Fix the fix for CAN-2005-2495.

Obtained from:	XFree86 CVS

2 files changed, 271 insertions, 128 deletions

diff --git a/x11-servers/XFree86-4-Server/Makefile b/x11-servers/XFree86-4-Server/Makefile
index 78b3f52f410d..bb80c63c04cc 100644
--- a/x11-servers/XFree86-4-Server/Makefile
+++ b/x11-servers/XFree86-4-Server/Makefile
@@ -7,7 +7,7 @@
 
 PORTNAME=	Server
 PORTVERSION=	4.5.0
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	x11-servers
 MASTER_SITES=	${MASTER_SITE_XFREE}
 MASTER_SITE_SUBDIR=	${PORTVERSION}
diff --git a/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495 b/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495
index e6ac39da8a48..672d7b7e6222 100644
--- a/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495
+++ b/x11-servers/XFree86-4-Server/files/patch-CAN-2005-2495
@@ -1,169 +1,312 @@
---- programs/Xserver/afb/afbpixmap.c.orig	Tue Jun  3 16:11:07 1997
-+++ programs/Xserver/afb/afbpixmap.c	Tue Sep  6 16:26:35 2005
-@@ -73,10 +73,14 @@ afbCreatePixmap(pScreen, width, height, 
- 	int				depth;
- {
- 	PixmapPtr pPixmap;
--	int datasize;
--	int paddedWidth;
-+	size_t datasize;
-+	size_t paddedWidth;
+Index: programs/Xserver/afb/afbpixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/afb/afbpixmap.c,v
+retrieving revision 3.1
+retrieving revision 3.1.20.1
+diff -u -r3.1 -r3.1.20.1
+--- programs/Xserver/afb/afbpixmap.c	3 Jun 1997 14:11:07 -0000	3.1
++++ programs/Xserver/afb/afbpixmap.c	18 Sep 2005 00:20:57 -0000	3.1.20.1
+@@ -76,6 +76,9 @@
+ 	int datasize;
+ 	int paddedWidth;
  
- 	paddedWidth = BitmapBytePad(width);
++	if ((width > MAXSHORT) || (height > MAXSHORT))
++		return NullPixmap;
 +
-+	if (paddedWidth > 32767 || height > 32767)
-+	    return NullPixmap;
-+	
+ 	paddedWidth = BitmapBytePad(width);
  	datasize = height * paddedWidth * depth;
  	pPixmap = AllocatePixmap(pScreen, datasize);
- 	if (!pPixmap)
---- programs/Xserver/cfb/cfbpixmap.c.orig	Fri Dec 14 20:59:23 2001
-+++ programs/Xserver/cfb/cfbpixmap.c	Tue Sep  6 16:26:35 2005
-@@ -70,10 +70,13 @@ cfbCreatePixmap (pScreen, width, height,
-     int		depth;
- {
-     PixmapPtr pPixmap;
--    int datasize;
--    int paddedWidth;
-+    size_t datasize;
-+    size_t paddedWidth;
+Index: programs/Xserver/cfb/cfbpixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/cfb/cfbpixmap.c,v
+retrieving revision 1.5
+retrieving revision 1.5.8.1
+diff -u -r1.5 -r1.5.8.1
+--- programs/Xserver/cfb/cfbpixmap.c	14 Dec 2001 19:59:23 -0000	1.5
++++ programs/Xserver/cfb/cfbpixmap.c	18 Sep 2005 00:20:57 -0000	1.5.8.1
+@@ -73,6 +72,9 @@
+     int datasize;
+     int paddedWidth;
  
