qbit/xenocara
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update to libX11 1.5.99.902 aka 1.6rc2

Browse Source
This commit is contained in:
matthieu 2013-05-31 21:17:09 +00:00
parent 1254571aea
commit 9573aeb427
52 changed files with 811 additions and 175 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

622
lib/libX11/ChangeLog
View File

@ -1,3 +1,625 @@
commit 95a388158c9d73df7d24016d6a3d61506d7d53a4
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu May 23 19:43:35 2013 -0700
libX11 1.5.99.902 (1.6 RC2)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit a3bdd2b090915fe0163b062f0e6576fe05dd332e
Author: Julien Cristau <jcristau@debian.org>
Date: Thu May 23 20:39:46 2013 +0200
xkb: fix off-by-one in _XkbReadGetNamesReply and _XkbReadVirtualModMap
The size of the arrays is max_key_code + 1. This makes these functions
consistent with the other checks added for CVE-2013-1997.
Also check the XkbGetNames reply when names->keys was just allocated.
Signed-off-by: Julien Cristau <jcristau@debian.org>
Tested-by: Colin Walters <walters@verbum.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 7e30056e78e4b7979ff47f102e00327617266019
Author: Niveditha Rau <Niveditha.Rau@Oracle.COM>
Date: Fri May 17 15:26:21 2013 -0700
Make sure internal headers include required headers
Fixes builds with Solaris Studio 12.3 when lint is enabled, since it no
longer ignores *.h files, but complains when they reference undefined
typedefs or macros.
Signed-off-by: Niveditha Rau <Niveditha.Rau@Oracle.COM>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 2820100bf8ba130b94253f415e7fa5ac28bb2037
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu May 16 23:05:36 2013 -0700
Free fs->properties in _XF86BigfontQueryFont overflow error path
Fixes small memory leak introduced in commit 5669a22081
Reported-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 3131740513133a9ff7cb12123d29ceb18584fc38
Author: Matthieu Herrb <matthieu.herrb@laas.fr>
Date: Wed May 8 19:33:09 2013 +0200
XListFontsWithInfo: Re-decrement flist[0] before calling free() on it.
Freeing a pointer that wasn't returned by malloc() is undefined
behavior and produces an error with OpenBSD's implementation.
Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 3fe4bea086149f06a142a8f1d575f627ec1e22c7
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Apr 19 14:30:40 2013 -0700
Give GNU & Solaris Studio compilers hints about XEatData branches
Try to offset the cost of all the recent checks we've added by giving
the compiler a hint that the branches that involve us eating data
are less likely to be used than the ones that process it.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit e1b457beb8d4e831ef44279dada6c475cb955738
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun Mar 31 12:22:35 2013 -0700
_XkbReadGetMapReply: reject maxKeyCodes smaller than the minKeyCode
Various other bounds checks in the code assume this is true, so
enforce it when we first get the data from the X server.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 12ad4c6432496897ff000eb7cfecd0fb4b290331
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 16 10:03:13 2013 -0700
Use calloc in XOpenDisplay to initialize structs containing pointers
Prevents trying to free uninitialized pointers if we have to bail out
partway through setup, such as if we receive a corrupted or incomplete
connection setup block from the server.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit d38527e25f8b6e2f1174ecc21260c5c5416f972e
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu Mar 7 23:46:05 2013 -0800
Remove more unnecessary casts from Xmalloc/calloc calls
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit b2c86b582c58f50c7b14da01cf7ebd20ef12a6b2
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 16:56:16 2013 -0800
Convert more _XEatData callers to _XEatDataWords
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 192bbb9e2fc45df4e17b35b6d14ea0eb418dbd39
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 9 11:04:37 2013 -0800
Make XGetWindowProperty() always initialize returned values
Avoids memory corruption and other errors when callers access them
without checking to see if XGetWindowProperty() returned an error value.
Callers are still required to check for errors, this just reduces the
damage when they don't.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit db1b1c871da29aa0545182bf888df81627f165a5
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 15:08:21 2013 -0800
Avoid overflows in XListExtensions() [CVE-2013-1997 15/15]
Ensure that when breaking the returned list into individual strings,
we don't walk past the end of allocated memory to write the '\0' bytes
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 8d5936594993921acdfec778dd8f41b555e2543a
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 15:08:21 2013 -0800
Avoid overflows in XGetFontPath() [CVE-2013-1997 14/15]
Ensure that when breaking the returned list into individual strings,
we don't walk past the end of allocated memory to write the '\0' bytes
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 0c404db6a92dc2c198328bf586c02d8abbe02013
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 15:08:21 2013 -0800
Avoid overflows in XListFonts() [CVE-2013-1997 13/15]
