xData = (void *) Xmalloc (rlength); 472 rlength = ((rep.numFormats * sizeof (xPictFormInfo)) +
472 nbytes = (int) rep.length << 2; 473 (rep.numScreens * sizeof (xPictScreen)) +
 474 (rep.numDepths * sizeof (xPictDepth)) +
 475 (rep.numVisuals * sizeof (xPictVisual)) +
 476 (rep.numSubpixel * 4));
 477 xData = Xmalloc (rlength);
 478 nbytes = (unsigned long) rep.length << 2;
 479 } else {
 480 xri = NULL;
 481 xData = NULL;
 482 rlength = nbytes = 0;
 483 }
473  484
474 if (!xri || !xData || nbytes < rlength) 485 if (!xri || !xData || nbytes < rlength)
475 { 486 {
476 if (xri) Xfree (xri); 487 if (xri) Xfree (xri);
477 if (xData) Xfree (xData); 488 if (xData) Xfree (xData);
478 _XEatData (dpy, nbytes); 489 _XEatData (dpy, nbytes);
479 UnlockDisplay (dpy); 490 UnlockDisplay (dpy);
480 SyncHandle (); 491 SyncHandle ();
481 return 0; 492 return 0;
482 } 493 }
483 xri->major_version = async_state.major_version; 494 xri->major_version = async_state.major_version;
484 xri->minor_version = async_state.minor_version; 495 xri->minor_version = async_state.minor_version;
485 xri->format = (XRenderPictFormat *) (xri + 1); 496 xri->format = (XRenderPictFormat *) (xri + 1);
@@ -822,51 +833,58 @@ XRenderFindStandardFormat (Display *dpy @@ -822,51 +833,58 @@ XRenderFindStandardFormat (Display *dpy
822 0); 833 0);
823 return 0; 834 return 0;
824} 835}
825 836
826XIndexValue * 837XIndexValue *
827XRenderQueryPictIndexValues(Display *dpy, 838XRenderQueryPictIndexValues(Display *dpy,
828 _Xconst XRenderPictFormat *format, 839 _Xconst XRenderPictFormat *format,
829 int *num) 840 int *num)
830{ 841{
831 XRenderExtDisplayInfo *info = XRenderFindDisplay (dpy); 842 XRenderExtDisplayInfo *info = XRenderFindDisplay (dpy);
832 xRenderQueryPictIndexValuesReq *req; 843 xRenderQueryPictIndexValuesReq *req;
833 xRenderQueryPictIndexValuesReply rep; 844 xRenderQueryPictIndexValuesReply rep;
834 XIndexValue *values; 845 XIndexValue *values;
835 int nbytes, nread, rlength, i; 846 unsigned int nbytes, nread, rlength, i;
836 847
837 RenderCheckExtension (dpy, info, 0); 848 RenderCheckExtension (dpy, info, 0);
838 849
839 LockDisplay (dpy); 850 LockDisplay (dpy);
840 GetReq (RenderQueryPictIndexValues, req); 851 GetReq (RenderQueryPictIndexValues, req);
841 req->reqType = info->codes->major_opcode; 852 req->reqType = info->codes->major_opcode;
842 req->renderReqType = X_RenderQueryPictIndexValues; 853 req->renderReqType = X_RenderQueryPictIndexValues;
843 req->format = format->id; 854 req->format = format->id;
844 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) 855 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
845 { 856 {
846 UnlockDisplay (dpy); 857 UnlockDisplay (dpy);
847 SyncHandle (); 858 SyncHandle ();
848 return 0; 859 return 0;
849 } 860 }
850 861
851 /* request data length */ 862 if ((rep.length < (INT_MAX >> 2)) &&
852 nbytes = (long)rep.length << 2; 863 (rep.numIndexValues < (INT_MAX / sizeof (XIndexValue)))) {
853 /* bytes of actual data in the request */ 864 /* request data length */
854 nread = rep.numIndexValues * SIZEOF (xIndexValue); 865 nbytes = rep.length << 2;
855 /* size of array returned to application */ 866 /* bytes of actual data in the request */
856 rlength = rep.numIndexValues * sizeof (XIndexValue); 867 nread = rep.numIndexValues * SIZEOF (xIndexValue);
 868 /* size of array returned to application */
 869 rlength = rep.numIndexValues * sizeof (XIndexValue);
 870
 871 /* allocate returned data */
 872 values = Xmalloc (rlength);
 873 } else {
 874 nbytes = nread = rlength = 0;
 875 values = NULL;
 876 }
857 877
858 /* allocate returned data */ 
859 values = (XIndexValue *)Xmalloc (rlength); 
860 if (!values) 878 if (!values)
861 { 879 {
862 _XEatData (dpy, nbytes); 880 _XEatData (dpy, nbytes);
863 UnlockDisplay (dpy); 881 UnlockDisplay (dpy);
864 SyncHandle (); 882 SyncHandle ();
865 return 0; 883 return 0;
866 } 884 }
867 885
868 /* read the values one at a time and convert */ 886 /* read the values one at a time and convert */
869 *num = rep.numIndexValues; 887 *num = rep.numIndexValues;
870 for(i = 0; i < rep.numIndexValues; i++) 888 for(i = 0; i < rep.numIndexValues; i++)
871 { 889 {
872 xIndexValue value; 890 xIndexValue value;
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXres/dist/src/XRes.c (expand / switch to unified diff)

--- xsrc/external/mit/libXres/dist/src/XRes.c 2008/07/30 02:56:16 1.1.1.1
+++ xsrc/external/mit/libXres/dist/src/XRes.c 2013/06/06 16:39:20 1.1.1.1.6.1
@@ -5,26 +5,27 @@ @@ -5,26 +5,27 @@
5 5
6#define NEED_EVENTS 6#define NEED_EVENTS
7#define NEED_REPLIES 7#define NEED_REPLIES
8#ifdef HAVE_CONFIG_H 8#ifdef HAVE_CONFIG_H
9#include <config.h> 9#include <config.h>
10#endif 10#endif
11#include <stdlib.h> 11#include <stdlib.h>
12#include <X11/Xlibint.h> 12#include <X11/Xlibint.h>
13#include <X11/Xutil.h> 13#include <X11/Xutil.h>
14#include <X11/extensions/Xext.h> 14#include <X11/extensions/Xext.h>
15#include <X11/extensions/extutil.h> 15#include <X11/extensions/extutil.h>
16#include <X11/extensions/XResproto.h> 16#include <X11/extensions/XResproto.h>
17#include <X11/extensions/XRes.h> 17#include <X11/extensions/XRes.h>
 18#include <limits.h>
18 19
19 20
20static XExtensionInfo _xres_ext_info_data; 21static XExtensionInfo _xres_ext_info_data;
21static XExtensionInfo *xres_ext_info = &_xres_ext_info_data; 22static XExtensionInfo *xres_ext_info = &_xres_ext_info_data;
22static char *xres_extension_name = XRES_NAME; 23static char *xres_extension_name = XRES_NAME;
23 24
24#define XResCheckExtension(dpy,i,val) \ 25#define XResCheckExtension(dpy,i,val) \
25 XextCheckExtension (dpy, i, xres_extension_name, val) 26 XextCheckExtension (dpy, i, xres_extension_name, val)
26 27
27static XEXT_GENERATE_CLOSE_DISPLAY (close_display, xres_ext_info) 28static XEXT_GENERATE_CLOSE_DISPLAY (close_display, xres_ext_info)
28 29
29static XExtensionHooks xres_extension_hooks = { 30static XExtensionHooks xres_extension_hooks = {
30 NULL, /* create_gc */ 31 NULL, /* create_gc */
@@ -111,27 +112,32 @@ Status XResQueryClients ( @@ -111,27 +112,32 @@ Status XResQueryClients (
111 XResCheckExtension (dpy, info, 0); 112 XResCheckExtension (dpy, info, 0);
112 113
113 LockDisplay (dpy); 114 LockDisplay (dpy);
114 GetReq (XResQueryClients, req); 115 GetReq (XResQueryClients, req);
115 req->reqType = info->codes->major_opcode; 116 req->reqType = info->codes->major_opcode;
116 req->XResReqType = X_XResQueryClients; 117 req->XResReqType = X_XResQueryClients;
117 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 118 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
118 UnlockDisplay (dpy); 119 UnlockDisplay (dpy);
119 SyncHandle (); 120 SyncHandle ();
120 return 0; 121 return 0;
121 } 122 }
122 123
123 if(rep.num_clients) { 124 if(rep.num_clients) {
124 if((clnts = Xmalloc(sizeof(XResClient) * rep.num_clients))) { 125 if (rep.num_clients < (INT_MAX / sizeof(XResClient)))
 126 clnts = Xmalloc(sizeof(XResClient) * rep.num_clients);
 127 else
 128 clnts = NULL;
 129
 130 if (clnts != NULL) {
125 xXResClient scratch; 131 xXResClient scratch;
126 int i; 132 int i;
127 133
128 for(i = 0; i < rep.num_clients; i++) { 134 for(i = 0; i < rep.num_clients; i++) {