-     paddedWidth = PixmapBytePad(width, depth);
-+
-+    if (paddedWidth > 32767 || height > 32767)
++    if ((width > MAXSHORT) || (height > MAXSHORT))
 +	return NullPixmap;
++
+     paddedWidth = PixmapBytePad(width, depth);
      datasize = height * paddedWidth;
      pPixmap = AllocatePixmap(pScreen, datasize);
+Index: programs/Xserver/dix/pixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/dix/pixmap.c,v
+retrieving revision 3.5
+retrieving revision 3.5.8.1
+diff -u -r3.5 -r3.5.8.1
+--- programs/Xserver/dix/pixmap.c	14 Dec 2001 19:59:32 -0000	3.5
++++ programs/Xserver/dix/pixmap.c	18 Sep 2005 00:20:58 -0000	3.5.8.1
+@@ -126,7 +125,9 @@
+     unsigned size;
+     int i;
+ 
+-    pPixmap = (PixmapPtr)xalloc(pScreen->totalPixmapSize + pixDataSize);
++    if (((unsigned)(-1) - pScreen->totalPixmapSize) < (unsigned)pixDataSize)
++	return NullPixmap;
++    pPixmap = xalloc(pScreen->totalPixmapSize + (unsigned)pixDataSize);
      if (!pPixmap)
---- programs/Xserver/dix/dispatch.c.orig	Wed Jun 23 21:40:15 2004
-+++ programs/Xserver/dix/dispatch.c	Tue Sep  6 16:26:35 2005
-@@ -1483,6 +1483,23 @@ ProcCreatePixmap(client)
- 	client->errorValue = 0;
-         return BadValue;
+ 	return NullPixmap;
+     ppriv = (DevUnion *)(pPixmap + 1);
+@@ -144,7 +145,7 @@
+ 	    ppriv->ptr = (pointer)NULL;
      }
-+    if (stuff->width > 32767 || stuff->height > 32767)
-+    {
-+	/* It is allowed to try and allocate a pixmap which is larger than
-+	 * 32767 in either dimension. However, all of the framebuffer code
-+	 * is buggy and does not reliably draw to such big pixmaps, basically
-+	 * because the Region data structure operates with signed shorts
-+	 * for the rectangles in it.
-+	 *
-+	 * Furthermore, several places in the X server computes the
-+	 * size in bytes of the pixmap and tries to store it in an
-+	 * integer. This integer can overflow and cause the allocated size
-+	 * to be much smaller.
-+	 *
-+	 * So, such big pixmaps are rejected here with a BadAlloc
-+	 */
-+	return BadAlloc;
-+    }
-     if (stuff->depth != 1)
-     {
-         pDepth = pDraw->pScreen->allowedDepths;
---- programs/Xserver/fb/fbpixmap.c.orig	Mon Sep 16 20:05:34 2002
-+++ programs/Xserver/fb/fbpixmap.c	Tue Sep  6 16:26:35 2005
-@@ -32,12 +32,14 @@ PixmapPtr
- fbCreatePixmapBpp (ScreenPtr pScreen, int width, int height, int depth, int bpp)
- {
-     PixmapPtr	pPixmap;
--    int		datasize;
--    int		paddedWidth;
-+    size_t	datasize;
-+    size_t	paddedWidth;
+ #else
+-    pPixmap = (PixmapPtr)xalloc(sizeof(PixmapRec) + pixDataSize);
++    pPixmap = xalloc(sizeof(PixmapRec) + (unsigned)pixDataSize);
+ #endif
+     return pPixmap;
+ }
+Index: programs/Xserver/fb/fbpixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/fb/fbpixmap.c,v
+retrieving revision 1.11
+retrieving revision 1.11.6.1
+diff -u -r1.11 -r1.11.6.1
+--- programs/Xserver/fb/fbpixmap.c	16 Sep 2002 18:05:34 -0000	1.11
++++ programs/Xserver/fb/fbpixmap.c	18 Sep 2005 00:20:58 -0000	1.11.6.1
+@@ -37,6 +37,9 @@
      int		adjust;
      int		base;
  
