diff options
Diffstat (limited to 'x11')
-rw-r--r-- | x11/libXrender/Makefile | 3 | ||||
-rw-r--r-- | x11/libXrender/distinfo | 4 | ||||
-rw-r--r-- | x11/libXrender/files/patch-src_Filter.c | 70 | ||||
-rw-r--r-- | x11/libXrender/files/patch-src_Xrender.c | 114 |
4 files changed, 3 insertions, 188 deletions
diff --git a/x11/libXrender/Makefile b/x11/libXrender/Makefile index 4205a28f20c4..3866a0f87db5 100644 --- a/x11/libXrender/Makefile +++ b/x11/libXrender/Makefile @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= libXrender -PORTVERSION= 0.9.7 -PORTREVISION= 1 +PORTVERSION= 0.9.8 CATEGORIES= x11 MAINTAINER= x11@FreeBSD.org diff --git a/x11/libXrender/distinfo b/x11/libXrender/distinfo index a0865cc86371..72503f465ab4 100644 --- a/x11/libXrender/distinfo +++ b/x11/libXrender/distinfo @@ -1,2 +1,2 @@ -SHA256 (xorg/lib/libXrender-0.9.7.tar.bz2) = f9b46b93c9bc15d5745d193835ac9ba2a2b411878fad60c504bbb8f98492bbe6 -SIZE (xorg/lib/libXrender-0.9.7.tar.bz2) = 281098 +SHA256 (xorg/lib/libXrender-0.9.8.tar.bz2) = 1d14b02f0060aec5d90dfdcf16a996f17002e515292906ed26e3dcbba0f4fc62 +SIZE (xorg/lib/libXrender-0.9.8.tar.bz2) = 306121 diff --git a/x11/libXrender/files/patch-src_Filter.c b/x11/libXrender/files/patch-src_Filter.c deleted file mode 100644 index 9bd1784ec5ca..000000000000 --- a/x11/libXrender/files/patch-src_Filter.c +++ /dev/null @@ -1,70 +0,0 @@ ---- src/Filter.c.orig 2013-06-03 19:11:25.000000000 +0000 -+++ src/Filter.c 2013-06-03 19:11:31.000000000 +0000 -@@ -25,6 +25,7 @@ - #include <config.h> - #endif - #include "Xrenderint.h" -+#include <limits.h> - - XFilters * - XRenderQueryFilters (Display *dpy, Drawable drawable) -@@ -37,7 +38,7 @@ XRenderQueryFilters (Display *dpy, Drawa - char *name; - char len; - int i; -- long nbytes, nbytesAlias, nbytesName; -+ unsigned long nbytes, nbytesAlias, nbytesName; - - if (!RenderHasExtension (info)) - return NULL; -@@ -60,26 +61,36 @@ XRenderQueryFilters (Display *dpy, Drawa - SyncHandle (); - return NULL; - } -- /* -- * Compute total number of bytes for filter names -- */ -- nbytes = (long)rep.length << 2; -- nbytesAlias = rep.numAliases * 2; -- if (rep.numAliases & 1) -- nbytesAlias += 2; -- nbytesName = nbytes - nbytesAlias; - - /* -- * Allocate one giant block for the whole data structure -+ * Limit each component of combined size to 1/4 the max, which is far -+ * more than they should ever possibly need. - */ -- filters = Xmalloc (sizeof (XFilters) + -- rep.numFilters * sizeof (char *) + -- rep.numAliases * sizeof (short) + -- nbytesName); -+ if ((rep.length < (INT_MAX >> 2)) && -+ (rep.numFilters < ((INT_MAX / 4) / sizeof (char *))) && -+ (rep.numAliases < ((INT_MAX / 4) / sizeof (short)))) { -+ /* -+ * Compute total number of bytes for filter names -+ */ -+ nbytes = (unsigned long)rep.length << 2; -+ nbytesAlias = rep.numAliases * 2; -+ if (rep.numAliases & 1) -+ nbytesAlias += 2; -+ nbytesName = nbytes - nbytesAlias; -+ -+ /* -+ * Allocate one giant block for the whole data structure -+ */ -+ filters = Xmalloc (sizeof (XFilters) + -+ (rep.numFilters * sizeof (char *)) + -+ (rep.numAliases * sizeof (short)) + -+ nbytesName); -+ } else -+ filters = NULL; - - if (!filters) - { -- _XEatData (dpy, (unsigned long) rep.length << 2); -+ _XEatDataWords(dpy, rep.length); - UnlockDisplay (dpy); - SyncHandle (); - return NULL; diff --git a/x11/libXrender/files/patch-src_Xrender.c b/x11/libXrender/files/patch-src_Xrender.c deleted file mode 100644 index 0d282cb8c3e9..000000000000 --- a/x11/libXrender/files/patch-src_Xrender.c +++ /dev/null @@ -1,114 +0,0 @@ ---- src/Xrender.c.orig 2013-06-03 19:11:25.000000000 +0000 -+++ src/Xrender.c 2013-06-03 