129 _XRead(dpy, (char*)&scratch, sz_xXResClient); 135 _XRead(dpy, (char*)&scratch, sz_xXResClient);
130 clnts[i].resource_base = scratch.resource_base; 136 clnts[i].resource_base = scratch.resource_base;
131 clnts[i].resource_mask = scratch.resource_mask; 137 clnts[i].resource_mask = scratch.resource_mask;
132 } 138 }
133 *clients = clnts; 139 *clients = clnts;
134 *num_clients = rep.num_clients; 140 *num_clients = rep.num_clients;
135 result = 1; 141 result = 1;
136 } else { 142 } else {
137 _XEatData(dpy, rep.length << 2); 143 _XEatData(dpy, rep.length << 2);
@@ -163,27 +169,32 @@ Status XResQueryClientResources ( @@ -163,27 +169,32 @@ Status XResQueryClientResources (
163 169
164 LockDisplay (dpy); 170 LockDisplay (dpy);
165 GetReq (XResQueryClientResources, req); 171 GetReq (XResQueryClientResources, req);
166 req->reqType = info->codes->major_opcode; 172 req->reqType = info->codes->major_opcode;
167 req->XResReqType = X_XResQueryClientResources; 173 req->XResReqType = X_XResQueryClientResources;
168 req->xid = xid; 174 req->xid = xid;
169 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 175 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
170 UnlockDisplay (dpy); 176 UnlockDisplay (dpy);
171 SyncHandle (); 177 SyncHandle ();
172 return 0; 178 return 0;
173 } 179 }
174 180
175 if(rep.num_types) { 181 if(rep.num_types) {
176 if((typs = Xmalloc(sizeof(XResType) * rep.num_types))) { 182 if (rep.num_types < (INT_MAX / sizeof(XResType)))
 183 typs = Xmalloc(sizeof(XResType) * rep.num_types);
 184 else
 185 typs = NULL;
 186
 187 if (typs != NULL) {
177 xXResType scratch; 188 xXResType scratch;
178 int i; 189 int i;
179 190
180 for(i = 0; i < rep.num_types; i++) { 191 for(i = 0; i < rep.num_types; i++) {
181 _XRead(dpy, (char*)&scratch, sz_xXResType); 192 _XRead(dpy, (char*)&scratch, sz_xXResType);
182 typs[i].resource_type = scratch.resource_type; 193 typs[i].resource_type = scratch.resource_type;
183 typs[i].count = scratch.count; 194 typs[i].count = scratch.count;
184 } 195 }
185 *types = typs; 196 *types = typs;
186 *num_types = rep.num_types; 197 *num_types = rep.num_types;
187 result = 1; 198 result = 1;
188 } else { 199 } else {
189 _XEatData(dpy, rep.length << 2); 200 _XEatData(dpy, rep.length << 2);
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXt/dist/src/ResConfig.c (expand / switch to unified diff)

--- xsrc/external/mit/libXt/dist/src/ResConfig.c 2009/09/17 03:33:20 1.1.1.1.2.1
+++ xsrc/external/mit/libXt/dist/src/ResConfig.c 2013/06/06 16:39:20 1.1.1.1.2.1.2.1
@@ -985,39 +985,50 @@ _XtResourceConfigurationEH ( @@ -985,39 +985,50 @@ _XtResourceConfigurationEH (
985 &actual_type, &actual_format, &nitems, &leftover, 985 &actual_type, &actual_format, &nitems, &leftover,
986 &data ) == Success && actual_type == XA_STRING 986 &data ) == Success && actual_type == XA_STRING
987 && actual_format == 8) { 987 && actual_format == 8) {
988 /* 988 /*
989 * data format is: 989 * data format is:
990 * 990 *
991 * resource_length, resource, value 991 * resource_length, resource, value
992 * 992 *
993 * convert the resource_length to a long, skip over it, put a 993 * convert the resource_length to a long, skip over it, put a
994 * zero byte at the end of the resource, and pick off the 994 * zero byte at the end of the resource, and pick off the
995 * resource and value fields. 995 * resource and value fields.
996 */ 996 */
997 if (data) { 997 if (data) {
 998 char *data_end = data + nitems;
 999 char *data_value;
 1000
998 resource_len = Strtoul ((void *)data, &data_ptr, 10); 1001 resource_len = Strtoul ((void *)data, &data_ptr, 10);
999 data_ptr++; 
1000 1002
1001 data_ptr[resource_len] = '\0'; 1003 if (data_ptr != (char *) data) {
 1004 data_ptr++;
 1005 data_value = data_ptr + resource_len;
 1006 } else /* strtoul failed to convert a number */
 1007 data_ptr = data_value = NULL;
 1008
 1009 if (data_value > data_ptr && data_value < data_end) {
 1010 *data_value++ = '\0';
1002 1011
1003 resource = XtNewString (data_ptr); 1012 resource = XtNewString (data_ptr);
1004 value = XtNewString (&data_ptr[resource_len + 1]); 1013 value = XtNewString (data_value);
1005#ifdef DEBUG 1014#ifdef DEBUG
1006 fprintf (stderr, "resource_len=%d\n",resource_len); 1015 fprintf (stderr, "resource_len=%d\n"
1007 fprintf (stderr, "resource = %s\t value = %s\n", 1016 resource_len);
1008 resource, value); 1017 fprintf (stderr, "resource = %s\t value = %s\n",
 1018 resource, value);
1009#endif 1019#endif
1010 /* 1020 /*
1011 * descend the application widget tree and 1021 * descend the application widget tree and
1012 * apply the value to the appropriate widgets 1022 * apply the value to the appropriate widgets
1013 */ 1023 */
1014 _search_widget_tree (w, resource, value); 1024 _search_widget_tree (w, resource, value);
1015 1025
1016 XtFree (resource); 1026 XtFree (resource);
1017 XtFree (value); 1027 XtFree (value);
 1028 }
1018 } 1029 }
1019 } 1030 }
1020 1031
1021 if (data) 1032 if (data)
1022 XFree ((char *)data); 1033 XFree ((char *)data);
1023} 1034}
cvs diff -r1.1.1.1.2.1 -r1.1.1.1.2.1.2.1 xsrc/external/mit/libXt/dist/src/Selection.c (expand / switch to unified diff)

--- xsrc/external/mit/libXt/dist/src/Selection.c 2009/09/17 03:33:20 1.1.1.1.2.1
+++ xsrc/external/mit/libXt/dist/src/Selection.c 2013/06/06 16:39:20 1.1.1.1.2.1.2.1
@@ -817,34 +817,36 @@ static void HandleSelectionEvents( @@ -817,34 +817,36 @@ static void HandleSelectionEvents(
817 ev.time = event->xselectionrequest.time; 817 ev.time = event->xselectionrequest.time;
818 ev.target = event->xselectionrequest.target; 818 ev.target = event->xselectionrequest.target;
819 if (event->xselectionrequest.property == None) /* obsolete requestor */ 819 if (event->xselectionrequest.property == None) /* obsolete requestor */
820 event->xselectionrequest.property = event->xselectionrequest.target; 820 event->xselectionrequest.property = event->xselectionrequest.target;
821 if (ctx->widget != widget || ctx->was_disowned 821 if (ctx->widget != widget || ctx->was_disowned
822 || ((event->xselectionrequest.time != CurrentTime) 822 || ((event->xselectionrequest.time != CurrentTime)
823 && (event->xselectionrequest.time < ctx->time))) 823 && (event->xselectionrequest.time < ctx->time)))
824 ev.property = None; 824 ev.property = None;
825 else { 825 else {
826 if (ev.target == ctx->prop_list->indirect_atom) { 826 if (ev.target == ctx->prop_list->indirect_atom) {
827 IndirectPair *p; 827 IndirectPair *p;
828 int format; 828 int format;
829 unsigned long bytesafter, length; 829 unsigned long bytesafter, length;
830 unsigned char *value; 830 unsigned char *value = NULL;
831 ev.property = event->xselectionrequest.property; 831 ev.property = event->xselectionrequest.property;
832 StartProtectedSection(ev.display, ev.requestor); 832 StartProtectedSection(ev.display, ev.requestor);
833 (void) XGetWindowProperty(ev.display, ev.requestor, 833 if (XGetWindowProperty(ev.display, ev.requestor,
834 event->xselectionrequest.property, 0L, 1000000, 834 event->xselectionrequest.property, 0L, 1000000,
835 False,(Atom)AnyPropertyType, &target, &format, &length, 835 False,(Atom)AnyPropertyType, &target, &format, &length,
836 &bytesafter, &value); 836 &bytesafter, &value) == Success)