-     paddedWidth = ((width * bpp + FB_MASK) >> FB_SHIFT) * sizeof (FbBits);
-+    if (paddedWidth > 32767 || height > 32767)
++    if ((width > MAXSHORT) || (height > MAXSHORT))
 +	return NullPixmap;
++
+     paddedWidth = ((width * bpp + FB_MASK) >> FB_SHIFT) * sizeof (FbBits);
      datasize = height * paddedWidth;
  #ifdef PIXPRIV
-     base = pScreen->totalPixmapSize;
---- programs/Xserver/hw/xfree86/xaa/xaaInit.c.orig	Thu Jul 19 20:50:16 2001
-+++ programs/Xserver/hw/xfree86/xaa/xaaInit.c	Tue Sep  6 16:26:35 2005
-@@ -480,6 +480,9 @@ XAACreatePixmap(ScreenPtr pScreen, int w
+Index: programs/Xserver/hw/xfree86/xaa/xaaInit.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/hw/xfree86/xaa/xaaInit.c,v
+retrieving revision 1.35
+retrieving revision 1.35.10.1
+diff -u -r1.35 -r1.35.10.1
+--- programs/Xserver/hw/xfree86/xaa/xaaInit.c	19 Jul 2001 18:50:16 -0000	1.35
++++ programs/Xserver/hw/xfree86/xaa/xaaInit.c	18 Sep 2005 00:20:59 -0000	1.35.10.1
+@@ -479,8 +479,12 @@
+     ScrnInfoPtr pScrn = xf86Screens[pScreen->myNum];
      XAAPixmapPtr pPriv;
      PixmapPtr pPix = NULL;
-     int size = w * h;
+-    int size = w * h;
++    int size;
 +
-+    if (w > 32767 || h > 32767)
++    if ((w > MAXSHORT) || (h > MAXSHORT))
 +	return NullPixmap;
      
++    size = w * h;
      if (!infoRec->offscreenDepthsInitialized)
  	XAAInitializeOffscreenDepths (pScreen);
---- programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c.orig	Thu Apr 27 18:26:49 2000
-+++ programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c	Tue Sep  6 16:26:35 2005
-@@ -85,14 +85,18 @@ xf4bppCreatePixmap( pScreen, width, heig
-     int		depth ;
- {
-     register PixmapPtr pPixmap  = (PixmapPtr)NULL;
--    int size ;
-+    size_t size ;
+ 
+Index: programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c,v
+retrieving revision 1.5
+retrieving revision 1.5.14.1
+diff -u -r1.5 -r1.5.14.1
+--- programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c	27 Apr 2000 16:26:49 -0000	1.5
++++ programs/Xserver/hw/xfree86/xf4bpp/ppcPixmap.c	18 Sep 2005 00:21:00 -0000	1.5.14.1
+@@ -89,8 +89,8 @@
      
      TRACE(("xf4bppCreatePixmap(pScreen=0x%x, width=%d, height=%d, depth=%d)\n", pScreen, width, height, depth)) ;
  
-     if ( depth > 8 )
- 	return (PixmapPtr) NULL ;
+-    if ( depth > 8 )
+-	return (PixmapPtr) NULL ;
++    if ((depth > 8) || (width > MAXSHORT) || (height > MAXSHORT))
++	return NullPixmap;
  
-+    if (width > 32767 || height > 32767)
-+	return (PixmapPtr) NULL ;
-+    
      size = PixmapBytePad(width, depth);
-+
      pPixmap = AllocatePixmap (pScreen, (height * size));
-     
-     if ( !pPixmap )
---- programs/Xserver/ilbm/ilbmpixmap.c.orig	Sun Aug 18 03:54:01 1996
-+++ programs/Xserver/ilbm/ilbmpixmap.c	Tue Sep  6 16:26:35 2005
-@@ -75,10 +75,12 @@ ilbmCreatePixmap(pScreen, width, height,
- 	int				depth;
- {
- 	PixmapPtr pPixmap;
--	int datasize;
--	int paddedWidth;
-+	size_t datasize;
-+	size_t paddedWidth;
+Index: programs/Xserver/ilbm/ilbmpixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/ilbm/ilbmpixmap.c,v
+retrieving revision 3.0
+retrieving revision 3.0.26.1
+diff -u -r3.0 -r3.0.26.1
+--- programs/Xserver/ilbm/ilbmpixmap.c	18 Aug 1996 01:54:01 -0000	3.0
++++ programs/Xserver/ilbm/ilbmpixmap.c	18 Sep 2005 00:21:00 -0000	3.0.26.1
+@@ -78,6 +78,9 @@
+ 	int datasize;
+ 	int paddedWidth;
  
