Apply by doing: cd /usr/src/xenocara # Assuming Xenocara is in /usr/src/xenocara patch -p0 < 006_xorg.patch And then rebuild and install X: make build Index: lib/libXfont/src/bitmap/pcfread.c =================================================================== RCS file: /cvs/xenocara/lib/libXfont/src/bitmap/pcfread.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- lib/libXfont/src/bitmap/pcfread.c 25 Nov 2006 17:14:59 -0000 1.1.1.1 +++ lib/libXfont/src/bitmap/pcfread.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -588,6 +588,9 @@ pcfReadFont(FontPtr pFont, FontFilePtr f pFont->info.lastRow = pcfGetINT16(file, format); pFont->info.defaultCh = pcfGetINT16(file, format); if (IS_EOF(file)) goto Bail; + if (pFont->info.firstCol > pFont->info.lastCol || + pFont->info.firstRow > pFont->info.lastRow || + pFont->info.lastCol-pFont->info.firstCol > 255) goto Bail; nencoding = (pFont->info.lastCol - pFont->info.firstCol + 1) * (pFont->info.lastRow - pFont->info.firstRow + 1); @@ -726,6 +729,9 @@ pcfReadFontInfo(FontInfoPtr pFontInfo, F pFontInfo->lastRow = pcfGetINT16(file, format); pFontInfo->defaultCh = pcfGetINT16(file, format); if (IS_EOF(file)) goto Bail; + if (pFontInfo->firstCol > pFontInfo->lastCol || + pFontInfo->firstRow > pFontInfo->lastRow || + pFontInfo->lastCol-pFontInfo->firstCol > 255) goto Bail; nencoding = (pFontInfo->lastCol - pFontInfo->firstCol + 1) * (pFontInfo->lastRow - pFontInfo->firstRow + 1); Index: xserver/Xext/EVI.c =================================================================== RCS file: /cvs/xenocara/xserver/Xext/EVI.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xext/EVI.c 26 Nov 2006 18:14:48 -0000 1.1.1.1 +++ xserver/Xext/EVI.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. #include #include "EVIstruct.h" #include "modinit.h" +#include "scrnintstr.h" #if 0 static unsigned char XEVIReqCode = 0; @@ -87,10 +88,22 @@ ProcEVIGetVisualInfo(ClientPtr client) { REQUEST(xEVIGetVisualInfoReq); xEVIGetVisualInfoReply rep; - int n, n_conflict, n_info, sz_info, sz_conflict; + int i, n, n_conflict, n_info, sz_info, sz_conflict; VisualID32 *conflict; + unsigned int total_visuals = 0; xExtendedVisualInfo *eviInfo; int status; + + /* + * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume + * here that you don't have more than 2^32 visuals over all your screens; + * this seems like a safe assumption. + */ + for (i = 0; i < screenInfo.numScreens; i++) + total_visuals += screenInfo.screens[i]->numVisuals; + if (stuff->n_visual > total_visuals) + return BadValue; + REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32); status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual, &eviInfo, &n_info, &conflict, &n_conflict); Index: xserver/Xext/cup.c =================================================================== RCS file: /cvs/xenocara/xserver/Xext/cup.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xext/cup.c 26 Nov 2006 18:14:51 -0000 1.1.1.1 +++ xserver/Xext/cup.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -196,6 +196,9 @@ int ProcGetReservedColormapEntries( REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq); + if (stuff->screen >= screenInfo.numScreens) + return BadValue; + #ifndef HAVE_SPECIAL_DESKTOP_COLORS citems[CUP_BLACK_PIXEL].pixel = screenInfo.screens[stuff->screen]->blackPixel; Index: xserver/Xext/sampleEVI.c =================================================================== RCS file: /cvs/xenocara/xserver/Xext/sampleEVI.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xext/sampleEVI.c 26 Nov 2006 18:14:51 -0000 1.1.1.1 +++ xserver/Xext/sampleEVI.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -35,6 +35,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE. #include #include "EVIstruct.h" #include "scrnintstr.h" + +#if HAVE_STDINT_H +#include +#elif !defined(UINT32_MAX) +#define UINT32_MAX 0xffffffffU +#endif + static int sampleGetVisualInfo( VisualID32 *visual, int n_visual, @@ -43,24 +50,36 @@ static int sampleGetVisualInfo( VisualID32 **conflict_rn, int *n_conflict_rn) { - int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; + unsigned int max_sz_evi; VisualID32 *temp_conflict; xExtendedVisualInfo *evi; - int max_visuals = 0, max_sz_conflict, sz_conflict = 0; + unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0; register int visualI, scrI, sz_evi = 0, conflictI, n_conflict; - *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); - if (!