19:11:34.000000000 +0000 -@@ -26,6 +26,7 @@ - #include <config.h> - #endif - #include "Xrenderint.h" -+#include <limits.h> - - XRenderExtInfo XRenderExtensionInfo; - char XRenderExtensionName[] = RENDER_NAME; -@@ -411,8 +412,8 @@ XRenderQueryFormats (Display *dpy) - CARD32 *xSubpixel; - void *xData; - int nf, ns, nd, nv; -- int rlength; -- int nbytes; -+ unsigned long rlength; -+ unsigned long nbytes; - - RenderCheckExtension (dpy, info, 0); - LockDisplay (dpy); -@@ -458,24 +459,35 @@ XRenderQueryFormats (Display *dpy) - if (async_state.major_version == 0 && async_state.minor_version < 6) - rep.numSubpixel = 0; - -- xri = (XRenderInfo *) Xmalloc (sizeof (XRenderInfo) + -- rep.numFormats * sizeof (XRenderPictFormat) + -- rep.numScreens * sizeof (XRenderScreen) + -- rep.numDepths * sizeof (XRenderDepth) + -- rep.numVisuals * sizeof (XRenderVisual)); -- rlength = (rep.numFormats * sizeof (xPictFormInfo) + -- rep.numScreens * sizeof (xPictScreen) + -- rep.numDepths * sizeof (xPictDepth) + -- rep.numVisuals * sizeof (xPictVisual) + -- rep.numSubpixel * 4); -- xData = (void *) Xmalloc (rlength); -- nbytes = (int) rep.length << 2; -+ if ((rep.numFormats < ((INT_MAX / 4) / sizeof (XRenderPictFormat))) && -+ (rep.numScreens < ((INT_MAX / 4) / sizeof (XRenderScreen))) && -+ (rep.numDepths < ((INT_MAX / 4) / sizeof (XRenderDepth))) && -+ (rep.numVisuals < ((INT_MAX / 4) / sizeof (XRenderVisual))) && -+ (rep.numSubpixel < ((INT_MAX / 4) / 4)) && -+ (rep.length < (INT_MAX >> 2)) ) { -+ xri = Xmalloc (sizeof (XRenderInfo) + -+ (rep.numFormats * sizeof (XRenderPictFormat)) + -+ (rep.numScreens * sizeof (XRenderScreen)) + -+ (rep.numDepths * sizeof (XRenderDepth)) + -+ (rep.numVisuals * sizeof (XRenderVisual))); -+ rlength = ((rep.numFormats * sizeof (xPictFormInfo)) + -+ (rep.numScreens * sizeof (xPictScreen)) + -+ (rep.numDepths * sizeof (xPictDepth)) + -+ (rep.numVisuals * sizeof (xPictVisual)) + -+ (rep.numSubpixel * 4)); -+ xData = Xmalloc (rlength); -+ nbytes = (unsigned long) rep.length << 2; -+ } else { -+ xri = NULL; -+ xData = NULL; -+ rlength = nbytes = 0; -+ } - - if (!xri || !xData || nbytes < rlength) - { - if (xri) Xfree (xri); - if (xData) Xfree (xData); -- _XEatData (dpy, nbytes); -+ _XEatDataWords (dpy, rep.length); - UnlockDisplay (dpy); - SyncHandle (); - return 0; -@@ -832,7 +844,7 @@ XRenderQueryPictIndexValues(Display *d - xRenderQueryPictIndexValuesReq *req; - xRenderQueryPictIndexValuesReply rep; - XIndexValue *values; -- int nbytes, nread, rlength, i; -+ unsigned int nbytes, nread, rlength, i; - - RenderCheckExtension (dpy, info, NULL); - -@@ -848,18 +860,25 @@ XRenderQueryPictIndexValues(Display *d - return NULL; - } - -- /* request data length */ -- nbytes = (long)rep.length << 2; -- /* bytes of actual data in the request */ -- nread = rep.numIndexValues * SIZEOF (xIndexValue); -- /* size of array returned to application */ -- rlength = rep.numIndexValues * sizeof (XIndexValue); -+ if ((rep.length < (INT_MAX >> 2)) && -+ (rep.numIndexValues < (INT_MAX / sizeof (XIndexValue)))) { -+ /* request data length */ -+ nbytes = rep.length << 2; -+ /* bytes of actual data in the request */ -+ nread = rep.numIndexValues * SIZEOF (xIndexValue); -+ /* size of array returned to application */ -+ rlength = rep.numIndexValues * sizeof (XIndexValue); -+ -+ /* allocate returned data */ -+ values = Xmalloc (rlength); -+ } else { -+ nbytes = nread = rlength = 0; -+ values = NULL; -+ } - -- /* allocate returned data */ -- values = (XIndexValue *)Xmalloc (rlength); - if (!values) - { -- _XEatData (dpy, nbytes); -+ _XEatDataWords (dpy, rep.length); - UnlockDisplay (dpy); - SyncHandle (); - return NULL; |