837 count = BYTELENGTH(length, format) / sizeof(IndirectPair); 837 count = BYTELENGTH(length, format) / sizeof(IndirectPair);
 838 else
 839 count = 0;
838 for (p = (IndirectPair *)value; count; p++, count--) { 840 for (p = (IndirectPair *)value; count; p++, count--) {
839 EndProtectedSection(ctx->dpy); 841 EndProtectedSection(ctx->dpy);
840 if (!GetConversion(ctx, (XSelectionRequestEvent*)event, 842 if (!GetConversion(ctx, (XSelectionRequestEvent*)event,
841 p->target, p->property, widget)) { 843 p->target, p->property, widget)) {
842 844
843 p->target = None; 845 p->target = None;
844 writeback = TRUE; 846 writeback = TRUE;
845 StartProtectedSection(ctx->dpy, ev.requestor); 847 StartProtectedSection(ctx->dpy, ev.requestor);
846 } 848 }
847 } 849 }
848 if (writeback) 850 if (writeback)
849 XChangeProperty(ev.display, ev.requestor, 851 XChangeProperty(ev.display, ev.requestor,
850 event->xselectionrequest.property, target, 852 event->xselectionrequest.property, target,
@@ -1031,108 +1033,113 @@ void XtDisownSelection( @@ -1031,108 +1033,113 @@ void XtDisownSelection(
1031static Boolean IsINCRtype( 1033static Boolean IsINCRtype(
1032 CallBackInfo info, 1034 CallBackInfo info,
1033 Window window, 1035 Window window,
1034 Atom prop) 1036 Atom prop)
1035{ 1037{
1036 unsigned long bytesafter; 1038 unsigned long bytesafter;
1037 unsigned long length; 1039 unsigned long length;
1038 int format; 1040 int format;
1039 Atom type; 1041 Atom type;
1040 unsigned char *value; 1042 unsigned char *value;
1041 1043
1042 if (prop == None) return False; 1044 if (prop == None) return False;
1043 1045
1044 (void)XGetWindowProperty(XtDisplay(info->widget), window, prop, 0L, 0L, 1046 if (XGetWindowProperty(XtDisplay(info->widget), window, prop, 0L, 0L,
1045 False, info->ctx->prop_list->incr_atom, 1047 False, info->ctx->prop_list->incr_atom, &type,
1046 &type, &format, &length, &bytesafter, &value); 1048 &format, &length, &bytesafter, &value) != Success)
 1049 return False;
1047 1050
1048 return (type == info->ctx->prop_list->incr_atom); 1051 return (type == info->ctx->prop_list->incr_atom);
1049} 1052}
1050 1053
1051/*ARGSUSED*/ 1054/*ARGSUSED*/
1052static void ReqCleanup( 1055static void ReqCleanup(
1053 Widget widget, 1056 Widget widget,
1054 XtPointer closure, 1057 XtPointer closure,
1055 XEvent *ev, 1058 XEvent *ev,
1056 Boolean *cont) 1059 Boolean *cont)
1057{ 1060{
1058 CallBackInfo info = (CallBackInfo)closure; 1061 CallBackInfo info = (CallBackInfo)closure;
1059 unsigned long bytesafter, length; 1062 unsigned long bytesafter, length;
1060 char *value; 
1061 int format; 1063 int format;
1062 Atom target; 1064 Atom target;
1063 1065
1064 if (ev->type == SelectionNotify) { 1066 if (ev->type == SelectionNotify) {
1065 XSelectionEvent *event = (XSelectionEvent *) ev; 1067 XSelectionEvent *event = (XSelectionEvent *) ev;
1066 if (!MATCH_SELECT(event, info)) return; /* not really for us */ 1068 if (!MATCH_SELECT(event, info)) return; /* not really for us */
1067 XtRemoveEventHandler(widget, (EventMask)0, TRUE, 1069 XtRemoveEventHandler(widget, (EventMask)0, TRUE,
1068 ReqCleanup, (XtPointer) info ); 1070 ReqCleanup, (XtPointer) info );
1069 if (IsINCRtype(info, XtWindow(widget), event->property)) { 1071 if (IsINCRtype(info, XtWindow(widget), event->property)) {
1070 info->proc = HandleGetIncrement; 1072 info->proc = HandleGetIncrement;
1071 XtAddEventHandler(info->widget, (EventMask) PropertyChangeMask, 1073 XtAddEventHandler(info->widget, (EventMask) PropertyChangeMask,
1072 FALSE, ReqCleanup, (XtPointer) info); 1074 FALSE, ReqCleanup, (XtPointer) info);
1073 } else { 1075 } else {
1074 if (event->property != None) 1076 if (event->property != None)
1075 XDeleteProperty(event->display, XtWindow(widget), 1077 XDeleteProperty(event->display, XtWindow(widget),
1076 event->property); 1078 event->property);
1077 FreeSelectionProperty(XtDisplay(widget), info->property); 1079 FreeSelectionProperty(XtDisplay(widget), info->property);
1078 FreeInfo(info); 1080 FreeInfo(info);
1079 } 1081 }
1080 } else if ((ev->type == PropertyNotify) && 1082 } else if ((ev->type == PropertyNotify) &&
1081 (ev->xproperty.state == PropertyNewValue) && 1083 (ev->xproperty.state == PropertyNewValue) &&
1082 (ev->xproperty.atom == info->property)) { 1084 (ev->xproperty.atom == info->property)) {
1083 XPropertyEvent *event = (XPropertyEvent *) ev; 1085 XPropertyEvent *event = (XPropertyEvent *) ev;
1084 (void) XGetWindowProperty(event->display, XtWindow(widget), 1086 char *value = NULL;
1085 event->atom, 0L, 1000000, True, AnyPropertyType, 1087 if (XGetWindowProperty(event->display, XtWindow(widget),
1086 &target, &format, &length, &bytesafter, 1088 event->atom, 0L, 1000000, True, AnyPropertyType,
1087 (unsigned char **) &value); 1089 &target, &format, &length, &bytesafter,
1088 XFree(value); 1090 (unsigned char **) &value) == Success) {
1089 if (length == 0) { 1091 XFree(value);
1090 XtRemoveEventHandler(widget, (EventMask) PropertyChangeMask, FALSE, 1092 if (length == 0) {
1091 ReqCleanup, (XtPointer) info ); 1093 XtRemoveEventHandler(widget, (EventMask) PropertyChangeMask,
1092 FreeSelectionProperty(XtDisplay(widget), info->property); 1094 FALSE, ReqCleanup, (XtPointer) info );
1093 XtFree(info->value); /* requestor never got this, so free now */ 1095 FreeSelectionProperty(XtDisplay(widget), info->property);
1094 FreeInfo(info); 1096 XtFree(info->value); /* requestor never got this, so free now */
 1097 FreeInfo(info);
 1098 }
1095 } 1099 }
1096 } 1100 }
1097} 1101}
1098 1102
1099/* ARGSUSED */ 1103/* ARGSUSED */
1100static void ReqTimedOut( 1104static void ReqTimedOut(
1101 XtPointer closure, 1105 XtPointer closure,
1102 XtIntervalId *id) 1106 XtIntervalId *id)
1103{ 1107{
1104 XtPointer value = NULL; 1108 XtPointer value = NULL;
1105 unsigned long length = 0; 1109 unsigned long length = 0;
1106 int format = 8; 1110 int format = 8;
1107 Atom resulttype = XT_CONVERT_FAIL; 1111 Atom resulttype = XT_CONVERT_FAIL;
1108 CallBackInfo info = (CallBackInfo)closure; 1112 CallBackInfo info = (CallBackInfo)closure;
1109 unsigned long bytesafter; 1113 unsigned long bytesafter;
1110 unsigned long proplength; 1114 unsigned long proplength;
1111 Atom type; 1115 Atom type;
1112 IndirectPair *pairs; 
1113 XtPointer *c; 1116 XtPointer *c;
1114 int i; 1117 int i;
1115 1118
1116 if (*info->target == info->ctx->prop_list->indirect_atom) { 1119 if (*info->target == info->ctx->prop_list->indirect_atom) {
1117 (void) XGetWindowProperty(XtDisplay(info->widget), 1120 IndirectPair *pairs = NULL;
1118 XtWindow(info->widget), info->property, 0L, 1121 if (XGetWindowProperty(XtDisplay(info->widget), XtWindow(info->widget),
1119 10000000, True, AnyPropertyType, &type, &format, 1122 info->property, 0L, 10000000, True,
1120 &proplength, &bytesafter, (unsigned char **) &pairs); 1123 AnyPropertyType, &type, &format, &proplength,
1121 XFree((char*)pairs); 1124 &bytesafter, (unsigned char **) &pairs)
1122 for (proplength = proplength / IndirectPairWordSize, i = 0, c = info->req_closure; 1125 == Success) {
1123 proplength; proplength--, c++, i++) 1126 XFree(pairs);
1124 (*info->callbacks[i])(info->widget, *c, 1127 for (proplength = proplength / IndirectPairWordSize, i = 0,
