[deb_xorg-server.git] / debian / patches / CVE-2014-8xxx / 0000-glx-check-return.patch

From 61a292adf45405641de1c522a04c148e0a152acd Mon Sep 17 00:00:00 2001
From: Keith Packard <keithp@keithp.com>
Date: Thu, 9 Oct 2014 15:17:17 +0200
Subject: glx: check return from __glXGetAnswerBuffer

This function can return NULL; make sure every caller tests for that.

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>

--- a/glx/indirect_dispatch.c
+++ b/glx/indirect_dispatch.c
@@ -2464,6 +2464,9 @@ __glXDisp_AreTexturesResident(__GLXclien
         GLboolean answerBuffer[200];
         GLboolean *residences =
             __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
+
+        if (residences == NULL)
+            return BadAlloc;
         retval =
             glAreTexturesResident(n, (const GLuint *) (pc + 4), residences);
         __glXSendReply(cl->client, residences, n, 1, GL_TRUE, retval);
@@ -2488,6 +2491,9 @@ __glXDisp_AreTexturesResidentEXT(__GLXcl
         GLboolean answerBuffer[200];
         GLboolean *residences =
             __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
+
+        if (residences == NULL)
+            return BadAlloc;
         retval =
             glAreTexturesResident(n, (const GLuint *) (pc + 4), residences);
         __glXSendReply(cl->client, residences, n, 1, GL_TRUE, retval);
@@ -2593,6 +2599,9 @@ __glXDisp_GenTextures(__GLXclientState *
         GLuint *textures =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (textures == NULL)
+            return BadAlloc;
         glGenTextures(n, textures);
         __glXSendReply(cl->client, textures, n, 4, GL_TRUE, 0);
         error = Success;
@@ -2616,6 +2625,9 @@ __glXDisp_GenTexturesEXT(__GLXclientStat
         GLuint *textures =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (textures == NULL)
+            return BadAlloc;
         glGenTextures(n, textures);
         __glXSendReply(cl->client, textures, n, 4, GL_TRUE, 0);
         error = Success;
@@ -3883,6 +3895,9 @@ __glXDisp_GenQueries(__GLXclientState *
         GLuint *ids =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (ids == NULL)
+            return BadAlloc;
         GenQueries(n, ids);
         __glXSendReply(cl->client, ids, n, 4, GL_TRUE, 0);
         error = Success;
@@ -4253,6 +4268,9 @@ __glXDisp_GenProgramsARB(__GLXclientStat
         GLuint *programs =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (programs == NULL)
+            return BadAlloc;
         GenProgramsARB(n, programs);
         __glXSendReply(cl->client, programs, n, 4, GL_TRUE, 0);
         error = Success;
@@ -4630,6 +4648,10 @@ __glXDisp_GenFramebuffers(__GLXclientSta
         GLuint *framebuffers =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (framebuffers == NULL)
+            return BadAlloc;
+
         GenFramebuffers(n, framebuffers);
         __glXSendReply(cl->client, framebuffers, n, 4, GL_TRUE, 0);
         error = Success;
@@ -4655,6 +4677,9 @@ __glXDisp_GenRenderbuffers(__GLXclientSt
         GLuint *renderbuffers =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (renderbuffers == NULL)
+            return BadAlloc;
         GenRenderbuffers(n, renderbuffers);
         __glXSendReply(cl->client, renderbuffers, n, 4, GL_TRUE, 0);
         error = Success;
--- a/glx/indirect_dispatch_swap.c
+++ b/glx/indirect_dispatch_swap.c
@@ -2731,6 +2731,9 @@ __glXDispSwap_AreTexturesResident(__GLXc
         GLboolean answerBuffer[200];
         GLboolean *residences =
             __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
+
+        if (residences == NULL)
+            return BadAlloc;
         retval =
             glAreTexturesResident(n,
                                   (const GLuint *)
@@ -2759,6 +2762,9 @@ __glXDispSwap_AreTexturesResidentEXT(__G
         GLboolean answerBuffer[200];
         GLboolean *residences =
             __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
+
+        if (residences == NULL)
+            return BadAlloc;
         retval =
             glAreTexturesResident(n,
                                   (const GLuint *)
@@ -2878,6 +2884,9 @@ __glXDispSwap_GenTextures(__GLXclientSta
