X-Git-Url: https://git.piment-noir.org/?p=deb_xorg-server.git;a=blobdiff_plain;f=debian%2Fpatches%2FCVE-2014-8xxx%2F0032-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch;fp=debian%2Fpatches%2FCVE-2014-8xxx%2F0032-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch;h=131b0d683627d9fe2cc0e20d9c3fdb2636f8dc33;hp=0000000000000000000000000000000000000000;hb=7217e0ca50bba73dad94782e67980aeeb24ab693;hpb=a09e091a5c996d46a398abb27b06fe504591673f

diff --git a/debian/patches/CVE-2014-8xxx/0032-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch b/debian/patches/CVE-2014-8xxx/0032-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch
new file mode 100644
index 0000000..131b0d6
--- /dev/null
+++ b/debian/patches/CVE-2014-8xxx/0032-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch
@@ -0,0 +1,913 @@
+From d303d79450436a1ef04252c2a7e36870c2506f38 Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Mon, 10 Nov 2014 12:13:48 -0500
+Subject: [PATCH 32/33] glx: Pass remaining request length into ->varsize (v2)
+ [CVE-2014-8098 8/8]
+
+v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau)
+
+Reviewed-by: Julien Cristau <jcristau@debian.org>
+Reviewed-by: Michal Srb <msrb@suse.com>
+Reviewed-by: Andy Ritger <aritger@nvidia.com>
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ glx/glxcmds.c          |    7 +-
+ glx/glxserver.h        |    2 +-
+ glx/indirect_reqsize.c |  142 +++++++++++++++++++------------------
+ glx/indirect_reqsize.h |  181 +++++++++++++++++++++++++++++-------------------
+ glx/rensize.c          |   27 +++++---
+ 5 files changed, 205 insertions(+), 154 deletions(-)
+
+Index: xorg-server-1.15.1/glx/glxcmds.c
+===================================================================
+--- xorg-server-1.15.1.orig/glx/glxcmds.c	2014-12-04 11:57:06.345650678 -0500
++++ xorg-server-1.15.1/glx/glxcmds.c	2014-12-04 11:57:06.337650627 -0500
+@@ -2057,7 +2057,8 @@
+         if (entry.varsize) {
+             /* variable size command */
+             extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
+-                                      client->swapped);
++                                      client->swapped,
++                                      left - __GLX_RENDER_HDR_SIZE);
+             if (extra < 0) {
+                 return BadLength;
+             }
+@@ -2134,6 +2135,7 @@
+     if (cl->largeCmdRequestsSoFar == 0) {
+         __GLXrenderSizeData entry;
+         int extra = 0;
++        int left = (req->length << 2) - sz_xGLXRenderLargeReq;
+         size_t cmdlen;
+         int err;
+ 
+@@ -2174,7 +2176,8 @@
+              ** will be in the 1st request, so it's okay to do this.
+              */
+             extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE,
+-                                      client->swapped);
++                                      client->swapped,
++                                      left - __GLX_RENDER_LARGE_HDR_SIZE);
+             if (extra < 0) {
+                 return BadLength;
+             }
+Index: xorg-server-1.15.1/glx/glxserver.h
+===================================================================
+--- xorg-server-1.15.1.orig/glx/glxserver.h	2014-12-04 11:57:06.345650678 -0500
++++ xorg-server-1.15.1/glx/glxserver.h	2014-12-04 11:57:06.337650627 -0500
+@@ -179,7 +179,7 @@
+ /*
+  * Tables for computing the size of each rendering command.