1125 &info->ctx->selection, &resulttype, value, &length, &format); 1128 c = info->req_closure;
 1129 proplength; proplength--, c++, i++)
 1130 (*info->callbacks[i])(info->widget, *c, &info->ctx->selection,
 1131 &resulttype, value, &length, &format);
 1132 }
1126 } else { 1133 } else {
1127 (*info->callbacks[0])(info->widget, *info->req_closure, 1134 (*info->callbacks[0])(info->widget, *info->req_closure,
1128 &info->ctx->selection, &resulttype, value, &length, &format); 1135 &info->ctx->selection, &resulttype, value, &length, &format);
1129 } 1136 }
1130 1137
1131 /* change event handlers for straggler events */ 1138 /* change event handlers for straggler events */
1132 if (info->proc == (XtEventHandler)HandleSelectionReplies) { 1139 if (info->proc == (XtEventHandler)HandleSelectionReplies) {
1133 XtRemoveEventHandler(info->widget, (EventMask)0, 1140 XtRemoveEventHandler(info->widget, (EventMask)0,
1134 TRUE, info->proc, (XtPointer) info); 1141 TRUE, info->proc, (XtPointer) info);
1135 XtAddEventHandler(info->widget, (EventMask)0, TRUE, 1142 XtAddEventHandler(info->widget, (EventMask)0, TRUE,
1136 ReqCleanup, (XtPointer) info); 1143 ReqCleanup, (XtPointer) info);
1137 } else { 1144 } else {
1138 XtRemoveEventHandler(info->widget,(EventMask) PropertyChangeMask, 1145 XtRemoveEventHandler(info->widget,(EventMask) PropertyChangeMask,
@@ -1258,32 +1265,33 @@ static long IncrPropSize( @@ -1258,32 +1265,33 @@ static long IncrPropSize(
1258static 1265static
1259Boolean HandleNormal( 1266Boolean HandleNormal(
1260 Display *dpy, 1267 Display *dpy,
1261 Widget widget, 1268 Widget widget,
1262 Atom property, 1269 Atom property,
1263 CallBackInfo info, 1270 CallBackInfo info,
1264 XtPointer closure, 1271 XtPointer closure,
1265 Atom selection) 1272 Atom selection)
1266{ 1273{
1267 unsigned long bytesafter; 1274 unsigned long bytesafter;
1268 unsigned long length; 1275 unsigned long length;
1269 int format; 1276 int format;
1270 Atom type; 1277 Atom type;
1271 unsigned char *value; 1278 unsigned char *value = NULL;
1272 int number = info->current; 1279 int number = info->current;
1273 1280
1274 (void) XGetWindowProperty(dpy, XtWindow(widget), property, 0L, 1281 if (XGetWindowProperty(dpy, XtWindow(widget), property, 0L, 10000000,
1275 10000000, False, AnyPropertyType, 1282 False, AnyPropertyType, &type, &format, &length,
1276 &type, &format, &length, &bytesafter, &value); 1283 &bytesafter, &value) != Success)
 1284 return FALSE;
1277 1285
1278 if (type == info->ctx->prop_list->incr_atom) { 1286 if (type == info->ctx->prop_list->incr_atom) {
1279 unsigned long size = IncrPropSize(widget, value, format, length); 1287 unsigned long size = IncrPropSize(widget, value, format, length);
1280 XFree((char *)value); 1288 XFree((char *)value);
1281 if (info->property != property) { 1289 if (info->property != property) {
1282 /* within MULTIPLE */ 1290 /* within MULTIPLE */
1283 CallBackInfo ninfo; 1291 CallBackInfo ninfo;
1284 ninfo = MakeInfo(info->ctx, &info->callbacks[number], 1292 ninfo = MakeInfo(info->ctx, &info->callbacks[number],
1285 &info->req_closure[number], 1, widget, 1293 &info->req_closure[number], 1, widget,
1286 info->time, &info->incremental[number], &property); 1294 info->time, &info->incremental[number], &property);
1287 ninfo->target = (Atom *) __XtMalloc((unsigned) sizeof(Atom)); 1295 ninfo->target = (Atom *) __XtMalloc((unsigned) sizeof(Atom));
1288 *ninfo->target = info->target[number + 1]; 1296 *ninfo->target = info->target[number + 1];
1289 info = ninfo; 1297 info = ninfo;
@@ -1348,44 +1356,46 @@ static void HandleIncremental( @@ -1348,44 +1356,46 @@ static void HandleIncremental(
1348} 1356}
1349 1357
1350/*ARGSUSED*/ 1358/*ARGSUSED*/
1351static void HandleSelectionReplies( 1359static void HandleSelectionReplies(
1352 Widget widget, 1360 Widget widget,
1353 XtPointer closure, 1361 XtPointer closure,
1354 XEvent *ev, 1362 XEvent *ev,
1355 Boolean *cont) 1363 Boolean *cont)
1356{ 1364{
1357 XSelectionEvent *event = (XSelectionEvent *) ev; 1365 XSelectionEvent *event = (XSelectionEvent *) ev;
1358 Display *dpy = event->display; 1366 Display *dpy = event->display;
1359 CallBackInfo info = (CallBackInfo) closure; 1367 CallBackInfo info = (CallBackInfo) closure;
1360 Select ctx = info->ctx; 1368 Select ctx = info->ctx;
1361 IndirectPair *pairs, *p; 
1362 unsigned long bytesafter; 1369 unsigned long bytesafter;
1363 unsigned long length; 1370 unsigned long length;
1364 int format; 1371 int format;
1365 Atom type; 1372 Atom type;
1366 XtPointer *c; 1373 XtPointer *c;
1367 1374
1368 if (event->type != SelectionNotify) return; 1375 if (event->type != SelectionNotify) return;
1369 if (!MATCH_SELECT(event, info)) return; /* not really for us */ 1376 if (!MATCH_SELECT(event, info)) return; /* not really for us */
1370#ifndef DEBUG_WO_TIMERS 1377#ifndef DEBUG_WO_TIMERS
1371 XtRemoveTimeOut(info->timeout); 1378 XtRemoveTimeOut(info->timeout);
1372#endif 1379#endif
1373 XtRemoveEventHandler(widget, (EventMask)0, TRUE, 1380 XtRemoveEventHandler(widget, (EventMask)0, TRUE,
1374 HandleSelectionReplies, (XtPointer) info ); 1381 HandleSelectionReplies, (XtPointer) info );
1375 if (event->target == ctx->prop_list->indirect_atom) { 1382 if (event->target == ctx->prop_list->indirect_atom) {
1376 (void) XGetWindowProperty(dpy, XtWindow(widget), info->property, 0L, 1383 IndirectPair *pairs = NULL, *p;
1377 10000000, True, AnyPropertyType, &type, &format, 1384 if (XGetWindowProperty(dpy, XtWindow(widget), info->property, 0L,
1378 &length, &bytesafter, (unsigned char **) &pairs); 1385 10000000, True, AnyPropertyType, &type, &format,
 1386 &length, &bytesafter, (unsigned char **) &pairs)
 1387 != Success)
 1388 length = 0;
1379 for (length = length / IndirectPairWordSize, p = pairs, 1389 for (length = length / IndirectPairWordSize, p = pairs,
1380 c = info->req_closure; 1390 c = info->req_closure;
1381 length; length--, p++, c++, info->current++) { 1391 length; length--, p++, c++, info->current++) {
1382 if (event->property == None || format != 32 || p->target == None 1392 if (event->property == None || format != 32 || p->target == None
1383 || /* bug compatibility */ p->property == None) { 1393 || /* bug compatibility */ p->property == None) {
1384 HandleNone(widget, info->callbacks[info->current], 1394 HandleNone(widget, info->callbacks[info->current],
1385 *c, event->selection); 1395 *c, event->selection);
1386 if (p->property != None) 1396 if (p->property != None)
1387 FreeSelectionProperty(XtDisplay(widget), p->property); 1397 FreeSelectionProperty(XtDisplay(widget), p->property);
1388 } else { 1398 } else {
1389 if (HandleNormal(dpy, widget, p->property, info, *c, 1399 if (HandleNormal(dpy, widget, p->property, info, *c,
1390 event->selection)) { 1400 event->selection)) {
1391 FreeSelectionProperty(XtDisplay(widget), p->property); 1401 FreeSelectionProperty(XtDisplay(widget), p->property);
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXv/dist/src/Xv.c (expand / switch to unified diff)

--- xsrc/external/mit/libXv/dist/src/Xv.c 2008/07/30 02:57:12 1.1.1.1
+++ xsrc/external/mit/libXv/dist/src/Xv.c 2013/06/06 16:39:20 1.1.1.1.6.1
@@ -46,26 +46,27 @@ SOFTWARE. @@ -46,26 +46,27 @@ SOFTWARE.