- 	paddedWidth = BitmapBytePad(width);
-+	if (paddedWidth > 32767 || height > 32767)
++	if ((width > MAXSHORT) || (height > MAXSHORT))
 +		return NullPixmap;
++
+ 	paddedWidth = BitmapBytePad(width);
  	datasize = height * paddedWidth * depth;
  	pPixmap = AllocatePixmap(pScreen, datasize);
- 	if (!pPixmap)
---- programs/Xserver/iplan2p4/iplpixmap.c.orig	Mon Dec 17 21:00:46 2001
-+++ programs/Xserver/iplan2p4/iplpixmap.c	Tue Sep  6 16:26:35 2005
-@@ -74,12 +74,14 @@ iplCreatePixmap (pScreen, width, height,
-     int		depth;
- {
+Index: programs/Xserver/iplan2p4/iplpixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/iplan2p4/iplpixmap.c,v
+retrieving revision 3.1
+retrieving revision 3.1.8.1
+diff -u -r3.1 -r3.1.8.1
+--- programs/Xserver/iplan2p4/iplpixmap.c	17 Dec 2001 20:00:46 -0000	3.1
++++ programs/Xserver/iplan2p4/iplpixmap.c	18 Sep 2005 00:21:00 -0000	3.1.8.1
+@@ -76,8 +76,12 @@
      PixmapPtr pPixmap;
--    int datasize;
--    int paddedWidth;
-+    size_t datasize;
-+    size_t paddedWidth;
-     int ipad=INTER_PLANES*2 - 1;
+     int datasize;
+     int paddedWidth;
+-    int ipad=INTER_PLANES*2 - 1;
++    int ipad;
  
++    if ((width > MAXSHORT) || (height > MAXSHORT))
++	return NullPixmap;
++
++    ipad = INTER_PLANES*2 - 1;
      paddedWidth = PixmapBytePad(width, depth);
      paddedWidth = (paddedWidth + ipad) & ~ipad;
-+    if (paddedWidth > 32767 || height > 32767)
-+	return NullPixmap;
      datasize = height * paddedWidth;
-     pPixmap = AllocatePixmap(pScreen, datasize);
-     if (!pPixmap)
---- programs/Xserver/mfb/mfbpixmap.c.orig	Fri Dec 14 21:00:10 2001
-+++ programs/Xserver/mfb/mfbpixmap.c	Tue Sep  6 16:26:35 2005
-@@ -72,10 +72,12 @@ mfbCreatePixmap (pScreen, width, height,
-     int		depth;
- {
-     PixmapPtr pPixmap;
--    int datasize;
--    int paddedWidth;
-+    size_t datasize;
-+    size_t paddedWidth;
+Index: programs/Xserver/mfb/mfbpixmap.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/mfb/mfbpixmap.c,v
+retrieving revision 1.2
+retrieving revision 1.2.8.1
+diff -u -r1.2 -r1.2.8.1
+--- programs/Xserver/mfb/mfbpixmap.c	14 Dec 2001 20:00:10 -0000	1.2
++++ programs/Xserver/mfb/mfbpixmap.c	18 Sep 2005 00:21:00 -0000	1.2.8.1
+@@ -44,7 +45,6 @@
+ SOFTWARE.
  