+  */
+-typedef int (*gl_proto_size_func) (const GLbyte *, Bool);
++typedef int (*gl_proto_size_func) (const GLbyte *, Bool, int);
+ 
+ typedef struct {
+     int bytes;
+Index: xorg-server-1.15.1/glx/indirect_reqsize.c
+===================================================================
+--- xorg-server-1.15.1.orig/glx/indirect_reqsize.c	2014-12-04 11:57:06.345650678 -0500
++++ xorg-server-1.15.1/glx/indirect_reqsize.c	2014-12-04 11:57:06.337650627 -0500
+@@ -31,24 +31,22 @@
+ #include "indirect_size.h"
+ #include "indirect_reqsize.h"
+ 
+-#define __GLX_PAD(x)  (((x) + 3) & ~3)
+-
+ #if defined(__CYGWIN__) || defined(__MINGW32__)
+ #undef HAVE_ALIAS
+ #endif
+ #ifdef HAVE_ALIAS
+ #define ALIAS2(from,to) \
+-    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
++    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
+         __attribute__ ((alias( # to )));
+ #define ALIAS(from,to) ALIAS2( from, __glX ## to ## ReqSize )
+ #else
+ #define ALIAS(from,to) \
+-    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
+-    { return __glX ## to ## ReqSize( pc, swap ); }
++    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
++    { return __glX ## to ## ReqSize( pc, swap, reqlen ); }
+ #endif
+ 
+ int
+-__glXCallListsReqSize(const GLbyte * pc, Bool swap)
++__glXCallListsReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 0);
+     GLenum type = *(GLenum *) (pc + 4);
+@@ -60,11 +58,11 @@
+     }
+ 
+     compsize = __glCallLists_size(type);
+-    return __GLX_PAD((compsize * n));
++    return safe_pad(safe_mul(compsize, n));
+ }
+ 
+ int
+-__glXBitmapReqSize(const GLbyte * pc, Bool swap)
++__glXBitmapReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -88,7 +86,7 @@
+ }
+ 
+ int
+-__glXFogfvReqSize(const GLbyte * pc, Bool swap)
++__glXFogfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 0);
+     GLsizei compsize;
+@@ -98,11 +96,11 @@
+     }
+ 
+     compsize = __glFogfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXLightfvReqSize(const GLbyte * pc, Bool swap)
++__glXLightfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -112,11 +110,11 @@
+     }
+ 
+     compsize = __glLightfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXLightModelfvReqSize(const GLbyte * pc, Bool swap)
++__glXLightModelfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 0);
+     GLsizei compsize;
+@@ -126,11 +124,11 @@
+     }
+ 
+     compsize = __glLightModelfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXMaterialfvReqSize(const GLbyte * pc, Bool swap)
++__glXMaterialfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -140,11 +138,11 @@
+     }
+ 
+     compsize = __glMaterialfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap)
++__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -164,7 +162,7 @@
+ }
+ 
+ int
+-__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap)
++__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -174,11 +172,11 @@
+     }
+ 
+     compsize = __glTexParameterfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXTexImage1DReqSize(const GLbyte * pc, Bool swap)
++__glXTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -206,7 +204,7 @@
+ }
+ 
+ int
+-__glXTexImage2DReqSize(const GLbyte * pc, Bool swap)
++__glXTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -236,7 +234,7 @@
+ }
+ 
+ int
+-__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap)
++__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -246,11 +244,11 @@
+     }
+ 
+     compsize = __glTexEnvfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXTexGendvReqSize(const GLbyte * pc, Bool swap)
++__glXTexGendvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -260,11 +258,11 @@
+     }
+ 
+     compsize = __glTexGendv_size(pname);
+-    return __GLX_PAD((compsize * 8));
++    return safe_pad(safe_mul(compsize, 8));
+ }
+ 
+ int
+-__glXTexGenfvReqSize(const GLbyte * pc, Bool swap)
++__glXTexGenfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -274,11 +272,11 @@
+     }
+ 
+     compsize = __glTexGenfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap)
++__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei mapsize = *(GLsizei *) (pc + 4);
+ 
+@@ -286,11 +284,11 @@
+         mapsize = bswap_32(mapsize);
+     }
+ 
+-    return __GLX_PAD((mapsize * 4));
++    return safe_pad(safe_mul(mapsize, 4));
+ }
+ 
+ int
+-__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap)
++__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei mapsize = *(GLsizei *) (pc + 4);
+ 
+@@ -298,11 +296,11 @@
+         mapsize = bswap_32(mapsize);
+     }
+ 
+-    return __GLX_PAD((mapsize * 2));
++    return safe_pad(safe_mul(mapsize, 2));
+ }
+ 
+ int
+-__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap)
++__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -330,7 +328,7 @@
+ }
+ 
+ int
+-__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap)
++__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 0);
+ 
+@@ -338,11 +336,11 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 4) + (n * 4));
++    return safe_pad(safe_add(safe_mul(n, 4), safe_mul(n, 4)));
+ }
+ 
+ int
+-__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap)
++__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -370,7 +368,7 @@
+ }
+ 
+ int
+-__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap)
++__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -400,7 +398,7 @@
+ }
+ 
+ int
+-__glXColorTableReqSize(const GLbyte * pc, Bool swap)
++__glXColorTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -428,7 +426,7 @@
+ }
+ 
+ int
+-__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap)
++__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -438,11 +436,11 @@
+     }
+ 
+     compsize = __glColorTableParameterfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXColorSubTableReqSize(const GLbyte * pc, Bool swap)
++__glXColorSubTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -470,7 +468,7 @@
+ }
+ 
+ int
+-__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap)
++__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -498,7 +496,7 @@
+ }
+ 
+ int
+-__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap)
++__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = 0;