         GLuint *textures =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (textures == NULL)
+            return BadAlloc;
         glGenTextures(n, textures);
         (void) bswap_32_array((uint32_t *) textures, n);
         __glXSendReplySwap(cl->client, textures, n, 4, GL_TRUE, 0);
@@ -2903,6 +2912,9 @@ __glXDispSwap_GenTexturesEXT(__GLXclient
         GLuint *textures =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (textures == NULL)
+            return BadAlloc;
         glGenTextures(n, textures);
         (void) bswap_32_array((uint32_t *) textures, n);
         __glXSendReplySwap(cl->client, textures, n, 4, GL_TRUE, 0);
@@ -4290,6 +4302,9 @@ __glXDispSwap_GenQueries(__GLXclientStat
         GLuint *ids =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+        if (ids == NULL)
+            return BadAlloc;
+
         GenQueries(n, ids);
         (void) bswap_32_array((uint32_t *) ids, n);
         __glXSendReplySwap(cl->client, ids, n, 4, GL_TRUE, 0);
@@ -4697,6 +4712,9 @@ __glXDispSwap_GenProgramsARB(__GLXclient
         GLuint *programs =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+        if (programs == NULL)
+            return BadAlloc;
+
         GenProgramsARB(n, programs);
         (void) bswap_32_array((uint32_t *) programs, n);
         __glXSendReplySwap(cl->client, programs, n, 4, GL_TRUE, 0);
@@ -5122,6 +5140,10 @@ __glXDispSwap_GenFramebuffers(__GLXclien
         GLuint *framebuffers =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (framebuffers == NULL)
+            return BadAlloc;
+
         GenFramebuffers(n, framebuffers);
         (void) bswap_32_array((uint32_t *) framebuffers, n);
         __glXSendReplySwap(cl->client, framebuffers, n, 4, GL_TRUE, 0);
@@ -5149,6 +5171,10 @@ __glXDispSwap_GenRenderbuffers(__GLXclie
         GLuint *renderbuffers =
             __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
                                  4);
+
+        if (renderbuffers == NULL)
+            return BadAlloc;
+
         GenRenderbuffers(n, renderbuffers);
         (void) bswap_32_array((uint32_t *) renderbuffers, n);
         __glXSendReplySwap(cl->client, renderbuffers, n, 4, GL_TRUE, 0);
Commit	Line	Data
	1	From 61a292adf45405641de1c522a04c148e0a152acd Mon Sep 17 00:00:00 2001
	2	From: Keith Packard <keithp@keithp.com>
	3	Date: Thu, 9 Oct 2014 15:17:17 +0200
	4	Subject: glx: check return from __glXGetAnswerBuffer
	5
	6	This function can return NULL; make sure every caller tests for that.
	7
	8	Reviewed-by: Adam Jackson <ajax@redhat.com>
	9	Signed-off-by: Keith Packard <keithp@keithp.com>
	10
	11	--- a/glx/indirect_dispatch.c
	12	+++ b/glx/indirect_dispatch.c
	13	@@ -2464,6 +2464,9 @@ __glXDisp_AreTexturesResident(__GLXclien
	14	GLboolean answerBuffer[200];
	15	GLboolean *residences =
	16	__glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
	17	+
	18	+ if (residences == NULL)
	19	+ return BadAlloc;
	20	retval =
	21	glAreTexturesResident(n, (const GLuint *) (pc + 4), residences);
	22	__glXSendReply(cl->client, residences, n, 1, GL_TRUE, retval);
	23	@@ -2488,6 +2491,9 @@ __glXDisp_AreTexturesResidentEXT(__GLXcl
	24	GLboolean answerBuffer[200];
	25	GLboolean *residences =
	26	__glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
	27	+
	28	+ if (residences == NULL)
	29	+ return BadAlloc;
	30	retval =
	31	glAreTexturesResident(n, (const GLuint *) (pc + 4), residences);
	32	__glXSendReply(cl->client, residences, n, 1, GL_TRUE, retval);
	33	@@ -2593,6 +2599,9 @@ __glXDisp_GenTextures(__GLXclientState *
	34	GLuint *textures =
	35	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	36	4);
	37	+
	38	+ if (textures == NULL)
	39	+ return BadAlloc;
	40	glGenTextures(n, textures);
	41	__glXSendReply(cl->client, textures, n, 4, GL_TRUE, 0);
	42	error = Success;
	43	@@ -2616,6 +2625,9 @@ __glXDisp_GenTexturesEXT(__GLXclientStat
	44	GLuint *textures =
	45	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	46	4);
	47	+
	48	+ if (textures == NULL)
	49	+ return BadAlloc;
	50	glGenTextures(n, textures);
	51	__glXSendReply(cl->client, textures, n, 4, GL_TRUE, 0);
	52	error = Success;
	53	@@ -3883,6 +3895,9 @@ __glXDisp_GenQueries(__GLXclientState *
	54	GLuint *ids =