*evi_rn) - return BadAlloc; + + if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens)) + return BadAlloc; + max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens; + for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { if (screenInfo.screens[scrI]->numVisuals > max_visuals) max_visuals = screenInfo.screens[scrI]->numVisuals; } + + if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens + * max_visuals)) + return BadAlloc; max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals; + + *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi); + if (!*evi_rn) + return BadAlloc; + temp_conflict = (VisualID32 *)xalloc(max_sz_conflict); if (!temp_conflict) { xfree(*evi_rn); return BadAlloc; } + for (scrI = 0; scrI < screenInfo.numScreens; scrI++) { for (visualI = 0; visualI < n_visual; visualI++) { evi[sz_evi].core_visual_id = visual[visualI]; Index: xserver/Xext/security.c =================================================================== RCS file: /cvs/xenocara/xserver/Xext/security.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xext/security.c 26 Nov 2006 18:14:54 -0000 1.1.1.1 +++ xserver/Xext/security.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -1567,7 +1567,7 @@ SecurityLoadPropertyAccessList(void) return; #ifndef __UNIXOS2__ - f = fopen(SecurityPolicyFile, "r"); + f = Fopen(SecurityPolicyFile, "r"); #else f = fopen((char*)__XOS2RedirRoot(SecurityPolicyFile), "r"); #endif @@ -1653,7 +1653,7 @@ SecurityLoadPropertyAccessList(void) } #endif /* PROPDEBUG */ - fclose(f); + Fclose(f); } /* SecurityLoadPropertyAccessList */ Index: xserver/Xext/shm.c =================================================================== RCS file: /cvs/xenocara/xserver/Xext/shm.c,v retrieving revision 1.3 retrieving revision 1.3.2.3 diff -u -p -r1.3 -r1.3.2.3 --- xserver/Xext/shm.c 31 May 2007 03:37:55 -0000 1.3 +++ xserver/Xext/shm.c 10 Feb 2008 19:55:10 -0000 1.3.2.3 @@ -723,6 +723,8 @@ ProcPanoramiXShmCreatePixmap( int i, j, result; ShmDescPtr shmdesc; REQUEST(xShmCreatePixmapReq); + unsigned int width, height, depth; + unsigned long size; PanoramiXRes *newPix; REQUEST_SIZE_MATCH(xShmCreatePixmapReq); @@ -732,11 +734,18 @@ ProcPanoramiXShmCreatePixmap( LEGAL_NEW_RESOURCE(stuff->pid, client); VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client); VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); - if (!stuff->width || !stuff->height) + + width = stuff->width; + height = stuff->height; + depth = stuff->depth; + if (!width || !height || !depth) { client->errorValue = 0; return BadValue; } + if (width > 32767 || height > 32767) + return BadAlloc; + if (stuff->depth != 1) { pDepth = pDraw->pScreen->allowedDepths; @@ -746,10 +755,18 @@ ProcPanoramiXShmCreatePixmap( client->errorValue = stuff->depth; return BadValue; } + CreatePmap: - VERIFY_SHMSIZE(shmdesc, stuff->offset, - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, - client); + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + } + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes)))) return BadAlloc; @@ -1047,6 +1064,8 @@ ProcShmCreatePixmap(client) register int i; ShmDescPtr shmdesc; REQUEST(xShmCreatePixmapReq); + unsigned int width, height, depth; + unsigned long size; REQUEST_SIZE_MATCH(xShmCreatePixmapReq); client->errorValue = stuff->pid; @@ -1055,11 +1074,18 @@ ProcShmCreatePixmap(client) LEGAL_NEW_RESOURCE(stuff->pid, client); VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client); VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client); - if (!stuff->width || !stuff->height) + + width = stuff->width; + height = stuff->height; + depth = stuff->depth; + if (!width || !height || !depth) { client->errorValue = 0; return BadValue; } + if (width > 32767 || height > 32767) + return BadAlloc; + if (stuff->depth != 1) { pDepth = pDraw->pScreen->allowedDepths; @@ -1069,10 +1095,18 @@ ProcShmCreatePixmap(client) client->errorValue = stuff->depth; return BadValue; } + CreatePmap: - VERIFY_SHMSIZE(shmdesc, stuff->offset, - PixmapBytePad(stuff->width, stuff->depth) * stuff->height, - client); + size = PixmapBytePad(width, depth) * height; + if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) { + if (size < width * height) + return BadAlloc; + } + /* thankfully, offset is unsigned */ + if (stuff->offset + size < size) + return BadAlloc; + + VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client); pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)( pDraw->pScreen, stuff->width, stuff->height, stuff->depth, Index: xserver/Xi/chgfctl.