46** 15.05.91 Carver 46** 15.05.91 Carver
47** - version 2.0 upgrade 47** - version 2.0 upgrade
48** 48**
49** 240.01.91 Carver 49** 240.01.91 Carver
50** - version 1.4 upgrade 50** - version 1.4 upgrade
51** 51**
52*/ 52*/
53 53
54#include <stdio.h> 54#include <stdio.h>
55#include "Xvlibint.h" 55#include "Xvlibint.h"
56#include <X11/extensions/Xext.h> 56#include <X11/extensions/Xext.h>
57#include <X11/extensions/extutil.h> 57#include <X11/extensions/extutil.h>
58#include <X11/extensions/XShm.h> 58#include <X11/extensions/XShm.h>
 59#include <limits.h>
59 60
60static XExtensionInfo _xv_info_data; 61static XExtensionInfo _xv_info_data;
61static XExtensionInfo *xv_info = &_xv_info_data; 62static XExtensionInfo *xv_info = &_xv_info_data;
62static char *xv_extension_name = XvName; 63static char *xv_extension_name = XvName;
63 64
64#define XvCheckExtension(dpy, i, val) \ 65#define XvCheckExtension(dpy, i, val) \
65 XextCheckExtension(dpy, i, xv_extension_name, val) 66 XextCheckExtension(dpy, i, xv_extension_name, val)
66 67
67static char *xv_error_string(Display *dpy, int code, XExtCodes *codes, 68static char *xv_error_string(Display *dpy, int code, XExtCodes *codes,
68 char * buf, int n); 69 char * buf, int n);
69static int xv_close_display(Display *dpy, XExtCodes *codes); 70static int xv_close_display(Display *dpy, XExtCodes *codes);
70static Bool xv_wire_to_event(Display *dpy, XEvent *host, xEvent *wire); 71static Bool xv_wire_to_event(Display *dpy, XEvent *host, xEvent *wire);
71 72
@@ -827,41 +828,53 @@ XvQueryPortAttributes(Display *dpy, XvPo @@ -827,41 +828,53 @@ XvQueryPortAttributes(Display *dpy, XvPo
827 828
828 XvGetReq(QueryPortAttributes, req); 829 XvGetReq(QueryPortAttributes, req);
829 req->port = port; 830 req->port = port;
830 831
831 /* READ THE REPLY */ 832 /* READ THE REPLY */
832 833
833 if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) { 834 if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) {
834 UnlockDisplay(dpy); 835 UnlockDisplay(dpy);
835 SyncHandle(); 836 SyncHandle();
836 return ret; 837 return ret;
837 } 838 }
838 839
839 if(rep.num_attributes) { 840 if(rep.num_attributes) {
840 int size = (rep.num_attributes * sizeof(XvAttribute)) + rep.text_size; 841 unsigned long size;
 842 /* limit each part to no more than one half the max size */
 843 if ((rep.num_attributes < ((INT_MAX / 2) / sizeof(XvAttribute))) &&
 844 (rep.text_size < (INT_MAX / 2))) {
 845 size = (rep.num_attributes * sizeof(XvAttribute)) + rep.text_size;
 846 ret = Xmalloc(size);
 847 }
841 848
842 if((ret = Xmalloc(size))) { 849 if (ret != NULL) {
843 char* marker = (char*)(&ret[rep.num_attributes]); 850 char* marker = (char*)(&ret[rep.num_attributes]);
844 xvAttributeInfo Info; 851 xvAttributeInfo Info;
845 int i; 852 int i;
 853
 854 /* keep track of remaining room for text strings */
 855 size = rep.text_size;
846  856
847 for(i = 0; i < rep.num_attributes; i++) { 857 for(i = 0; i < rep.num_attributes; i++) {
848 _XRead(dpy, (char*)(&Info), sz_xvAttributeInfo); 858 _XRead(dpy, (char*)(&Info), sz_xvAttributeInfo);
849 ret[i].flags = (int)Info.flags;  859 ret[i].flags = (int)Info.flags;
850 ret[i].min_value = Info.min;  860 ret[i].min_value = Info.min;
851 ret[i].max_value = Info.max;  861 ret[i].max_value = Info.max;
852 ret[i].name = marker; 862 ret[i].name = marker;
853 _XRead(dpy, marker, Info.size); 863 if (Info.size <= size) {
854 marker += Info.size; 864 _XRead(dpy, marker, Info.size);
 865 marker += Info.size;
 866 size -= Info.size;
 867 }
855 (*num)++; 868 (*num)++;
856 } 869 }
857 } else 870 } else
858 _XEatData(dpy, rep.length << 2); 871 _XEatData(dpy, rep.length << 2);
859 } 872 }
860 873
861 UnlockDisplay(dpy); 874 UnlockDisplay(dpy);
862 SyncHandle(); 875 SyncHandle();
863 876
864 return ret; 877 return ret;
865} 878}
866 879
867XvImageFormatValues * XvListImageFormats ( 880XvImageFormatValues * XvListImageFormats (
@@ -882,29 +895,30 @@ XvImageFormatValues * XvListImageFormats @@ -882,29 +895,30 @@ XvImageFormatValues * XvListImageFormats
882 895
883 XvGetReq(ListImageFormats, req); 896 XvGetReq(ListImageFormats, req);
884 req->port = port; 897 req->port = port;
885 898
886 /* READ THE REPLY */ 899 /* READ THE REPLY */
887 900
888 if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) { 901 if (_XReply(dpy, (xReply *)&rep, 0, xFalse) == 0) {
889 UnlockDisplay(dpy); 902 UnlockDisplay(dpy);
890 SyncHandle(); 903 SyncHandle();
891 return NULL; 904 return NULL;
892 } 905 }
893 906
894 if(rep.num_formats) { 907 if(rep.num_formats) {
895 int size = (rep.num_formats * sizeof(XvImageFormatValues)); 908 if (rep.num_formats < (INT_MAX / sizeof(XvImageFormatValues)))
 909 ret = Xmalloc(rep.num_formats * sizeof(XvImageFormatValues));
896 910
897 if((ret = Xmalloc(size))) { 911 if (ret != NULL) {
898 xvImageFormatInfo Info; 912 xvImageFormatInfo Info;
899 int i; 913 int i;
900  914
901 for(i = 0; i < rep.num_formats; i++) { 915 for(i = 0; i < rep.num_formats; i++) {
902 _XRead(dpy, (char*)(&Info), sz_xvImageFormatInfo); 916 _XRead(dpy, (char*)(&Info), sz_xvImageFormatInfo);
903 ret[i].id = Info.id;  917 ret[i].id = Info.id;
904 ret[i].type = Info.type;  918 ret[i].type = Info.type;
905 ret[i].byte_order = Info.byte_order;  919 ret[i].byte_order = Info.byte_order;
906 memcpy(&(ret[i].guid[0]), &(Info.guid[0]), 16); 920 memcpy(&(ret[i].guid[0]), &(Info.guid[0]), 16);
907 ret[i].bits_per_pixel = Info.bpp;  921 ret[i].bits_per_pixel = Info.bpp;
908 ret[i].format = Info.format;  922 ret[i].format = Info.format;
909 ret[i].num_planes = Info.num_planes;  923 ret[i].num_planes = Info.num_planes;
910 ret[i].depth = Info.depth;  924 ret[i].depth = Info.depth;
@@ -955,27 +969,30 @@ XvImage * XvCreateImage ( @@ -955,27 +969,30 @@ XvImage * XvCreateImage (
955 req->id = id; 969 req->id = id;
956 req->port = port; 970 req->port = port;
957 req->width = width; 971 req->width = width;
958 req->height = height; 972 req->height = height;
959 973
960 /* READ THE REPLY */ 974 /* READ THE REPLY */
961 975
962 if (!_XReply(dpy, (xReply *)&rep, 0, xFalse)) { 976 if (!_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
963 UnlockDisplay(dpy); 977 UnlockDisplay(dpy);
964 SyncHandle(); 978 SyncHandle();
965 return NULL; 979 return NULL;
966 } 980 }
967 981
968 if((ret = (XvImage*)Xmalloc(sizeof(XvImage) + (rep.num_planes << 3)))) { 982 if (rep.num_planes < ((INT_MAX >> 3) - sizeof(XvImage)))
 983 ret = Xmalloc(sizeof(XvImage) + (rep.num_planes << 3));
 984
 985 if (ret != NULL) {
969 ret->id = id; 986 ret->id = id;
970 ret->width = rep.width; 987 ret->width = rep.width;
971 ret->height = rep.height; 988 ret->height = rep.height;
972 ret->data_size = rep.data_size; 989 ret->data_size = rep.data_size;
973 ret->num_planes = rep.num_planes; 990 ret->num_planes = rep.num_planes;
974 ret->pitches = (int*)(&ret[1]); 991 ret->pitches = (int*)(&ret[1]);
975 ret->offsets = ret->pitches + rep.num_planes; 992 ret->offsets = ret->pitches + rep.num_planes;
976 ret->data = data; 993 ret->data = data;
977 ret->obdata = NULL; 994 ret->obdata = NULL;
978 _XRead(dpy, (char*)(ret->pitches), rep.num_planes << 2); 995 _XRead(dpy, (char*)(ret->pitches), rep.num_planes << 2);
979 _XRead(dpy, (char*)(ret->offsets), rep.num_planes << 2); 996 _XRead(dpy, (char*)(ret->offsets), rep.num_planes << 2);
980 } else 997 } else
981 _XEatData(dpy, rep.length << 2); 998 _XEatData(dpy, rep.length << 2);
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXvMC/dist/src/XvMC.c (expand / switch to unified diff)

