Module Name: xsrc
Committed By: mrg
Date: Wed Jun 5 23:49:22 UTC 2013
Modified Files:
xsrc/external/mit/MesaLib/dist/src/glx: XF86dri.c
Log Message:
merge the changes from these two upstream commits:
http://lists.freedesktop.org/archives/mesa-dev/2013-May/039720.html
http://lists.freedesktop.org/archives/mesa-dev/2013-May/039722.html
which fix:
http://www.x.org/wiki/Development/Security/Advisory-2013-05-23
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.1 -r1.2 xsrc/external/mit/MesaLib/dist/src/glx/XF86dri.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: xsrc/external/mit/MesaLib/dist/src/glx/XF86dri.c
diff -u xsrc/external/mit/MesaLib/dist/src/glx/XF86dri.c:1.1.1.1 xsrc/external/mit/MesaLib/dist/src/glx/XF86dri.c:1.2
--- xsrc/external/mit/MesaLib/dist/src/glx/XF86dri.c:1.1.1.1 Mon Jul 19 05:31:50 2010
+++ xsrc/external/mit/MesaLib/dist/src/glx/XF86dri.c Wed Jun 5 23:49:22 2013
@@ -43,6 +43,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN
#include <X11/extensions/Xext.h>
#include <X11/extensions/extutil.h>
#include "xf86dristr.h"
+#include <limits.h>
#if defined(__GNUC__)
@@ -212,7 +213,11 @@ XF86DRIOpenConnection(Display * dpy, int
}
if (rep.length) {
- if (!(*busIdString = (char *) Xcalloc(rep.busIdStringLength + 1, 1))) {
+ if (rep.busIdStringLength < INT_MAX)
+ *busIdString = (char *) Xcalloc(rep.busIdStringLength + 1, 1);
+ else
+ *busIdString = NULL;
+ if (*busIdString == NULL) {
_XEatData(dpy, ((rep.busIdStringLength + 3) & ~3));
UnlockDisplay(dpy);
SyncHandle();
@@ -311,9 +316,11 @@ XF86DRIGetClientDriverName(Display * dpy
*ddxDriverPatchVersion = rep.ddxDriverPatchVersion;
if (rep.length) {
- if (!
- (*clientDriverName =
- (char *) Xcalloc(rep.clientDriverNameLength + 1, 1))) {
+ if (rep.clientDriverNameLength < INT_MAX)
+ *clientDriverName = (char *) Xcalloc(rep.clientDriverNameLength + 1, 1);
+ else
+ *clientDriverName = NULL;
+ if (*clientDriverName == NULL) {
_XEatData(dpy, ((rep.clientDriverNameLength + 3) & ~3));
UnlockDisplay(dpy);
SyncHandle();
