From 5c3ce08b0e8082a9307e46710f1f2dec4d2bd534 Mon Sep 17 00:00:00 2001 From: "Enrico Weigelt, metux IT consult" Date: Fri, 18 Jul 2025 04:19:24 +0200 Subject: [PATCH] Xext: xv: ProcXvListImageFormats(): use x_rpcbuf_t for payload size Use the payload size from the rpcbuf, but also compare that with our computation as sanity check and log error on mismatch. Signed-off-by: Enrico Weigelt, metux IT consult --- Xext/xvdisp.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c index e399a09a8..9f069877a 100644 --- a/Xext/xvdisp.c +++ b/Xext/xvdisp.c @@ -862,22 +862,6 @@ ProcXvListImageFormats(ClientPtr client) VALIDATE_XV_PORT(stuff->port, pPort, DixReadAccess); - xvListImageFormatsReply rep = { - .type = X_Reply, - .sequenceNumber = client->sequence, - .num_formats = pPort->pAdaptor->nImages, - .length = - bytes_to_int32(pPort->pAdaptor->nImages * sz_xvImageFormatInfo) - }; - - if (client->swapped) { - swaps(&rep.sequenceNumber); - swapl(&rep.length); - swapl(&rep.num_formats); - } - - WriteToClient(client, sz_xvListImageFormatsReply, &rep); - pImage = pPort->pAdaptor->pImages; x_rpcbuf_t rpcbuf = { .swapped = client->swapped, .err_clear = TRUE }; @@ -920,6 +904,24 @@ ProcXvListImageFormats(ClientPtr client) if (rpcbuf.error) return BadAlloc; + if (rpcbuf.wpos != (pPort->pAdaptor->nImages*sz_xvImageFormatInfo)) + LogMessage(X_WARNING, "ProcXvListImageFormats() payload_len mismatch: %ld but shoud be %d\n", + rpcbuf.wpos, (pPort->pAdaptor->nImages*sz_xvImageFormatInfo)); + + xvListImageFormatsReply rep = { + .type = X_Reply, + .sequenceNumber = client->sequence, + .num_formats = pPort->pAdaptor->nImages, + .length = bytes_to_int32(rpcbuf.wpos) + }; + + if (client->swapped) { + swaps(&rep.sequenceNumber); + swapl(&rep.length); + swapl(&rep.num_formats); + } + + WriteToClient(client, sz_xvListImageFormatsReply, &rep); WriteRpcbufToClient(client, &rpcbuf); return Success; }