XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-26 08:15:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

(!1639) Xext: vidmode: fix length checking with bigreq

Browse Source 
The authorative source of the request frame size is client->req_len,
especially with big requests larger than 2^18 bytes.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult
2024-08-06 15:59:38 +02:00
parent df1510b251
commit 8d70b71710
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Xext/vidmode.c
View File

@@ -471,7 +471,7 @@ ProcVidModeAddModeLine(ClientPtr client)
if (ver < 2) {
/* convert from old format */
stuff = &newstuff;
stuff->length = oldstuff->length;
stuff->length = client->req_len;
stuff->screen = oldstuff->screen;
stuff->dotclock = oldstuff->dotclock;
stuff->hdisplay = oldstuff->hdisplay;
@@ -641,7 +641,7 @@ ProcVidModeDeleteModeLine(ClientPtr client)
if (ver < 2) {
/* convert from old format */
stuff = &newstuff;
stuff->length = oldstuff->length;
stuff->length = client->req_len;
stuff->screen = oldstuff->screen;
stuff->dotclock = oldstuff->dotclock;
stuff->hdisplay = oldstuff->hdisplay;
@@ -670,7 +670,7 @@ ProcVidModeDeleteModeLine(ClientPtr client)
"len = %d, length = %d\n",
(unsigned long) client->req_len,
(int) sizeof(xXF86VidModeDeleteModeLineReq) >> 2,
(unsigned long) stuff->privsize, len, stuff->length);
(unsigned long) stuff->privsize, len, client->req_len);
return BadLength;
}
@@ -765,7 +765,7 @@ ProcVidModeModModeLine(ClientPtr client)
if (ver < 2) {
/* convert from old format */
stuff = &newstuff;
stuff->length = oldstuff->length;
stuff->length = client->req_len;
stuff->screen = oldstuff->screen;
stuff->hdisplay = oldstuff->hdisplay;
stuff->hsyncstart = oldstuff->hsyncstart;
@@ -899,7 +899,7 @@ ProcVidModeValidateModeLine(ClientPtr client)
if (ver < 2) {
/* convert from old format */
stuff = &newstuff;
stuff->length = oldstuff->length;
stuff->length = client->req_len;
stuff->screen = oldstuff->screen;
stuff->dotclock = oldstuff->dotclock;
stuff->hdisplay = oldstuff->hdisplay;
@@ -1052,7 +1052,7 @@ ProcVidModeSwitchToMode(ClientPtr client)
if (ver < 2) {
/* convert from old format */
stuff = &newstuff;
stuff->length = oldstuff->length;
stuff->length = client->req_len;
stuff->screen = oldstuff->screen;
stuff->dotclock = oldstuff->dotclock;
stuff->hdisplay = oldstuff->hdisplay;