debian/patches/CVE-2014-8xxx/0000-glx-check-return.patch

   1 From 61a292adf45405641de1c522a04c148e0a152acd Mon Sep 17 00:00:00 2001
   2 From: Keith Packard <keithp@keithp.com>
   3 Date: Thu, 9 Oct 2014 15:17:17 +0200
   4 Subject: glx: check return from __glXGetAnswerBuffer
   5
   6 This function can return NULL; make sure every caller tests for that.
   7
   8 Reviewed-by: Adam Jackson <ajax@redhat.com>
   9 Signed-off-by: Keith Packard <keithp@keithp.com>
  10
  11 --- a/glx/indirect_dispatch.c
  12 +++ b/glx/indirect_dispatch.c
  13 @@ -2464,6 +2464,9 @@ __glXDisp_AreTexturesResident(__GLXclien
  14          GLboolean answerBuffer[200];
  15          GLboolean *residences =
  16              __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
  17 +
  18 +        if (residences == NULL)
  19 +            return BadAlloc;
  20          retval =
  21              glAreTexturesResident(n, (const GLuint *) (pc + 4), residences);
  22          __glXSendReply(cl->client, residences, n, 1, GL_TRUE, retval);
  23 @@ -2488,6 +2491,9 @@ __glXDisp_AreTexturesResidentEXT(__GLXcl
  24          GLboolean answerBuffer[200];
  25          GLboolean *residences =
  26              __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
  27 +
  28 +        if (residences == NULL)
  29 +            return BadAlloc;
  30          retval =
  31              glAreTexturesResident(n, (const GLuint *) (pc + 4), residences);
  32          __glXSendReply(cl->client, residences, n, 1, GL_TRUE, retval);
  33 @@ -2593,6 +2599,9 @@ __glXDisp_GenTextures(__GLXclientState *
  34          GLuint *textures =
  35              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
  36                                   4);
  37 +
  38 +        if (textures == NULL)
  39 +            return BadAlloc;
  40          glGenTextures(n, textures);
  41          __glXSendReply(cl->client, textures, n, 4, GL_TRUE, 0);
  42          error = Success;
  43 @@ -2616,6 +2625,9 @@ __glXDisp_GenTexturesEXT(__GLXclientStat
  44          GLuint *textures =
  45              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
  46                                   4);
  47 +
  48 +        if (textures == NULL)
  49 +            return BadAlloc;
  50          glGenTextures(n, textures);
  51          __glXSendReply(cl->client, textures, n, 4, GL_TRUE, 0);
  52          error = Success;
  53 @@ -3883,6 +3895,9 @@ __glXDisp_GenQueries(__GLXclientState *
  54          GLuint *ids =
  55              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
  56                                   4);
  57 +
  58 +        if (ids == NULL)
  59 +            return BadAlloc;
  60          GenQueries(n, ids);
  61          __glXSendReply(cl->client, ids, n, 4, GL_TRUE, 0);
  62          error = Success;
  63 @@ -4253,6 +4268,9 @@ __glXDisp_GenProgramsARB(__GLXclientStat
  64          GLuint *programs =
  65              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
  66                                   4);
  67 +
  68 +        if (programs == NULL)
  69 +            return BadAlloc;
  70          GenProgramsARB(n, programs);
  71          __glXSendReply(cl->client, programs, n, 4, GL_TRUE, 0);
  72          error = Success;
  73 @@ -4630,6 +4648,10 @@ __glXDisp_GenFramebuffers(__GLXclientSta
  74          GLuint *framebuffers =
  75              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
  76                                   4);
  77 +
  78 +        if (framebuffers == NULL)
  79 +            return BadAlloc;
  80 +
  81          GenFramebuffers(n, framebuffers);
  82          __glXSendReply(cl->client, framebuffers, n, 4, GL_TRUE, 0);
  83          error = Success;
  84 @@ -4655,6 +4677,9 @@ __glXDisp_GenRenderbuffers(__GLXclientSt
  85          GLuint *renderbuffers =
  86              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
  87                                   4);
  88 +
  89 +        if (renderbuffers == NULL)
  90 +            return BadAlloc;