+@@ -528,7 +526,7 @@
+ }
+ 
+ int
+-__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap)
++__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 4);
+     GLsizei compsize;
+@@ -538,11 +536,11 @@
+     }
+ 
+     compsize = __glConvolutionParameterfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXTexImage3DReqSize(const GLbyte * pc, Bool swap)
++__glXTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = *(GLint *) (pc + 8);
+@@ -579,7 +577,7 @@
+ }
+ 
+ int
+-__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
++__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLint row_length = *(GLint *) (pc + 4);
+     GLint image_height = *(GLint *) (pc + 8);
+@@ -613,7 +611,7 @@
+ }
+ 
+ int
+-__glXCompressedTexImage1DReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei imageSize = *(GLsizei *) (pc + 20);
+ 
+@@ -621,11 +619,11 @@
+         imageSize = bswap_32(imageSize);
+     }
+ 
+-    return __GLX_PAD(imageSize);
++    return safe_pad(imageSize);
+ }
+ 
+ int
+-__glXCompressedTexImage2DReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei imageSize = *(GLsizei *) (pc + 24);
+ 
+@@ -633,11 +631,11 @@
+         imageSize = bswap_32(imageSize);
+     }
+ 
+-    return __GLX_PAD(imageSize);
++    return safe_pad(imageSize);
+ }
+ 
+ int
+-__glXCompressedTexImage3DReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei imageSize = *(GLsizei *) (pc + 28);
+ 
+@@ -645,11 +643,11 @@
+         imageSize = bswap_32(imageSize);
+     }
+ 
+-    return __GLX_PAD(imageSize);
++    return safe_pad(imageSize);
+ }
+ 
+ int
+-__glXCompressedTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
++__glXCompressedTexSubImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei imageSize = *(GLsizei *) (pc + 36);
+ 
+@@ -657,11 +655,11 @@
+         imageSize = bswap_32(imageSize);
+     }
+ 
+-    return __GLX_PAD(imageSize);
++    return safe_pad(imageSize);
+ }
+ 
+ int
+-__glXPointParameterfvReqSize(const GLbyte * pc, Bool swap)
++__glXPointParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum pname = *(GLenum *) (pc + 0);
+     GLsizei compsize;
+@@ -671,11 +669,11 @@
+     }
+ 
+     compsize = __glPointParameterfv_size(pname);
+-    return __GLX_PAD((compsize * 4));
++    return safe_pad(safe_mul(compsize, 4));
+ }
+ 
+ int
+-__glXDrawBuffersReqSize(const GLbyte * pc, Bool swap)
++__glXDrawBuffersReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 0);
+ 
+@@ -683,11 +681,11 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 4));
++    return safe_pad(safe_mul(n, 4));
+ }
+ 
+ int
+-__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap)
++__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei len = *(GLsizei *) (pc + 8);
+ 
+@@ -695,11 +693,11 @@
+         len = bswap_32(len);
+     }
+ 
+-    return __GLX_PAD(len);
++    return safe_pad(len);
+ }
+ 
+ int
+-__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 4);
+ 
+@@ -707,11 +705,11 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 8));
++    return safe_pad(safe_mul(n, 8));
+ }
+ 
+ int
+-__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 4);
+ 
+@@ -719,11 +717,11 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 16));
++    return safe_pad(safe_mul(n, 16));
+ }
+ 
+ int
+-__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 4);
+ 
+@@ -731,11 +729,11 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 24));
++    return safe_pad(safe_mul(n, 24));
+ }
+ 
+ int
+-__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 4);
+ 
+@@ -743,11 +741,11 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 12));
++    return safe_pad(safe_mul(n, 12));
+ }
+ 
+ int
+-__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 4);
+ 
+@@ -755,11 +753,11 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 6));
++    return safe_pad(safe_mul(n, 6));
+ }
+ 
+ int
+-__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap)
++__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLsizei n = *(GLsizei *) (pc + 4);
+ 
+@@ -767,7 +765,7 @@
+         n = bswap_32(n);
+     }
+ 
+-    return __GLX_PAD((n * 32));
++    return safe_pad(safe_mul(n, 32));
+ }
+ 
+ ALIAS(Fogiv, Fogfv)
+Index: xorg-server-1.15.1/glx/indirect_reqsize.h
+===================================================================
+--- xorg-server-1.15.1.orig/glx/indirect_reqsize.h	2014-12-04 11:57:06.345650678 -0500
++++ xorg-server-1.15.1/glx/indirect_reqsize.h	2014-12-04 11:57:06.337650627 -0500
+@@ -36,115 +36,156 @@
+ #define PURE
+ #endif
+ 
+-extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc,
+-                                                   Bool swap);
+-extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc,
+-                                                   Bool swap);
+-extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap);
++extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap,
++                                                int reqlen);
++extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap,
++                                             int reqlen);
++extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap,
++                                            int reqlen);
++extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap,
++                                            int reqlen);
++extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap,
++                                              int reqlen);
++extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap,
++                                              int reqlen);
++extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc, Bool swap,
++                                                   int reqlen);
++extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc, Bool swap,
++                                                   int reqlen);
++extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
++extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
+ extern PURE _X_HIDDEN int __glXPolygonStippleReqSize(const GLbyte * pc,
+-                                                     Bool swap);
++                                                     Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexParameterfvReqSize(const GLbyte * pc,
