fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-24 21:50:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

glx: Fix handling of property list received from the server in glXImportContextEXT

Browse source 
The primary problem was that the number of reply bytes read is clamped
to sizeof(propList), but the loop that processes the properties tries
to examine all of the properties sent by the server.  If the server
sends 47,000 properties, we only read 3 but process all 47,000.

NOTE: This is a candidate for the 7.11 branch.

Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
This commit is contained in:
Ian Romanick 2011-12-07 11:15:14 -08:00
parent 7c2f1160c2
commit 5a849e864e
1 changed files with 32 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
src/glx/glxcmds.c
View file

@ -1411,14 +1411,23 @@ _X_EXPORT GLXContext
glXImportContextEXT(Display *dpy, GLXContextID contextID)
{
struct glx_display *priv = __glXInitialize(dpy);
struct glx_screen *psc;
struct glx_screen *psc = NULL;
xGLXQueryContextReply reply;
CARD8 opcode;
struct glx_context *ctx;
int propList[__GLX_MAX_CONTEXT_PROPS * 2], *pProp, nPropListBytes;
/* This GLX implementation knows about 5 different properties, so
* allow the server to send us one of each.
*/
int propList[5 * 2], *pProp, nPropListBytes;
int numProps;
int i, renderType;
XID share;
struct glx_config *mode;
uint32_t fbconfigID = 0;
uint32_t visualID = 0;
uint32_t screen;
Bool got_screen = False;
if (contextID == None || __glXIsDirect(dpy, contextID))
return NULL;
@ -1463,35 +1472,45 @@ glXImportContextEXT(Display *dpy, GLXContextID contextID)
UnlockDisplay(dpy);
SyncHandle();
/* Look up screen first so we can look up visuals/fbconfigs later */
psc = NULL;
for (i = 0, pProp = propList; i < reply.n; i++, pProp += 2)
if (pProp[0] == GLX_SCREEN)
psc = GetGLXScreenConfigs(dpy, pProp[1]);
if (psc == NULL)
return NULL;
numProps = nPropListBytes / (2 * sizeof(propList[0]));
share = None;
mode = NULL;
renderType = 0;
pProp = propList;
for (i = 0, pProp = propList; i < reply.n; i++, pProp += 2)
for (i = 0, pProp = propList; i < numProps; i++, pProp += 2)
switch (pProp[0]) {
case GLX_SCREEN:
screen = pProp[1];
got_screen = True;
break;
case GLX_SHARE_CONTEXT_EXT:
share = pProp[1];
break;
case GLX_VISUAL_ID_EXT:
mode = glx_config_find_visual(psc->visuals, pProp[1]);
visualID = pProp[1];
break;
case GLX_FBCONFIG_ID:
mode = glx_config_find_fbconfig(psc->configs, pProp[1]);
fbconfigID = pProp[1];
break;
case GLX_RENDER_TYPE:
renderType = pProp[1];
break;
}
if (!got_screen)
return NULL;
psc = GetGLXScreenConfigs(dpy, screen);
if (psc == NULL)
return NULL;
if (fbconfigID != 0) {
mode = glx_config_find_fbconfig(psc->configs, fbconfigID);
} else if (visualID != 0) {
mode = glx_config_find_visual(psc->visuals, visualID);
}
if (mode == NULL)
return NULL;