29 lines
1.2 KiB
Diff
29 lines
1.2 KiB
Diff
|
Index: nx-x11-ubuntu/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c
|
||
|
|
===================================================================
|
||
|
|
--- nx-x11-ubuntu.orig/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c 2007-06-02 18:49:57.000000000 -0300
|
||
|
|
+++ nx-x11-ubuntu/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c 2010-03-18 17:51:32.963686193 -0300
|
||
|
|
@@ -1973,6 +1973,23 @@
|
||
|
|
client->errorValue = 0;
|
||
|
|
return BadValue;
|
||
|
|
}
|
||
|
|
+ if (stuff->width > 32767 || stuff->height > 32767)
|
||
|
|
+ {
|
||
|
|
+ /* It is allowed to try and allocate a pixmap which is larger than
|
||
|
|
+ * 32767 in either dimension. However, all of the framebuffer code
|
||
|
|
+ * is buggy and does not reliably draw to such big pixmaps, basically
|
||
|
|
+ * because the Region data structure operates with signed shorts
|
||
|
|
+ * for the rectangles in it.
|
||
|
|
+ *
|
||
|
|
+ * Furthermore, several places in the X server computes the
|
||
|
|
+ * size in bytes of the pixmap and tries to store it in an
|
||
|
|
+ * integer. This integer can overflow and cause the allocated size
|
||
|
|
+ * to be much smaller.
|
||
|
|
+ *
|
||
|
|
+ * So, such big pixmaps are rejected here with a BadAlloc
|
||
|
|
+ */
|
||
|
|
+ return BadAlloc;
|
||
|
|
+ }
|
||
|
|
if (stuff->depth != 1)
|
||
|
|
{
|
||
|
|
pDepth = pDraw->pScreen->allowedDepths;
|