--- xsrc/external/mit/libXvMC/dist/src/XvMC.c 2008/07/30 02:57:22 1.1.1.1
+++ xsrc/external/mit/libXvMC/dist/src/XvMC.c 2013/06/06 16:39:20 1.1.1.1.6.1
@@ -10,26 +10,27 @@ @@ -10,26 +10,27 @@
10#ifdef HAS_SHM 10#ifdef HAS_SHM
11#ifndef Lynx 11#ifndef Lynx
12#include <sys/ipc.h> 12#include <sys/ipc.h>
13#include <sys/shm.h> 13#include <sys/shm.h>
14#else 14#else
15#include <ipc.h> 15#include <ipc.h>
16#include <shm.h> 16#include <shm.h>
17#endif /* Lynx */ 17#endif /* Lynx */
18#endif /* HAS_SHM */ 18#endif /* HAS_SHM */
19#include <unistd.h> 19#include <unistd.h>
20#include <sys/time.h> 20#include <sys/time.h>
21#include <X11/extensions/Xext.h> 21#include <X11/extensions/Xext.h>
22#include <X11/extensions/extutil.h> 22#include <X11/extensions/extutil.h>
 23#include <limits.h>
23 24
24static XExtensionInfo _xvmc_info_data; 25static XExtensionInfo _xvmc_info_data;
25static XExtensionInfo *xvmc_info = &_xvmc_info_data; 26static XExtensionInfo *xvmc_info = &_xvmc_info_data;
26static char *xvmc_extension_name = XvMCName; 27static char *xvmc_extension_name = XvMCName;
27 28
28static char *xvmc_error_list[] = 29static char *xvmc_error_list[] =
29{ 30{
30 "BadContext", 31 "BadContext",
31 "BadSurface", 32 "BadSurface",
32 "BadSubpicture" 33 "BadSubpicture"
33}; 34};
34 35
35static XEXT_GENERATE_CLOSE_DISPLAY (xvmc_close_display, xvmc_info) 36static XEXT_GENERATE_CLOSE_DISPLAY (xvmc_close_display, xvmc_info)
@@ -105,28 +106,28 @@ XvMCSurfaceInfo * XvMCListSurfaceTypes(D @@ -105,28 +106,28 @@ XvMCSurfaceInfo * XvMCListSurfaceTypes(D
105 106
106 XvMCCheckExtension (dpy, info, NULL); 107 XvMCCheckExtension (dpy, info, NULL);
107  108
108 LockDisplay (dpy); 109 LockDisplay (dpy);
109 XvMCGetReq (ListSurfaceTypes, req); 110 XvMCGetReq (ListSurfaceTypes, req);
110 req->port = port; 111 req->port = port;
111 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 112 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
112 UnlockDisplay (dpy); 113 UnlockDisplay (dpy);
113 SyncHandle (); 114 SyncHandle ();
114 return NULL; 115 return NULL;
115 } 116 }
116 117
117 if(rep.num > 0) { 118 if(rep.num > 0) {
118 surface_info =  119 if (rep.num < (INT_MAX / sizeof(XvMCSurfaceInfo)))
119 (XvMCSurfaceInfo*)Xmalloc(rep.num * sizeof(XvMCSurfaceInfo)); 120 surface_info = Xmalloc(rep.num * sizeof(XvMCSurfaceInfo));
120 121
121 if(surface_info) { 122 if(surface_info) {
122 xvmcSurfaceInfo sinfo; 123 xvmcSurfaceInfo sinfo;
123 int i; 124 int i;
124 125
125 *num = rep.num; 126 *num = rep.num;
126 127
127 for(i = 0; i < rep.num; i++) { 128 for(i = 0; i < rep.num; i++) {
128 _XRead(dpy, (char*)&sinfo, sizeof(xvmcSurfaceInfo)); 129 _XRead(dpy, (char*)&sinfo, sizeof(xvmcSurfaceInfo));
129 surface_info[i].surface_type_id = sinfo.surface_type_id; 130 surface_info[i].surface_type_id = sinfo.surface_type_id;
130 surface_info[i].chroma_format = sinfo.chroma_format; 131 surface_info[i].chroma_format = sinfo.chroma_format;
131 surface_info[i].max_width = sinfo.max_width; 132 surface_info[i].max_width = sinfo.max_width;
132 surface_info[i].max_height = sinfo.max_height; 133 surface_info[i].max_height = sinfo.max_height;
@@ -166,28 +167,28 @@ XvImageFormatValues * XvMCListSubpicture @@ -166,28 +167,28 @@ XvImageFormatValues * XvMCListSubpicture
166 167
167 168
168 LockDisplay (dpy); 169 LockDisplay (dpy);
169 XvMCGetReq (ListSubpictureTypes, req); 170 XvMCGetReq (ListSubpictureTypes, req);
170 req->port = port; 171 req->port = port;
171 req->surface_type_id = surface_type_id; 172 req->surface_type_id = surface_type_id;
172 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 173 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
173 UnlockDisplay (dpy); 174 UnlockDisplay (dpy);
174 SyncHandle (); 175 SyncHandle ();
175 return NULL; 176 return NULL;
176 } 177 }
177 178
178 if(rep.num > 0) { 179 if(rep.num > 0) {
179 ret =  180 if (rep.num < (INT_MAX / sizeof(XvImageFormatValues)))
180 (XvImageFormatValues*)Xmalloc(rep.num * sizeof(XvImageFormatValues)); 181 ret = Xmalloc(rep.num * sizeof(XvImageFormatValues));
181 182
182 if(ret) { 183 if(ret) {
183 xvImageFormatInfo Info; 184 xvImageFormatInfo Info;
184 int i; 185 int i;
185 186
186 *count_return = rep.num; 187 *count_return = rep.num;
187 188
188 for(i = 0; i < rep.num; i++) { 189 for(i = 0; i < rep.num; i++) {
189 _XRead(dpy, (char*)(&Info), sz_xvImageFormatInfo); 190 _XRead(dpy, (char*)(&Info), sz_xvImageFormatInfo);
190 ret[i].id = Info.id;  191 ret[i].id = Info.id;
191 ret[i].type = Info.type;  192 ret[i].type = Info.type;
192 ret[i].byte_order = Info.byte_order;  193 ret[i].byte_order = Info.byte_order;
193 memcpy(&(ret[i].guid[0]), &(Info.guid[0]), 16); 194 memcpy(&(ret[i].guid[0]), &(Info.guid[0]), 16);
@@ -478,37 +479,39 @@ Status _xvmc_destroy_subpicture( @@ -478,37 +479,39 @@ Status _xvmc_destroy_subpicture(
478 SyncHandle (); 479 SyncHandle ();
479 return Success; 480 return Success;
480} 481}
481 482
482Status XvMCGetDRInfo(Display *dpy, XvPortID port, 483Status XvMCGetDRInfo(Display *dpy, XvPortID port,
483 char **name, char **busID,  484 char **name, char **busID,
484 int *major, int *minor,  485 int *major, int *minor,
485 int *patchLevel, 486 int *patchLevel,
486 int *isLocal) 487 int *isLocal)
487{ 488{
488 XExtDisplayInfo *info = xvmc_find_display(dpy); 489 XExtDisplayInfo *info = xvmc_find_display(dpy);
489 xvmcGetDRInfoReply rep; 490 xvmcGetDRInfoReply rep;
490 xvmcGetDRInfoReq *req; 491 xvmcGetDRInfoReq *req;
491 char *tmpBuf = NULL; 
492 CARD32 magic; 492 CARD32 magic;
493 493
494#ifdef HAS_SHM 494#ifdef HAS_SHM
495 volatile CARD32 *shMem; 495 volatile CARD32 *shMem;
496 struct timezone here; 496 struct timezone here;
497 struct timeval now; 497 struct timeval now;
498 here.tz_minuteswest = 0; 498 here.tz_minuteswest = 0;
499 here.tz_dsttime = 0; 499 here.tz_dsttime = 0;
500#endif 500#endif
501 501
 502 *name = NULL;
 503 *busID = NULL;
 504
502 XvMCCheckExtension (dpy, info, BadImplementation); 505 XvMCCheckExtension (dpy, info, BadImplementation);
503 506
504 LockDisplay (dpy); 507 LockDisplay (dpy);
505 XvMCGetReq (GetDRInfo, req); 508 XvMCGetReq (GetDRInfo, req);
506 509
507 req->port = port; 510 req->port = port;
508 magic = 0; 511 magic = 0;
509 req->magic = 0; 512 req->magic = 0;
510#ifdef HAS_SHM  513#ifdef HAS_SHM
511 req->shmKey = shmget(IPC_PRIVATE, 1024, IPC_CREAT | 0600); 514 req->shmKey = shmget(IPC_PRIVATE, 1024, IPC_CREAT | 0600);
512 515
513 /* 516 /*
514 * We fill a shared memory page with a repetitive pattern. If the 517 * We fill a shared memory page with a repetitive pattern. If the
@@ -547,51 +550,52 @@ Status XvMCGetDRInfo(Display *dpy, XvPor @@ -547,51 +550,52 @@ Status XvMCGetDRInfo(Display *dpy, XvPor
547 SyncHandle (); 550 SyncHandle ();
548#ifdef HAS_SHM 551#ifdef HAS_SHM
549 if ( req->shmKey >= 0) { 552 if ( req->shmKey >= 0) {
550 shmdt( (const void *) shMem ); 553 shmdt( (const void *) shMem );
551 }  554 }
552#endif 555#endif
553 return -1; 556 return -1;
554 } 557 }
555#ifdef HAS_SHM 558#ifdef HAS_SHM
556 shmdt( (const void *) shMem ); 559 shmdt( (const void *) shMem );
557#endif 560#endif
558 561
559 if (rep.length > 0) { 562 if (rep.length > 0) {
 563 unsigned long realSize = 0;
 564 char *tmpBuf = NULL;
560 565
561 int realSize = rep.length << 2; 566 if (rep.length < (INT_MAX >> 2)) {
 567 realSize = rep.length << 2;
 568 if (realSize >= (rep.nameLen + rep.busIDLen)) {
 569 tmpBuf = Xmalloc(realSize);
 570 *name = Xmalloc(rep.nameLen);
 571 *busID = Xmalloc(rep.busIDLen);
562 572
563 tmpBuf = (char *) Xmalloc(realSize); 
564 if (tmpBuf) { 