+-                                                     Bool swap);
++                                                     Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexParameterivReqSize(const GLbyte * pc,
+-                                                     Bool swap);
+-extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap);
+-extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap);
++                                                     Bool swap, int reqlen);
++extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
++extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
++extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap,
++                                               int reqlen);
++extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap,
++                                               int reqlen);
++extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap,
++                                               int reqlen);
++extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap,
++                                               int reqlen);
++extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap,
++                                               int reqlen);
++extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap,
++                                            int reqlen);
++extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap,
++                                            int reqlen);
++extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap,
++                                            int reqlen);
++extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap,
++                                            int reqlen);
++extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
++extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap,
++                                                  int reqlen);
++extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap,
++                                                  int reqlen);
++extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
++extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
+ extern PURE _X_HIDDEN int __glXPrioritizeTexturesReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexSubImage1DReqSize(const GLbyte * pc,
+-                                                    Bool swap);
++                                                    Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXTexSubImage2DReqSize(const GLbyte * pc,
+-                                                    Bool swap);
+-extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap);
++                                                    Bool swap, int reqlen);
++extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
+ extern PURE _X_HIDDEN int __glXColorTableParameterfvReqSize(const GLbyte * pc,
+-                                                            Bool swap);
++                                                            Bool swap,
++                                                            int reqlen);
+ extern PURE _X_HIDDEN int __glXColorTableParameterivReqSize(const GLbyte * pc,
+-                                                            Bool swap);
++                                                            Bool swap,
++                                                            int reqlen);
+ extern PURE _X_HIDDEN int __glXColorSubTableReqSize(const GLbyte * pc,
+-                                                    Bool swap);
++                                                    Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionFilter1DReqSize(const GLbyte * pc,
+-                                                          Bool swap);
++                                                          Bool swap,
++                                                          int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionFilter2DReqSize(const GLbyte * pc,
+-                                                          Bool swap);
++                                                          Bool swap,
++                                                          int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionParameterfvReqSize(const GLbyte * pc,
+-                                                             Bool swap);
++                                                             Bool swap,
++                                                             int reqlen);
+ extern PURE _X_HIDDEN int __glXConvolutionParameterivReqSize(const GLbyte * pc,
+-                                                             Bool swap);
++                                                             Bool swap,
++                                                             int reqlen);
+ extern PURE _X_HIDDEN int __glXSeparableFilter2DReqSize(const GLbyte * pc,
+-                                                        Bool swap);
+-extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap);
++                                                        Bool swap, int reqlen);
++extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap,
++                                                 int reqlen);
+ extern PURE _X_HIDDEN int __glXTexSubImage3DReqSize(const GLbyte * pc,
+-                                                    Bool swap);
++                                                    Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexImage1DReqSize(const GLbyte * pc,
+-                                                           Bool swap);
++                                                           Bool swap,
++                                                           int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexImage2DReqSize(const GLbyte * pc,
+-                                                           Bool swap);
++                                                           Bool swap,
++                                                           int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexImage3DReqSize(const GLbyte * pc,
+-                                                           Bool swap);
++                                                           Bool swap,
