← Back to branch summary

~ubuntu-branches/ubuntu/precise/xorg-server/precise-updates

« back to all changes in this revision

Viewing changes to 0003-glx-Work-around-wrong-request-lengths-sent-by-mesa.patch

Tags: 2:1.10.1-2
* Build xserver-xorg-core-udeb on hurd-i386.  Thanks, Samuel Thibault!
* Upload to unstable.

Show diffs side-by-side

added added

removed removed

Lines of Context:
0003-glx-Work-around-wrong-request-lengths-sent-by-mesa.patch
 
1
From 5fa86d36c8b0089648e2a73a8d13127b4544084b Mon Sep 17 00:00:00 2001
 
2
From: Julien Cristau <jcristau@debian.org>
 
3
Date: Sun, 23 Jan 2011 13:35:54 +0100
 
4
Subject: [PATCH v3 3/3] glx: Work around wrong request lengths sent by mesa
 
5
 
 
6
mesa used to send too long requests for GLXDestroyPixmap,
 
7
GLXDestroyWindow, GLXChangeDrawableAttributes, GLXGetDrawableAttributes
 
8
and GLXGetFBConfigsSGIX.
 
9
 
 
10
Fixes a regression introduced in ec9c97c6bf70b523bc500bd3adf62176f1bb33a4
 
11
X.Org bug#33324 <https://bugs.freedesktop.org/show_bug.cgi?id=33324>
 
12
 
 
13
Reported-by: xunx.fang@intel.com
 
14
Signed-off-by: Julien Cristau <jcristau@debian.org>
 
15
---
 
16
 glx/glxcmds.c     |   19 +++++++++++++++----
 
17
 glx/glxcmdsswap.c |   12 +++++++-----
 
18
 2 files changed, 22 insertions(+), 9 deletions(-)
 
19
 
 
20
v2: also handle swapped versions
 
21
 
 
22
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
 
23
index 5d633df..9b4bc9e 100644
 
24
--- a/glx/glxcmds.c
 
25
+++ b/glx/glxcmds.c
 
26
@@ -1132,7 +1132,8 @@ int __glXDisp_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc)
 
27
 {
 
28
     ClientPtr client = cl->client;
 
29
     xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
 
30
-    REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
 
31
+    /* work around mesa bug, don't use REQUEST_SIZE_MATCH */
 
32
+    REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
 
33
     return DoGetFBConfigs(cl, req->screen);
 
34
 }
 
35
 
 
36
@@ -1356,7 +1357,9 @@ int __glXDisp_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
 
37
     ClientPtr client = cl->client;
 
38
     xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc;
 
39
 
 
40
-    REQUEST_SIZE_MATCH(xGLXDestroyPixmapReq);
 
41
+    /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set
 
42
+     * length to 3 instead of 2 */
 
43
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq);
 
44
 
 
45
     return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP);
 
46
 }
 
47
@@ -1498,7 +1501,13 @@ int __glXDisp_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 
48
        client->errorValue = req->numAttribs;
 
49
        return BadValue;
 
50
     }
 
51
+#if 0
 
52
+    /* mesa sends an additional 8 bytes */
 
53
     REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
 
54
+#else
 
55
+    if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len)
 
56
+           return BadLength;
 
57
+#endif
 
58
 
 
59
     return DoChangeDrawableAttributes(cl->client, req->drawable,
 
60
                                      req->numAttribs, (CARD32 *) (req + 1));
 
61
@@ -1563,7 +1572,8 @@ int __glXDisp_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
 
62
     ClientPtr client = cl->client;
 
63
     xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
 
64
 
 
65
-    REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
 
66
+    /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */
 
67
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
 
68
 
 
69
     return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW);
 
70
 }
 
71
@@ -1872,7 +1882,8 @@ int __glXDisp_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 
72
     ClientPtr client = cl->client;
 
73
     xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc;
 
74
 
 
75
-    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
 
76
+    /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */
 
77
+    REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
 
78
 
 
79
     return DoGetDrawableAttributes(cl, req->drawable);
 
80
 }
 
81
diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
 
82
index d58de62..76e6fb6 100644
 
83
--- a/glx/glxcmdsswap.c
 
84
+++ b/glx/glxcmdsswap.c
 
85
@@ -279,7 +279,7 @@ int __glXDispSwap_GetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc)
 
86
     xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
 
87
     __GLX_DECLARE_SWAP_VARIABLES;
 
88
 
 
89
-    REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
 
90
+    REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
 
91
 
 
92
     __GLX_SWAP_INT(&req->screen);
 
93
     return __glXDisp_GetFBConfigsSGIX(cl, pc);
 
94
@@ -368,7 +368,7 @@ int __glXDispSwap_DestroyPixmap(__GLXclientState *cl, GLbyte *pc)
 
95
     xGLXDestroyGLXPixmapReq *req = (xGLXDestroyGLXPixmapReq *) pc;
 
96
     __GLX_DECLARE_SWAP_VARIABLES;
 
97
 
 
98
-    REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
 
99
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq);
 
100
 
 
101
     __GLX_SWAP_SHORT(&req->length);
 
102
     __GLX_SWAP_INT(&req->glxpixmap);
 
103
@@ -476,7 +476,9 @@ int __glXDispSwap_ChangeDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 
104
        client->errorValue = req->numAttribs;
 
105
        return BadValue;
 
106
     }
 
107
-    REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
 
108
+    if (((sizeof(xGLXChangeDrawableAttributesReq) + (req->numAttribs << 3)) >> 2) < client->req_len)
 
109
+       return BadLength;
 
110
+
 
111
     attribs = (CARD32*)(req + 1);
 
112
     __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
 
113
 
 
114
@@ -542,7 +544,7 @@ int __glXDispSwap_DestroyWindow(__GLXclientState *cl, GLbyte *pc)
 
115
     xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
 
116
     __GLX_DECLARE_SWAP_VARIABLES;
 
117
 
 
118
-    REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
 
119
+    REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
 
120
 
 
121
     __GLX_SWAP_INT(&req->glxwindow);
 
122
 
 
123
@@ -742,7 +744,7 @@ int __glXDispSwap_GetDrawableAttributes(__GLXclientState *cl, GLbyte *pc)
 
124
     xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *)pc;
 
125
     __GLX_DECLARE_SWAP_VARIABLES;
 
126
 
 
127
-    REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
 
128
+    REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
 
129
 
 
130
     __GLX_SWAP_SHORT(&req->length);
 
131
     __GLX_SWAP_INT(&req->drawable);
 
132
-- 
 
133
1.7.2.3
 
134