  91          GenRenderbuffers(n, renderbuffers);
  92          __glXSendReply(cl->client, renderbuffers, n, 4, GL_TRUE, 0);
  93          error = Success;
  94 --- a/glx/indirect_dispatch_swap.c
  95 +++ b/glx/indirect_dispatch_swap.c
  96 @@ -2731,6 +2731,9 @@ __glXDispSwap_AreTexturesResident(__GLXc
  97          GLboolean answerBuffer[200];
  98          GLboolean *residences =
  99              __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
 100 +
 101 +        if (residences == NULL)
 102 +            return BadAlloc;
 103          retval =
 104              glAreTexturesResident(n,
 105                                    (const GLuint *)
 106 @@ -2759,6 +2762,9 @@ __glXDispSwap_AreTexturesResidentEXT(__G
 107          GLboolean answerBuffer[200];
 108          GLboolean *residences =
 109              __glXGetAnswerBuffer(cl, n, answerBuffer, sizeof(answerBuffer), 1);
 110 +
 111 +        if (residences == NULL)
 112 +            return BadAlloc;
 113          retval =
 114              glAreTexturesResident(n,
 115                                    (const GLuint *)
 116 @@ -2878,6 +2884,9 @@ __glXDispSwap_GenTextures(__GLXclientSta
 117          GLuint *textures =
 118              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
 119                                   4);
 120 +
 121 +        if (textures == NULL)
 122 +            return BadAlloc;
 123          glGenTextures(n, textures);
 124          (void) bswap_32_array((uint32_t *) textures, n);
 125          __glXSendReplySwap(cl->client, textures, n, 4, GL_TRUE, 0);
 126 @@ -2903,6 +2912,9 @@ __glXDispSwap_GenTexturesEXT(__GLXclient
 127          GLuint *textures =
 128              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
 129                                   4);
 130 +
 131 +        if (textures == NULL)
 132 +            return BadAlloc;
 133          glGenTextures(n, textures);
 134          (void) bswap_32_array((uint32_t *) textures, n);
 135          __glXSendReplySwap(cl->client, textures, n, 4, GL_TRUE, 0);
 136 @@ -4290,6 +4302,9 @@ __glXDispSwap_GenQueries(__GLXclientStat
 137          GLuint *ids =
 138              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
 139                                   4);
 140 +        if (ids == NULL)
 141 +            return BadAlloc;
 142 +
 143          GenQueries(n, ids);
 144          (void) bswap_32_array((uint32_t *) ids, n);
 145          __glXSendReplySwap(cl->client, ids, n, 4, GL_TRUE, 0);
 146 @@ -4697,6 +4712,9 @@ __glXDispSwap_GenProgramsARB(__GLXclient
 147          GLuint *programs =
 148              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
 149                                   4);
 150 +        if (programs == NULL)
 151 +            return BadAlloc;
 152 +
 153          GenProgramsARB(n, programs);
 154          (void) bswap_32_array((uint32_t *) programs, n);
 155          __glXSendReplySwap(cl->client, programs, n, 4, GL_TRUE, 0);
 156 @@ -5122,6 +5140,10 @@ __glXDispSwap_GenFramebuffers(__GLXclien
 157          GLuint *framebuffers =
 158              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
 159                                   4);
 160 +
 161 +        if (framebuffers == NULL)
 162 +            return BadAlloc;
 163 +
 164          GenFramebuffers(n, framebuffers);
 165          (void) bswap_32_array((uint32_t *) framebuffers, n);
 166          __glXSendReplySwap(cl->client, framebuffers, n, 4, GL_TRUE, 0);
 167 @@ -5149,6 +5171,10 @@ __glXDispSwap_GenRenderbuffers(__GLXclie
 168          GLuint *renderbuffers =
 169              __glXGetAnswerBuffer(cl, n * 4, answerBuffer, sizeof(answerBuffer),
 170                                   4);
 171 +
 172 +        if (renderbuffers == NULL)
 173 +            return BadAlloc;
 174 +
 175          GenRenderbuffers(n, renderbuffers);
 176          (void) bswap_32_array((uint32_t *) renderbuffers, n);
 177          __glXSendReplySwap(cl->client, renderbuffers, n, 4, GL_TRUE, 0);