Find a file
Jeremy Huddleston 04c9e80f08 Fix a couple off-by-one array boundary checks.
Error: Write outside array bounds at Xext/geext.c:406
        in function 'GEWindowSetMask' [Symbolic analysis]
       In array dereference of cli->nextSib[extension] with index 'extension'
       Array size is 128 elements (of 4 bytes each), index <= 128

Error: Buffer overflow at dix/events.c:592
	in function 'SetMaskForEvent' [Symbolic analysis]
       In array dereference of filters[deviceid] with index 'deviceid'
       Array size is 20 elements (of 512 bytes each), index >= 0 and index <= 20

Error: Read buffer overflow at hw/xfree86/loader/loader.c:226
	in function 'LoaderOpen' [Symbolic analysis]
       In array dereference of refCount[new_handle] with index 'new_handle'
       Array size is 256 elements (of 4 bytes each), index >= 1 and index <= 256

These bugs were found using the Parfait source code analysis tool.
For more information see http://research.sun.com/projects/parfait

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit b680bda34d)
2009-05-09 11:42:17 -07:00
composite Switching from Automatic to Manual redirect needs to unmap/remap 2008-09-19 20:58:32 -07:00
config config: if we can't connect to HAL, listen for a startup notification. 2009-02-18 17:50:21 -08:00
damageext Unifdef ISC 2008-10-02 17:03:54 -04:00
dbe Dead code cleanup over DBE. 2008-11-25 15:05:20 -05:00
dix Fix a couple off-by-one array boundary checks. 2009-05-09 11:42:17 -07:00
doc Document zap/-retro interaction more. 2008-10-07 20:40:15 -04:00
exa exa: kill of exaImageGlyphBlt 2009-02-25 11:49:37 -08:00
fb Partially reverts commit 505c216d03. 2008-10-03 11:24:34 -07:00
glx glx: Fix drawable private leak on destroy 2009-04-13 16:15:24 -04:00
hw Fix a couple off-by-one array boundary checks. 2009-05-09 11:42:17 -07:00
include selinux: Add support for avc_acquire_netlink_fd() 2009-03-27 16:18:39 -04:00
mi mi: force the paired kbd device before CopyKeyClass. (#19574) 2009-02-17 18:57:13 -08:00
miext XQuartz: Update window levels when changing rootless state 2009-04-10 00:47:39 -07:00
os Don't log audit messages when -audit 0 specified 2009-01-09 09:59:54 -08:00
randr Correct access mode in call to dixLookupWindow() within RRSelectInput. 2009-04-08 16:05:11 -04:00
record Drop the never-called SkippedRequestCallback list. 2008-10-03 17:51:19 -04:00
render Move matrix operations from X server to pixman 0.13.2 2008-11-25 22:17:58 -08:00
Xext Fix a couple off-by-one array boundary checks. 2009-05-09 11:42:17 -07:00
xfixes Unifdef ISC 2008-10-02 17:03:54 -04:00
Xi Xi: don't crash on a NULL property name, just return None. 2009-03-27 15:25:24 -04:00
xkb xkb: Fix wrong colour reference in XKB geometry copying. #20081 2009-03-27 15:25:36 -04:00
.gitignore Updated .gitignore 2008-12-28 22:16:21 -08:00
acinclude.m4 dolt: allow older versions of bash to compile the xserver (#19031) 2008-12-16 12:03:03 -08:00
autogen.sh autogen.sh: Pass --force to autoreconf 2008-07-22 16:55:26 +03:00
configure.ac Merge commit 'origin/server-1.6-branch' into xorg-server-1.6-apple 2009-04-22 19:29:04 -07:00
COPYING Revert "Update COPYING for SHA1 code" 2008-09-23 09:21:37 -07:00
cpprules.in For MANDEFS, also replace __mandir__ for $(mandir) which includes 2006-12-08 15:51:44 -06:00
Makefile.am Fix distcheck with dolt 2009-03-27 16:49:45 -04:00
xorg-server.m4 Add xorg-server.m4 for driver dependency checking. 2005-11-01 15:01:51 +00:00
xorg-server.pc.in Include pciaccess in the xorg-server.pc Requires line. 2008-04-15 14:51:51 -07:00