++                                                           int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexSubImage1DReqSize(const GLbyte * pc,
+-                                                              Bool swap);
++                                                              Bool swap,
++                                                              int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexSubImage2DReqSize(const GLbyte * pc,
+-                                                              Bool swap);
++                                                              Bool swap,
++                                                              int reqlen);
+ extern PURE _X_HIDDEN int __glXCompressedTexSubImage3DReqSize(const GLbyte * pc,
+-                                                              Bool swap);
++                                                              Bool swap,
++                                                              int reqlen);
+ extern PURE _X_HIDDEN int __glXPointParameterfvReqSize(const GLbyte * pc,
+-                                                       Bool swap);
++                                                       Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXPointParameterivReqSize(const GLbyte * pc,
+-                                                       Bool swap);
+-extern PURE _X_HIDDEN int __glXDrawBuffersReqSize(const GLbyte * pc, Bool swap);
++                                                       Bool swap, int reqlen);
++extern PURE _X_HIDDEN int __glXDrawBuffersReqSize(const GLbyte * pc, Bool swap,
++                                                  int reqlen);
+ extern PURE _X_HIDDEN int __glXProgramStringARBReqSize(const GLbyte * pc,
+-                                                       Bool swap);
++                                                       Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXDeleteFramebuffersReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXDeleteRenderbuffersReqSize(const GLbyte * pc,
+-                                                          Bool swap);
++                                                          Bool swap,
++                                                          int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs1dvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs1fvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs1svNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs2dvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs2fvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs2svNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs3dvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs3fvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs3svNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4dvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4fvNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4svNVReqSize(const GLbyte * pc,
+-                                                         Bool swap);
++                                                         Bool swap, int reqlen);
+ extern PURE _X_HIDDEN int __glXVertexAttribs4ubvNVReqSize(const GLbyte * pc,
+-                                                          Bool swap);
++                                                          Bool swap,
++                                                          int reqlen);
+ 
+ #undef PURE
+ 
+Index: xorg-server-1.15.1/glx/rensize.c
+===================================================================
+--- xorg-server-1.15.1.orig/glx/rensize.c	2014-12-04 11:57:06.345650678 -0500
++++ xorg-server-1.15.1/glx/rensize.c	2014-12-04 11:57:06.341650652 -0500
+@@ -44,7 +44,7 @@
+    ((a & 0xff00U)<<8) | ((a & 0xffU)<<24))
+ 
+ int
+-__glXMap1dReqSize(const GLbyte * pc, Bool swap)
++__glXMap1dReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum target;
+     GLint order;
+@@ -61,7 +61,7 @@
+ }
+ 
+ int
+-__glXMap1fReqSize(const GLbyte * pc, Bool swap)
++__glXMap1fReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum target;
+     GLint order;
+@@ -86,7 +86,7 @@
+ }
+ 
+ int
+-__glXMap2dReqSize(const GLbyte * pc, Bool swap)
++__glXMap2dReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum target;
+     GLint uorder, vorder;
+@@ -103,7 +103,7 @@
+ }
+ 
+ int
+-__glXMap2fReqSize(const GLbyte * pc, Bool swap)
++__glXMap2fReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     GLenum target;
+     GLint uorder, vorder;
+@@ -359,13 +359,14 @@
+ }
+ 
+ int
+-__glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
++__glXDrawArraysReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     __GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc;
+     __GLXdispatchDrawArraysComponentHeader *compHeader;
+     GLint numVertexes = hdr->numVertexes;
+     GLint numComponents = hdr->numComponents;
+     GLint arrayElementSize = 0;
++    GLint x, size;
+     int i;
+ 
+     if (swap) {
+@@ -374,6 +375,13 @@
+     }
+ 
+     pc += sizeof(__GLXdispatchDrawArraysHeader);
++    reqlen -= sizeof(__GLXdispatchDrawArraysHeader);
++
++    size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader),
++                    numComponents);
++    if (size < 0 || reqlen < 0 || reqlen < size)
++        return -1;
++
+     compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc;
+ 
+     for (i = 0; i < numComponents; i++) {
+@@ -417,17 +425,18 @@
+             return -1;
+         }
+ 
+-        arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype));
++        x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype)));
++        if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0)
++            return -1;
+ 
+         pc += sizeof(__GLXdispatchDrawArraysComponentHeader);
+     }
+ 
+-    return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) +
+-            (numVertexes * arrayElementSize));
++    return safe_add(size, safe_mul(numVertexes, arrayElementSize));
+ }
+ 
+ int
+-__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap)
++__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
+ {
+     __GLXdispatchConvolutionFilterHeader *hdr =
+         (__GLXdispatchConvolutionFilterHeader *) pc;