net-misc/nx-X11: Bump
git-svn-id: https://svn.disconnected-by-peer.at/svn/linamh/trunk/linamh@2335 6952d904-891a-0410-993b-d76249ca496b
This commit is contained in:
28
net-misc/nx-X11/files/createpixmap_bounds_check.patch
Normal file
28
net-misc/nx-X11/files/createpixmap_bounds_check.patch
Normal file
@@ -0,0 +1,28 @@
|
||||
Index: nx-x11-ubuntu/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c
|
||||
===================================================================
|
||||
--- nx-x11-ubuntu.orig/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c 2007-06-02 18:49:57.000000000 -0300
|
||||
+++ nx-x11-ubuntu/nxagent/programs/Xserver/hw/nxagent/NXdispatch.c 2010-03-18 17:51:32.963686193 -0300
|
||||
@@ -1973,6 +1973,23 @@
|
||||
client->errorValue = 0;
|
||||
return BadValue;
|
||||
}
|
||||
+ if (stuff->width > 32767 || stuff->height > 32767)
|
||||
+ {
|
||||
+ /* It is allowed to try and allocate a pixmap which is larger than
|
||||
+ * 32767 in either dimension. However, all of the framebuffer code
|
||||
+ * is buggy and does not reliably draw to such big pixmaps, basically
|
||||
+ * because the Region data structure operates with signed shorts
|
||||
+ * for the rectangles in it.
|
||||
+ *
|
||||
+ * Furthermore, several places in the X server computes the
|
||||
+ * size in bytes of the pixmap and tries to store it in an
|
||||
+ * integer. This integer can overflow and cause the allocated size
|
||||
+ * to be much smaller.
|
||||
+ *
|
||||
+ * So, such big pixmaps are rejected here with a BadAlloc
|
||||
+ */
|
||||
+ return BadAlloc;
|
||||
+ }
|
||||
if (stuff->depth != 1)
|
||||
{
|
||||
pDepth = pDraw->pScreen->allowedDepths;
|
||||
Reference in New Issue
Block a user