diff --git a/Xext/shm.c b/Xext/shm.c index 5633be904..6f99e9064 100644 --- a/Xext/shm.c +++ b/Xext/shm.c @@ -737,14 +737,6 @@ ProcPanoramiXShmCreatePixmap( } if (width > 32767 || height > 32767) return BadAlloc; - size = PixmapBytePad(width, depth) * height; - if (sizeof(size) == 4) { - if (size < width * height) - return BadAlloc; - /* thankfully, offset is unsigned */ - if (stuff->offset + size < size) - return BadAlloc; - } if (stuff->depth != 1) { @@ -755,7 +747,17 @@ ProcPanoramiXShmCreatePixmap( client->errorValue = stuff->depth; return BadValue; } + CreatePmap: + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + } + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) @@ -1080,14 +1082,6 @@ ProcShmCreatePixmap(client) } if (width > 32767 || height > 32767) return BadAlloc; - size = PixmapBytePad(width, depth) * height; - if (sizeof(size) == 4) { - if (size < width * height) - return BadAlloc; - /* thankfully, offset is unsigned */ - if (stuff->offset + size < size) - return BadAlloc; - } if (stuff->depth != 1) { @@ -1098,7 +1092,17 @@ ProcShmCreatePixmap(client) client->errorValue = stuff->depth; return BadValue; } + CreatePmap: + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + } + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( pDraw->pScreen, stuff->width,