-     if (depth != 1)
-+	return NullPixmap;
-+    if (width > 32767 || height > 32767)
+ ******************************************************************/
+-/* $Xorg: mfbpixmap.c,v 1.4 2001/02/09 02:05:19 xorgcvs Exp $ */
+ 
+ /* pixmap management
+    written by drewry, september 1986
+@@ -75,8 +75,9 @@
+     int datasize;
+     int paddedWidth;
+ 
+-    if (depth != 1)
++    if ((depth != 1) || (width > MAXSHORT) || (height > MAXSHORT))
  	return NullPixmap;
++
      paddedWidth = BitmapBytePad(width);
      datasize = height * paddedWidth;
+     pPixmap = AllocatePixmap(pScreen, datasize);
+Index: programs/Xserver/os/utils.c
+===================================================================
+RCS file: /cvs/xc/programs/Xserver/os/utils.c,v
+retrieving revision 3.102
+retrieving revision 3.102.2.1
+diff -u -r3.102 -r3.102.2.1
+--- programs/Xserver/os/utils.c	3 Feb 2005 02:01:14 -0000	3.102
++++ programs/Xserver/os/utils.c	18 Sep 2005 00:21:00 -0000	3.102.2.1
+@@ -1243,19 +1243,19 @@
+ void * 
+ Xalloc(unsigned long amount)
+ {
+-    register pointer  ptr;
+-	
+-    if ((long)amount <= 0)
+-	return NULL;
++    pointer ptr;
+ 
+     /* aligned extra on long word boundary */
+     amount = (amount + (sizeof(long) - 1)) & ~(sizeof(long) - 1);
++
++    if ((long)amount <= 0)
++	return NULL;
+ #ifdef MEMBUG
+     if (!Must_have_memory && Memory_fail &&
+ 	((random() % MEM_FAIL_SCALE) < Memory_fail))
+ 	return NULL;
+ #endif
+-    if ((ptr = (pointer)malloc(amount))) {
++    if ((ptr = malloc(amount))) {
+ 	return ptr;
+     }
+     if (Must_have_memory)
+@@ -1273,12 +1273,16 @@
+ {
+     register pointer ptr;
+ 
+-    if ((long)amount <= 0)
+-        return NULL;
++    if (amount == 0)
++	return NULL;
+ 
+     /* aligned extra on long word boundary */
+     amount = (amount + (sizeof(long) - 1)) & ~(sizeof(long) - 1);
+-    ptr = (pointer)malloc(amount);
++
++    if ((long)amount <= 0)
++        FatalError("Bad request for memory");
++
++    ptr = malloc(amount);
+     if (!ptr)
+         FatalError("Out of memory");
+ 
+@@ -1292,11 +1296,11 @@
+ void *
+ Xcalloc(unsigned long amount)
+ {
+-    unsigned long   *ret;
++    pointer ret;
+ 
+-    ret = Xalloc (amount);
++    ret = Xalloc(amount);
+     if (ret)
+-	bzero ((void *) ret, (int) amount);
++	bzero (ret, (int) amount);
+     return ret;
+ }
+ 
+@@ -1307,13 +1311,17 @@
+ void *
+ XNFcalloc(unsigned long amount)
+ {
+-    unsigned long   *ret;
++    pointer ret;
+ 
+-    ret = Xalloc (amount);
+-    if (ret)
+-	bzero ((char *) ret, (int) amount);
+-    else if ((long)amount > 0)
++    if (amount == 0)
++	return NULL;
++
++    ret = Xalloc(amount);
++    if (!ret)
+         FatalError("Out of memory");
++
++    bzero (ret, (int) amount);
++
+     return ret;
+ }
+ 
+@@ -1336,10 +1344,12 @@
+ 	return NULL;
+     }
+     amount = (amount + (sizeof(long) - 1)) & ~(sizeof(long) - 1);
++    if ((long)amount <= 0)
++	return NULL;
+     if (ptr)
+-        ptr = (pointer)realloc((char *)ptr, amount);
++        ptr = realloc(ptr, amount);
+     else
+-	ptr = (pointer)malloc(amount);
++	ptr = malloc(amount);
+     if (ptr)
+         return ptr;
+     if (Must_have_memory)
+@@ -1355,12 +1365,12 @@
+ void *
+ XNFrealloc(pointer ptr, unsigned long amount)
+ {
+-    if (( ptr = (pointer)Xrealloc( ptr, amount ) ) == NULL)
++    if ((ptr = Xrealloc(ptr, amount)) == NULL)
+     {
+-	if ((long)amount > 0)
++	if (amount != 0)
+             FatalError( "Out of memory" );
+     }
+-    return ((unsigned long *)ptr);
++    return ptr;
+ }
+ 
+ /*****************