	55	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	56	4);
	57	+
	58	+ if (ids == NULL)
	59	+ return BadAlloc;
	60	GenQueries(n, ids);
	61	__glXSendReply(cl->client, ids, n, 4, GL_TRUE, 0);
	62	error = Success;
	63	@@ -4253,6 +4268,9 @@ __glXDisp_GenProgramsARB(__GLXclientStat
	64	GLuint *programs =
	65	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	66	4);
	67	+
	68	+ if (programs == NULL)
	69	+ return BadAlloc;
	70	GenProgramsARB(n, programs);
	71	__glXSendReply(cl->client, programs, n, 4, GL_TRUE, 0);
	72	error = Success;
	73	@@ -4630,6 +4648,10 @@ __glXDisp_GenFramebuffers(__GLXclientSta
	74	GLuint *framebuffers =
	75	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	76	4);
	77	+
	78	+ if (framebuffers == NULL)
	79	+ return BadAlloc;
	80	+
	81	GenFramebuffers(n, framebuffers);
	82	__glXSendReply(cl->client, framebuffers, n, 4, GL_TRUE, 0);
	83	error = Success;
	84	@@ -4655,6 +4677,9 @@ __glXDisp_GenRenderbuffers(__GLXclientSt
	85	GLuint *renderbuffers =
	86	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	87	4);
	88	+
	89	+ if (renderbuffers == NULL)
	90	+ return BadAlloc;
	91	GenRenderbuffers(n, renderbuffers);
	92	__glXSendReply(cl->client, renderbuffers, n, 4, GL_TRUE, 0);
	93	error = Success;
	94	--- a/glx/indirect_dispatch_swap.c
	95	+++ b/glx/indirect_dispatch_swap.c
	96	@@ -2731,6 +2731,9 @@ __glXDispSwap_AreTexturesResident(__GLXc
	97	GLboolean answerBuffer[200];
	98	GLboolean *residences =
	99	__glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
	100	+
	101	+ if (residences == NULL)
	102	+ return BadAlloc;
	103	retval =
	104	glAreTexturesResident(n,
	105	(const GLuint *)
	106	@@ -2759,6 +2762,9 @@ __glXDispSwap_AreTexturesResidentEXT(__G
	107	GLboolean answerBuffer[200];
	108	GLboolean *residences =
	109	__glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
	110	+
	111	+ if (residences == NULL)
	112	+ return BadAlloc;
	113	retval =
	114	glAreTexturesResident(n,
	115	(const GLuint *)
	116	@@ -2878,6 +2884,9 @@ __glXDispSwap_GenTextures(__GLXclientSta
	117	GLuint *textures =
	118	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	119	4);
	120	+
	121	+ if (textures == NULL)
	122	+ return BadAlloc;
	123	glGenTextures(n, textures);
	124	(void) bswap_32_array((uint32_t *) textures, n);
	125	__glXSendReplySwap(cl->client, textures, n, 4, GL_TRUE, 0);
	126	@@ -2903,6 +2912,9 @@ __glXDispSwap_GenTexturesEXT(__GLXclient
	127	GLuint *textures =
	128	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	129	4);
	130	+
	131	+ if (textures == NULL)
	132	+ return BadAlloc;
	133	glGenTextures(n, textures);
	134	(void) bswap_32_array((uint32_t *) textures, n);
	135	__glXSendReplySwap(cl->client, textures, n, 4, GL_TRUE, 0);
	136	@@ -4290,6 +4302,9 @@ __glXDispSwap_GenQueries(__GLXclientStat
	137	GLuint *ids =
	138	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	139	4);
	140	+ if (ids == NULL)
	141	+ return BadAlloc;
	142	+
	143	GenQueries(n, ids);
	144	(void) bswap_32_array((uint32_t *) ids, n);
	145	__glXSendReplySwap(cl->client, ids, n, 4, GL_TRUE, 0);
	146	@@ -4697,6 +4712,9 @@ __glXDispSwap_GenProgramsARB(__GLXclient
	147	GLuint *programs =
	148	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	149	4);
	150	+ if (programs == NULL)
	151	+ return BadAlloc;
	152	+
	153	GenProgramsARB(n, programs);
	154	(void) bswap_32_array((uint32_t *) programs, n);
	155	__glXSendReplySwap(cl->client, programs, n, 4, GL_TRUE, 0);
	156	@@ -5122,6 +5140,10 @@ __glXDispSwap_GenFramebuffers(__GLXclien
	157	GLuint *framebuffers =
	158	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	159	4);
	160	+
	161	+ if (framebuffers == NULL)
	162	+ return BadAlloc;
	163	+
	164	GenFramebuffers(n, framebuffers);
	165	(void) bswap_32_array((uint32_t *) framebuffers, n);
	166	__glXSendReplySwap(cl->client, framebuffers, n, 4, GL_TRUE, 0);
	167	@@ -5149,6 +5171,10 @@ __glXDispSwap_GenRenderbuffers(__GLXclie
	168	GLuint *renderbuffers =
	169	__glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
	170	4);
	171	+
	172	+ if (renderbuffers == NULL)
	173	+ return BadAlloc;
	174	+
	175	GenRenderbuffers(n, renderbuffers);
	176	(void) bswap_32_array((uint32_t *) renderbuffers, n);
	177	__glXSendReplySwap(cl->client, renderbuffers, n, 4, GL_TRUE, 0);