565 *name = (char *) Xmalloc(rep.nameLen); 
566 if (*name) { 
567 *busID = (char *) Xmalloc(rep.busIDLen); 
568 if (! *busID) { 
569 XFree(*name); 
570 XFree(tmpBuf); 
571 } 
572 } else { 
573 XFree(tmpBuf); 
574 }  573 }
575 } 574 }
576 575
577 if (*name && *busID && tmpBuf) { 576 if (*name && *busID && tmpBuf) {
578 
579 _XRead(dpy, tmpBuf, realSize); 577 _XRead(dpy, tmpBuf, realSize);
580 strncpy(*name,tmpBuf,rep.nameLen); 578 strncpy(*name,tmpBuf,rep.nameLen);
 579 name[rep.nameLen - 1] = '\0';
581 strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen); 580 strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen);
 581 busID[rep.busIDLen - 1] = '\0';
582 XFree(tmpBuf); 582 XFree(tmpBuf);
583 
584 } else { 583 } else {
 584 XFree(*name);
 585 *name = NULL;
 586 XFree(*busID);
 587 *name = NULL;
 588 XFree(tmpBuf);
585 589
586 _XEatData(dpy, realSize); 590 _XEatData(dpy, realSize);
587 UnlockDisplay (dpy); 591 UnlockDisplay (dpy);
588 SyncHandle (); 592 SyncHandle ();
589 return -1; 593 return -1;
590 594
591 } 595 }
592 } 596 }
593 597
594 UnlockDisplay (dpy); 598 UnlockDisplay (dpy);
595 SyncHandle (); 599 SyncHandle ();
596 *major = rep.major; 600 *major = rep.major;
597 *minor = rep.minor; 601 *minor = rep.minor;
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXxf86dga/dist/src/XF86DGA2.c (expand / switch to unified diff)

--- xsrc/external/mit/libXxf86dga/dist/src/XF86DGA2.c 2008/07/30 02:57:52 1.1.1.1
+++ xsrc/external/mit/libXxf86dga/dist/src/XF86DGA2.c 2013/06/06 16:39:20 1.1.1.1.6.1
@@ -13,26 +13,27 @@ Copyright (c) 1995,1996 The XFree86 Pro @@ -13,26 +13,27 @@ Copyright (c) 1995,1996 The XFree86 Pro
13#define INCL_DOSIOCTL 13#define INCL_DOSIOCTL
14#define I_NEED_OS2_H 14#define I_NEED_OS2_H
15#include <os2.h> 15#include <os2.h>
16#endif 16#endif
17 17
18#define NEED_EVENTS 18#define NEED_EVENTS
19#define NEED_REPLIES 19#define NEED_REPLIES
20#include <X11/Xlibint.h> 20#include <X11/Xlibint.h>
21#include <X11/extensions/xf86dga.h> 21#include <X11/extensions/xf86dga.h>
22#include <X11/extensions/xf86dgastr.h> 22#include <X11/extensions/xf86dgastr.h>
23#include <X11/extensions/Xext.h> 23#include <X11/extensions/Xext.h>
24#include <X11/extensions/extutil.h> 24#include <X11/extensions/extutil.h>
25#include <stdio.h> 25#include <stdio.h>
 26#include <limits.h>
26 27
27 28
28/* If you change this, change the Bases[] array below as well */ 29/* If you change this, change the Bases[] array below as well */
29#define MAX_HEADS 16 30#define MAX_HEADS 16
30 31
31char *xdga_extension_name = XF86DGANAME; 32char *xdga_extension_name = XF86DGANAME;
32 33
33static XExtensionInfo _xdga_info_data; 34static XExtensionInfo _xdga_info_data;
34static XExtensionInfo *xdga_info = &_xdga_info_data; 35static XExtensionInfo *xdga_info = &_xdga_info_data;
35 36
36  37
37Bool XDGAMapFramebuffer(int, char *, unsigned char*, CARD32, CARD32, CARD32); 38Bool XDGAMapFramebuffer(int, char *, unsigned char*, CARD32, CARD32, CARD32);
38void XDGAUnmapFramebuffer(int); 39void XDGAUnmapFramebuffer(int);
@@ -289,36 +290,41 @@ XDGAMode* XDGAQueryModes( @@ -289,36 +290,41 @@ XDGAMode* XDGAQueryModes(
289 *num = 0; 290 *num = 0;
290 291
291 XDGACheckExtension (dpy, dinfo, NULL); 292 XDGACheckExtension (dpy, dinfo, NULL);
292 293
293 LockDisplay(dpy); 294 LockDisplay(dpy);
294 GetReq(XDGAQueryModes, req); 295 GetReq(XDGAQueryModes, req);
295 req->reqType = dinfo->codes->major_opcode; 296 req->reqType = dinfo->codes->major_opcode;
296 req->dgaReqType = X_XDGAQueryModes; 297 req->dgaReqType = X_XDGAQueryModes;
297 req->screen = screen; 298 req->screen = screen;
298 299
299 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) { 300 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
300 if(rep.length) { 301 if(rep.length) {
301 xXDGAModeInfo info; 302 xXDGAModeInfo info;
302 int i, size; 303 unsigned long size = 0;
303 char *offset; 304 char *offset;
304 305
305 size = rep.length << 2; 306 if ((rep.length < (INT_MAX >> 2)) &&
306 size -= rep.number * sz_xXDGAModeInfo; /* find text size */ 307 (rep.number < (INT_MAX / sizeof(XDGAMode)))) {
307 modes = (XDGAMode*)Xmalloc((rep.number * sizeof(XDGAMode)) + size); 308 size = rep.length << 2;
308 offset = (char*)(&modes[rep.number]); /* start of text */ 309 if (size > (rep.number * sz_xXDGAModeInfo)) {
 310 size -= rep.number * sz_xXDGAModeInfo; /* find text size */
 311 modes = Xmalloc((rep.number * sizeof(XDGAMode)) + size);
 312 offset = (char*)(&modes[rep.number]); /* start of text */
 313 }
 314 }
309 315
310 316 if (modes != NULL) {
311 if(modes) {  317 unsigned int i;
312 for(i = 0; i < rep.number; i++) { 318 for(i = 0; i < rep.number; i++) {
313 _XRead(dpy, (char*)(&info), sz_xXDGAModeInfo); 319 _XRead(dpy, (char*)(&info), sz_xXDGAModeInfo);
314 320
315 modes[i].num = info.num; 321 modes[i].num = info.num;
316 modes[i].verticalRefresh =  322 modes[i].verticalRefresh =
317 (float)info.vsync_num / (float)info.vsync_den; 323 (float)info.vsync_num / (float)info.vsync_den;
318 modes[i].flags = info.flags; 324 modes[i].flags = info.flags;
319 modes[i].imageWidth = info.image_width; 325 modes[i].imageWidth = info.image_width;
320 modes[i].imageHeight = info.image_height; 326 modes[i].imageHeight = info.image_height;
321 modes[i].pixmapWidth = info.pixmap_width; 327 modes[i].pixmapWidth = info.pixmap_width;
322 modes[i].pixmapHeight = info.pixmap_height; 328 modes[i].pixmapHeight = info.pixmap_height;
323 modes[i].bytesPerScanline = info.bytes_per_scanline; 329 modes[i].bytesPerScanline = info.bytes_per_scanline;
324 modes[i].byteOrder = info.byte_order; 330 modes[i].byteOrder = info.byte_order;
@@ -328,29 +334,36 @@ XDGAMode* XDGAQueryModes( @@ -328,29 +334,36 @@ XDGAMode* XDGAQueryModes(
328 modes[i].greenMask = info.green_mask; 334 modes[i].greenMask = info.green_mask;
329 modes[i].blueMask = info.blue_mask; 335 modes[i].blueMask = info.blue_mask;
330 modes[i].visualClass = info.visual_class; 336 modes[i].visualClass = info.visual_class;
331 modes[i].viewportWidth = info.viewport_width; 337 modes[i].viewportWidth = info.viewport_width;
332 modes[i].viewportHeight = info.viewport_height; 338 modes[i].viewportHeight = info.viewport_height;
333 modes[i].xViewportStep = info.viewport_xstep; 339 modes[i].xViewportStep = info.viewport_xstep;
334 modes[i].yViewportStep = info.viewport_ystep; 340 modes[i].yViewportStep = info.viewport_ystep;
335 modes[i].maxViewportX = info.viewport_xmax; 341 modes[i].maxViewportX = info.viewport_xmax;
336 modes[i].maxViewportY = info.viewport_ymax; 342 modes[i].maxViewportY = info.viewport_ymax;
337 modes[i].viewportFlags = info.viewport_flags; 343 modes[i].viewportFlags = info.viewport_flags;
338 modes[i].reserved1 = info.reserved1; 344 modes[i].reserved1 = info.reserved1;
339 modes[i].reserved2 = info.reserved2;  345 modes[i].reserved2 = info.reserved2;
340 346
341 _XRead(dpy, offset, info.name_size); 347 if (info.name_size > 0 && info.name_size <= size) {
342 modes[i].name = offset; 348 _XRead(dpy, offset, info.name_size);
343 offset += info.name_size; 349 modes[i].name = offset;
 350 modes[i].name[info.name_size - 1] = '\0';
 351 offset += info.name_size;
 352 size -= info.name_size;
 353 } else {
 354 _XEatData(dpy, info.name_size);
 355 modes[i].name = NULL;
 356 }
344 } 357 }
345 *num = rep.number; 358 *num = rep.number;
346 } else 359 } else
347 _XEatData(dpy, rep.length << 2); 360 _XEatData(dpy, rep.length << 2);
348 } 361 }
349 } 362 }
350 363
351 UnlockDisplay(dpy); 364 UnlockDisplay(dpy);
352 SyncHandle(); 365 SyncHandle();
353 366
