Peter Hutterer 93cafb0828 Xext: dynamically allocate the PanoramiXDepths[j].vids array ...

Control flow is:
   PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
   PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
   and writes those into the previously allocated array.

This caused invalid reads/writes followed by eventually a double-free abort.

Reproduced with xorg-integration-tests server test
XineramaTest.ScreenCrossing/* (and a bunch of others).

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>

2018-07-19 11:52:14 +10:00

..

bigreq.c

Move extension initialisation prototypes into extinit.h

2012-07-09 23:06:41 -07:00

dpms.c

Change the DPMS initialization to be conditional on not set from config

2018-06-26 17:14:34 -07:00

dpmsproc.h

dpms: Consolidate a bunch of stuff into Xext/dpms.c

2017-03-27 15:59:47 -04:00

geext.c

Use ARRAY_SIZE all over the tree

2017-10-30 13:45:20 -04:00

geext.h

Move extension initialisation prototypes into extinit.h

2012-07-09 23:06:41 -07:00

geint.h

xge: Hide some implementation details

2015-07-08 16:40:58 -04:00

hashtable.c

Xext: Fix memory leaks in hashtable.

2018-04-10 14:41:29 -04:00

hashtable.h

Replace 'pointer' type with 'void *'

2014-01-12 10:24:11 -08:00

Makefile.am

dix: Lift DPMS to a screen hook

2017-03-27 15:59:42 -04:00

meson.build

meson: Ensure we always build Xext/hashtable.c for glx

2018-04-19 16:20:22 -04:00

panoramiX.c

Xext: dynamically allocate the PanoramiXDepths[j].vids array

2018-07-19 11:52:14 +10:00

panoramiX.h

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

panoramiXh.h

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

panoramiXprocs.c

xinerama: Implement graphics exposures for window->pixmap copies (v4)

2017-03-15 16:16:36 -04:00

panoramiXsrv.h

Replace 'pointer' type with 'void *'

2014-01-12 10:24:11 -08:00

panoramiXSwap.c

dispatch: Mark swapped dispatch as _X_COLD

2017-03-01 10:16:20 -05:00

saver.c

Xext/saver: Swap ScreenSaverSuspend 'suspend' field. Handle old XCB clients.

2018-03-14 10:14:04 -07:00

security.c

dispatch: Mark swapped dispatch as _X_COLD

2017-03-01 10:16:20 -05:00

securitysrv.h

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

shape.c

dispatch: Mark swapped dispatch as _X_COLD

2017-03-01 10:16:20 -05:00

shm.c

Xext/shm: Refuse to work for remote clients

2018-06-14 12:35:09 -04:00

shmint.h

xext: Fix shmint.h to not use headers outside of sdk_HEADERS

2013-11-14 10:22:15 +09:00

sleepuntil.c

Remove fd_set from Block/Wakeup handler API

2016-07-18 15:27:51 -04:00

sleepuntil.h

Replace 'pointer' type with 'void *'

2014-01-12 10:24:11 -08:00

sync.c

sync: Fix diffgreater comparison

2018-01-18 14:08:46 -05:00

syncsdk.h

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

syncsrv.h

sync: Convert from "CARD64" to int64_t.

2017-09-20 13:19:27 -04:00

vidmode.c

hw/xfree86: unvalidated lengths

2017-10-10 23:33:44 +02:00

xace.c

xace: Don't censor window borders

2016-09-28 15:25:07 -04:00

xace.h

xace: Remove the audit hooks and tune dispatch

2016-06-10 13:26:19 -04:00

xacestr.h

Replace 'pointer' type with 'void *'

2014-01-12 10:24:11 -08:00

xcmisc.c

dispatch: Mark swapped dispatch as _X_COLD

2017-03-01 10:16:20 -05:00

xf86bigfont.c

Drop workaround for pre-glibc linux

2017-05-11 15:24:01 -04:00

xf86bigfontsrv.h

Move extension initialisation prototypes into extinit.h

2012-07-09 23:06:41 -07:00

xres.c

xres: Return the atom naming the type, not its internal type number

2017-11-14 16:02:49 -05:00

xselinux_ext.c

dix: Remove extension aliases

2017-06-20 16:37:24 -04:00

xselinux_hooks.c

Xext/xselinux: Use NotifyFd interface

2015-12-01 13:55:56 -05:00

xselinux_label.c

Convert top level extensions to new *allocarray functions

2015-04-21 16:57:08 -07:00

xselinux.h

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

xselinuxint.h

Introduce a consistent coding style

2012-03-21 13:54:42 -07:00

xtest.c

dispatch: Mark swapped dispatch as _X_COLD

2017-03-01 10:16:20 -05:00

xvdisp.c

Unvalidated lengths

2017-10-10 23:33:34 +02:00

xvdisp.h

Fix swapped Xv dispatch under Xinerama.

2007-12-02 14:15:36 -05:00

xvdix.h

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

xvmain.c

dispatch: Mark swapped dispatch as _X_COLD

2017-03-01 10:16:20 -05:00

xvmc.c

dispatch: Mark swapped dispatch as _X_COLD

2017-03-01 10:16:20 -05:00

xvmcext.h

Replace 'pointer' type with 'void *'

2014-01-12 10:24:11 -08:00