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/chgfctl.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/chgfctl.c 26 Nov 2006 18:15:29 -0000 1.1.1.1 +++ xserver/Xi/chgfctl.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -451,18 +451,13 @@ ChangeStringFeedback(ClientPtr client, D xStringFeedbackCtl * f) { register char n; - register long *p; int i, j; KeySym *syms, *sup_syms; syms = (KeySym *) (f + 1); if (client->swapped) { swaps(&f->length, n); /* swapped num_keysyms in calling proc */ - p = (long *)(syms); - for (i = 0; i < f->num_keysyms; i++) { - swapl(p, n); - p++; - } + SwapLongs((CARD32 *) syms, f->num_keysyms); } if (f->num_keysyms > s->ctrl.max_symbols) { Index: xserver/Xi/chgkmap.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/chgkmap.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/chgkmap.c 26 Nov 2006 18:15:31 -0000 1.1.1.1 +++ xserver/Xi/chgkmap.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -79,18 +79,14 @@ int SProcXChangeDeviceKeyMapping(register ClientPtr client) { register char n; - register long *p; - register int i, count; + unsigned int count; REQUEST(xChangeDeviceKeyMappingReq); swaps(&stuff->length, n); REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); - p = (long *)&stuff[1]; count = stuff->keyCodes * stuff->keySymsPerKeyCode; - for (i = 0; i < count; i++) { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), count); return (ProcXChangeDeviceKeyMapping(client)); } @@ -106,9 +102,13 @@ ProcXChangeDeviceKeyMapping(register Cli int ret; unsigned len; DeviceIntPtr dev; + unsigned int count; REQUEST(xChangeDeviceKeyMappingReq); REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq); + + count = stuff->keyCodes * stuff->keySymsPerKeyCode; + REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32)); dev = LookupDeviceIntRec(stuff->deviceid); if (dev == NULL) { Index: xserver/Xi/chgprop.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/chgprop.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/chgprop.c 26 Nov 2006 18:15:30 -0000 1.1.1.1 +++ xserver/Xi/chgprop.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -81,19 +81,15 @@ int SProcXChangeDeviceDontPropagateList(register ClientPtr client) { register char n; - register long *p; - register int i; REQUEST(xChangeDeviceDontPropagateListReq); swaps(&stuff->length, n); REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq); swapl(&stuff->window, n); swaps(&stuff->count, n); - p = (long *)&stuff[1]; - for (i = 0; i < stuff->count; i++) { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq, + stuff->count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->count); return (ProcXChangeDeviceDontPropagateList(client)); } Index: xserver/Xi/grabdev.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/grabdev.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/grabdev.c 26 Nov 2006 18:15:34 -0000 1.1.1.1 +++ xserver/Xi/grabdev.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -82,8 +82,6 @@ int SProcXGrabDevice(register ClientPtr client) { register char n; - register long *p; - register int i; REQUEST(xGrabDeviceReq); swaps(&stuff->length, n); @@ -91,11 +89,11 @@ SProcXGrabDevice(register ClientPtr clie swapl(&stuff->grabWindow, n); swapl(&stuff->time, n); swaps(&stuff->event_count, n); - p = (long *)&stuff[1]; - for (i = 0; i < stuff->event_count; i++) { - swapl(p, n); - p++; - } + + if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count) + return BadLength; + + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); return (ProcXGrabDevice(client)); } Index: xserver/Xi/grabdevb.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/grabdevb.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/grabdevb.c 26 Nov 2006 18:15:34 -0000 1.1.1.1 +++ xserver/Xi/grabdevb.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -80,8 +80,6 @@ int SProcXGrabDeviceButton(register ClientPtr client) { register char n; - register long *p; - register int i; REQUEST(xGrabDeviceButtonReq); swaps(&stuff->length, n); @@ -89,11 +87,9 @@ SProcXGrabDeviceButton(register ClientPt swapl(&stuff->grabWindow, n); swaps(&stuff->modifiers, n); swaps(&stuff->event_count, n); - p = (long *)&stuff[1]; - for (i = 0; i < stuff->event_count; i++) { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xGrabDeviceButtonReq, + stuff->event_count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); return (ProcXGrabDeviceButton(client)); } Index: xserver/Xi/grabdevk.