xserver/hw
Jeremy Huddleston 597747c655 Fix a couple off-by-one array boundary checks.
Error: Write outside array bounds at Xext/geext.c:406
        in function 'GEWindowSetMask' [Symbolic analysis]
       In array dereference of cli->nextSib[extension] with index 'extension'
       Array size is 128 elements (of 4 bytes each), index <= 128

Error: Buffer overflow at dix/events.c:592
	in function 'SetMaskForEvent' [Symbolic analysis]
       In array dereference of filters[deviceid] with index 'deviceid'
       Array size is 20 elements (of 512 bytes each), index >= 0 and index <= 20

Error: Read buffer overflow at hw/xfree86/loader/loader.c:226
	in function 'LoaderOpen' [Symbolic analysis]
       In array dereference of refCount[new_handle] with index 'new_handle'
       Array size is 256 elements (of 4 bytes each), index >= 1 and index <= 256

These bugs were found using the Parfait source code analysis tool.
For more information see http://research.sun.com/projects/parfait

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit b680bda34d)
(cherry picked from commit 04c9e80f08)

Signed-off-by: Keith Packard <keithp@keithp.com>
2009-06-29 14:15:17 -07:00
..
dmx Fix dmx compile on 1.6 branch. 2009-01-12 10:57:11 -08:00
kdrive Refix Sun bug #6685465: Xephyr uses wrong or bad colortable in 8-bit mode 2008-11-25 16:31:11 -08:00
vfb vfb: Fix depth setup. 2009-06-11 15:19:47 -04:00
xfree86 Fix a couple off-by-one array boundary checks. 2009-06-29 14:15:17 -07:00
xnest Warning fix 2008-11-25 15:05:18 -05:00
xquartz XQuartz: Re-enable support for capslock 2009-02-25 11:35:19 -08:00
xwin xalloc+memset(0) -> xcalloc 2008-10-06 15:36:51 -04:00
Makefile.am Remove xgl. 2008-06-12 16:00:50 -04:00