354 return modes; 367 return modes;
355} 368}
356 369
@@ -370,32 +383,35 @@ XDGASetMode( @@ -370,32 +383,35 @@ XDGASetMode(
370 XDGACheckExtension (dpy, dinfo, NULL); 383 XDGACheckExtension (dpy, dinfo, NULL);
371 384
372 LockDisplay(dpy); 385 LockDisplay(dpy);
373 GetReq(XDGASetMode, req); 386 GetReq(XDGASetMode, req);
374 req->reqType = dinfo->codes->major_opcode; 387 req->reqType = dinfo->codes->major_opcode;
375 req->dgaReqType = X_XDGASetMode; 388 req->dgaReqType = X_XDGASetMode;
376 req->screen = screen; 389 req->screen = screen;
377 req->mode = mode; 390 req->mode = mode;
378 req->pid = pid = XAllocID(dpy); 391 req->pid = pid = XAllocID(dpy);
379  392
380 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) { 393 if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
381 if(rep.length) { 394 if(rep.length) {
382 xXDGAModeInfo info; 395 xXDGAModeInfo info;
383 int size; 396 unsigned long size;
384 397
385 size = rep.length << 2; 398 if ((rep.length < (INT_MAX >> 2)) &&
386 size -= sz_xXDGAModeInfo; /* get text size */ 399 (rep.length > (sz_xXDGAModeInfo >> 2))) {
 400 size = rep.length << 2;
 401 size -= sz_xXDGAModeInfo; /* get text size */
387 402
388 dev = (XDGADevice*)Xmalloc(sizeof(XDGADevice) + size); 403 dev = Xmalloc(sizeof(XDGADevice) + size);
 404 }
389  405
390 if(dev) { 406 if(dev) {
391 _XRead(dpy, (char*)(&info), sz_xXDGAModeInfo); 407 _XRead(dpy, (char*)(&info), sz_xXDGAModeInfo);
392 408
393 dev->mode.num = info.num; 409 dev->mode.num = info.num;
394 dev->mode.verticalRefresh =  410 dev->mode.verticalRefresh =
395 (float)info.vsync_num / (float)info.vsync_den; 411 (float)info.vsync_num / (float)info.vsync_den;
396 dev->mode.flags = info.flags; 412 dev->mode.flags = info.flags;
397 dev->mode.imageWidth = info.image_width; 413 dev->mode.imageWidth = info.image_width;
398 dev->mode.imageHeight = info.image_height; 414 dev->mode.imageHeight = info.image_height;
399 dev->mode.pixmapWidth = info.pixmap_width; 415 dev->mode.pixmapWidth = info.pixmap_width;
400 dev->mode.pixmapHeight = info.pixmap_height; 416 dev->mode.pixmapHeight = info.pixmap_height;
401 dev->mode.bytesPerScanline = info.bytes_per_scanline; 417 dev->mode.bytesPerScanline = info.bytes_per_scanline;
@@ -406,36 +422,44 @@ XDGASetMode( @@ -406,36 +422,44 @@ XDGASetMode(
406 dev->mode.greenMask = info.green_mask; 422 dev->mode.greenMask = info.green_mask;
407 dev->mode.blueMask = info.blue_mask; 423 dev->mode.blueMask = info.blue_mask;
408 dev->mode.visualClass = info.visual_class; 424 dev->mode.visualClass = info.visual_class;
409 dev->mode.viewportWidth = info.viewport_width; 425 dev->mode.viewportWidth = info.viewport_width;
410 dev->mode.viewportHeight = info.viewport_height; 426 dev->mode.viewportHeight = info.viewport_height;
411 dev->mode.xViewportStep = info.viewport_xstep; 427 dev->mode.xViewportStep = info.viewport_xstep;
412 dev->mode.yViewportStep = info.viewport_ystep; 428 dev->mode.yViewportStep = info.viewport_ystep;
413 dev->mode.maxViewportX = info.viewport_xmax; 429 dev->mode.maxViewportX = info.viewport_xmax;
414 dev->mode.maxViewportY = info.viewport_ymax; 430 dev->mode.maxViewportY = info.viewport_ymax;
415 dev->mode.viewportFlags = info.viewport_flags; 431 dev->mode.viewportFlags = info.viewport_flags;
416 dev->mode.reserved1 = info.reserved1; 432 dev->mode.reserved1 = info.reserved1;
417 dev->mode.reserved2 = info.reserved2; 433 dev->mode.reserved2 = info.reserved2;
418 434
419 dev->mode.name = (char*)(&dev[1]);  435 if (info.name_size > 0 && info.name_size <= size) {
420 _XRead(dpy, dev->mode.name, info.name_size); 436 dev->mode.name = (char*)(&dev[1]);
 437 _XRead(dpy, dev->mode.name, info.name_size);
 438 dev->mode.name[info.name_size - 1] = '\0';
 439 } else {
 440 dev->mode.name = NULL;
 441 _XEatData(dpy, rep.length << 2);
 442 }
421 443
422 dev->pixmap = (rep.flags & XDGAPixmap) ? pid : 0; 444 dev->pixmap = (rep.flags & XDGAPixmap) ? pid : 0;
423 dev->data = XDGAGetMappedMemory(screen); 445 dev->data = XDGAGetMappedMemory(screen);
424 446
425 if(dev->data) 447 if(dev->data)
426 dev->data += rep.offset; 448 dev->data += rep.offset;
427 }  449 }
428 /* not sure what to do if the allocation fails */ 450 /* not sure what to do if the allocation fails */
 451 else
 452 _XEatData(dpy, rep.length << 2);
429 } 453 }
430 } 454 }
431 455
432 UnlockDisplay(dpy); 456 UnlockDisplay(dpy);
433 SyncHandle(); 457 SyncHandle();
434 458
435 return dev; 459 return dev;
436} 460}
437 461
438 462
439void XDGASetViewport( 463void XDGASetViewport(
440 Display *dpy, 464 Display *dpy,
441 int screen, 465 int screen,
cvs diff -r1.1.1.1 -r1.1.1.1.6.1 xsrc/external/mit/libXxf86vm/dist/src/XF86VMode.c (expand / switch to unified diff)

--- xsrc/external/mit/libXxf86vm/dist/src/XF86VMode.c 2008/07/30 02:58:08 1.1.1.1
+++ xsrc/external/mit/libXxf86vm/dist/src/XF86VMode.c 2013/06/06 16:39:20 1.1.1.1.6.1
@@ -1136,49 +1136,54 @@ XF86VidModeSetGammaRamp ( @@ -1136,49 +1136,54 @@ XF86VidModeSetGammaRamp (
1136Bool 1136Bool
1137XF86VidModeGetGammaRamp ( 1137XF86VidModeGetGammaRamp (
1138 Display *dpy, 1138 Display *dpy,
1139 int screen, 1139 int screen,
1140 int size, 1140 int size,
1141 unsigned short *red, 1141 unsigned short *red,
1142 unsigned short *green, 1142 unsigned short *green,
1143 unsigned short *blue 1143 unsigned short *blue
1144) 1144)
1145{ 1145{
1146 XExtDisplayInfo *info = find_display (dpy); 1146 XExtDisplayInfo *info = find_display (dpy);
1147 xXF86VidModeGetGammaRampReq *req; 1147 xXF86VidModeGetGammaRampReq *req;
1148 xXF86VidModeGetGammaRampReply rep; 1148 xXF86VidModeGetGammaRampReply rep;
 1149 Bool result = True;
1149  1150
1150 XF86VidModeCheckExtension (dpy, info, False); 1151 XF86VidModeCheckExtension (dpy, info, False);
1151 1152
1152 LockDisplay(dpy); 1153 LockDisplay(dpy);
1153 GetReq(XF86VidModeGetGammaRamp, req); 1154 GetReq(XF86VidModeGetGammaRamp, req);
1154 req->reqType = info->codes->major_opcode; 1155 req->reqType = info->codes->major_opcode;
1155 req->xf86vidmodeReqType = X_XF86VidModeGetGammaRamp; 1156 req->xf86vidmodeReqType = X_XF86VidModeGetGammaRamp;
1156 req->screen = screen; 1157 req->screen = screen;
1157 req->size = size; 1158 req->size = size;
1158 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) { 1159 if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
1159 UnlockDisplay (dpy); 1160 result = False;
1160 SyncHandle (); 
1161 return False; 
1162 } 1161 }
1163 if(rep.size) { 1162 else if (rep.size) {
1164 _XRead(dpy, (char*)red, rep.size << 1); 1163 if (rep.size <= size) {
1165 _XRead(dpy, (char*)green, rep.size << 1); 1164 _XRead(dpy, (char*)red, rep.size << 1);
1166 _XRead(dpy, (char*)blue, rep.size << 1); 1165 _XRead(dpy, (char*)green, rep.size << 1);
 1166 _XRead(dpy, (char*)blue, rep.size << 1);
 1167 }
 1168 else {
 1169 _XEatData(dpy, rep.length << 2);
 1170 result = False;
 1171 }
1167 } 1172 }
1168 1173
1169 UnlockDisplay(dpy); 1174 UnlockDisplay(dpy);
1170 SyncHandle(); 1175 SyncHandle();
1171 return True; 1176 return result;
1172} 1177}
1173 1178
1174Bool XF86VidModeGetGammaRampSize( 1179Bool XF86VidModeGetGammaRampSize(
1175 Display *dpy, 1180 Display *dpy,
1176 int screen, 1181 int screen,
1177 int *size 1182 int *size
1178) 1183)
1179{ 1184{
1180 XExtDisplayInfo *info = find_display (dpy); 1185 XExtDisplayInfo *info = find_display (dpy);
1181 xXF86VidModeGetGammaRampSizeReq *req; 1186 xXF86VidModeGetGammaRampSizeReq *req;
1182 xXF86VidModeGetGammaRampSizeReply rep; 1187 xXF86VidModeGetGammaRampSizeReply rep;
1183  1188
1184 *size = 0; 1189 *size = 0;