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/grabdevk.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/grabdevk.c 26 Nov 2006 18:15:31 -0000 1.1.1.1 +++ xserver/Xi/grabdevk.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -80,8 +80,6 @@ int SProcXGrabDeviceKey(register ClientPtr client) { register char n; - register long *p; - register int i; REQUEST(xGrabDeviceKeyReq); swaps(&stuff->length, n); @@ -89,11 +87,8 @@ SProcXGrabDeviceKey(register ClientPtr c swapl(&stuff->grabWindow, n); swaps(&stuff->modifiers, n); swaps(&stuff->event_count, n); - p = (long *)&stuff[1]; - for (i = 0; i < stuff->event_count; i++) { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count); return (ProcXGrabDeviceKey(client)); } Index: xserver/Xi/selectev.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/selectev.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/selectev.c 26 Nov 2006 18:15:30 -0000 1.1.1.1 +++ xserver/Xi/selectev.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -84,19 +84,16 @@ int SProcXSelectExtensionEvent(register ClientPtr client) { register char n; - register long *p; - register int i; REQUEST(xSelectExtensionEventReq); swaps(&stuff->length, n); REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq); swapl(&stuff->window, n); swaps(&stuff->count, n); - p = (long *)&stuff[1]; - for (i = 0; i < stuff->count; i++) { - swapl(p, n); - p++; - } + REQUEST_FIXED_SIZE(xSelectExtensionEventReq, + stuff->count * sizeof(CARD32)); + SwapLongs((CARD32 *) (&stuff[1]), stuff->count); + return (ProcXSelectExtensionEvent(client)); } Index: xserver/Xi/sendexev.c =================================================================== RCS file: /cvs/xenocara/xserver/Xi/sendexev.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/Xi/sendexev.c 26 Nov 2006 18:15:31 -0000 1.1.1.1 +++ xserver/Xi/sendexev.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -83,7 +83,7 @@ int SProcXSendExtensionEvent(register ClientPtr client) { register char n; - register long *p; + CARD32 *p; register int i; xEvent eventT; xEvent *eventP; @@ -94,6 +94,11 @@ SProcXSendExtensionEvent(register Client REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq); swapl(&stuff->destination, n); swaps(&stuff->count, n); + + if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count + + (stuff->num_events * (sizeof(xEvent) >> 2))) + return BadLength; + eventP = (xEvent *) & stuff[1]; for (i = 0; i < stuff->num_events; i++, eventP++) { proc = EventSwapVector[eventP->u.u.type & 0177]; @@ -103,11 +108,8 @@ SProcXSendExtensionEvent(register Client *eventP = eventT; } - p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events); - for (i = 0; i < stuff->count; i++) { - swapl(p, n); - p++; - } + p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events); + SwapLongs(p, stuff->count); return (ProcXSendExtensionEvent(client)); } Index: xserver/dix/dixfonts.c =================================================================== RCS file: /cvs/xenocara/xserver/dix/dixfonts.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/dix/dixfonts.c 26 Nov 2006 18:14:19 -0000 1.1.1.1 +++ xserver/dix/dixfonts.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -329,6 +329,13 @@ doOpenFont(ClientPtr client, OFclosurePt err = BadFontName; goto bail; } + /* check values for firstCol, lastCol, firstRow, and lastRow */ + if (pfont->info.firstCol > pfont->info.lastCol || + pfont->info.firstRow > pfont->info.lastRow || + pfont->info.lastCol - pfont->info.firstCol > 255) { + err = AllocError; + goto bail; + } if (!pfont->fpe) pfont->fpe = fpe; pfont->refcnt++; Index: xserver/hw/xfree86/common/xf86MiscExt.c =================================================================== RCS file: /cvs/xenocara/xserver/hw/xfree86/common/xf86MiscExt.c,v retrieving revision 1.1.1.1 retrieving revision 1.1.1.1.2.1 diff -u -p -r1.1.1.1 -r1.1.1.1.2.1 --- xserver/hw/xfree86/common/xf86MiscExt.c 26 Nov 2006 18:20:59 -0000 1.1.1.1 +++ xserver/hw/xfree86/common/xf86MiscExt.c 29 Jan 2008 06:02:07 -0000 1.1.1.1.2.1 @@ -640,6 +640,10 @@ MiscExtPassMessage(int scrnIndex, const DEBUG_P("MiscExtPassMessage"); + /* should check this in the protocol, but xf86NumScreens isn't exported */ + if (scrnIndex >= xf86NumScreens) + return BadValue; + if (*pScr->HandleMessage == NULL) return BadImplementation; return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);