Ensure that when breaking the returned list into individual strings,
we don't walk past the end of allocated memory to write the '\0' bytes
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 0b0f5d4358c3de7563d6af03f0d2ce454702a06a
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 15:08:21 2013 -0800
integer overflow in XGetModifierMapping() [CVE-2013-1981 13/13]
Ensure that we don't underallocate when the server claims a very large reply
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit a351b8103b2ba78882e1c309e85893ca3abe2073
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 15:08:21 2013 -0800
integer overflow in XGetPointerMapping() & XGetKeyboardMapping() [CVE-2013-1981 12/13]
Ensure that we don't underallocate when the server claims a very large reply
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 833f6b70bc789d33607f6dbfee9e0a4178ec4b59
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 15:08:21 2013 -0800
integer overflow in XGetImage() [CVE-2013-1981 11/13]
Ensure that we don't underallocate when the server claims to have sent a
very large reply.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 79d8dc08eb98842173ce239b9dd60df0e9e9ae72
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 8 22:25:35 2013 -0800
integer overflow in XGetWindowProperty() [CVE-2013-1981 10/13]
If the reported number of properties is too large, the calculations
to allocate memory for them may overflow, leaving us returning less
memory to the caller than implied by the value written to *nitems.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 164bf4dfe839b1cc75cdeee378a243d04a8200e4
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 13:18:48 2013 -0800
integer overflows in TransFileName() [CVE-2013-1981 9/13]
When trying to process file paths the tokens %H, %L, & %S are expanded
to $HOME, the standard compose file path & the xlocaledir path.
If enough of these tokens are repeated and values like $HOME are set to
very large values, the calculation of the total string size required to
hold the expanded path can overflow, resulting in allocating a smaller
string than the amount of data we'll write to it.
Simply restrict all of these values, and the total path size to PATH_MAX,
because really, that's all you should need for a filename path.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 460e8a223b87d4fa0ea1e97823e998a770e0f2a2
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 18:37:37 2013 -0800
integer truncation in _XimParseStringFile() [CVE-2013-1981 8/13]
Called from _XimCreateDefaultTree() which uses getenv("XCOMPOSEFILE")
to specify filename.
If the size of off_t is larger than the size of unsigned long (as in
32-bit builds with large file flags), a file larger than 4 gigs could
have its size truncated, leading to data from that file being written
past the end of the undersized buffer allocated for it.
While configure.ac does not use AC_SYS_LARGEFILE to set large file mode,
builders may have added the large file compilation flags to CFLAGS on
their own.
size is left limited to an int, because if your Xim file is
larger than 2gb, you're doing it wrong.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 226622349a4b1e16064649d4444a34fb4be4f464
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 12:39:58 2013 -0800
Unbounded recursion in _XimParseStringFile() when parsing include files [CVE-2013-2004 2/2]
parseline() can call _XimParseStringFile() which can call parseline()
which can call _XimParseStringFile() which can call parseline() ....
eventually causing recursive stack overflow and crash.
Limit is set to a include depth of 100 files, which should be enough
for all known use cases, but could be adjusted later if necessary.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 236b603d235dc264d1c6250dca09c745458a9088
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 12:01:39 2013 -0800
Unbounded recursion in GetDatabase() when parsing include files [CVE-2013-2004 1/2]
GetIncludeFile() can call GetDatabase() which can call GetIncludeFile()
which can call GetDatabase() which can call GetIncludeFile() ....
eventually causing recursive stack overflow and crash.
Easily reproduced with a resource file that #includes itself.
Limit is set to a include depth of 100 files, which should be enough
for all known use cases, but could be adjusted later if necessary.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 076428918e6c35f66b9b55c3fa097ff06496d155
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 18:37:37 2013 -0800
integer overflow in ReadInFile() in Xrm.c [CVE-2013-1981 7/13]
Called from XrmGetFileDatabase() which gets called from InitDefaults()
which gets the filename from getenv ("XENVIRONMENT")
If file is exactly 0xffffffff bytes long (or longer and truncates to
0xffffffff, on implementations where off_t is larger than an int),
then size may be set to a value which overflows causing less memory
to be allocated than is written to by the following read() call.
size is left limited to an int, because if your Xresources file is
larger than 2gb, you're very definitely doing it wrong.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 90fd5abac2faca86f9f100353a3c9c7b89f31484
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 11:44:19 2013 -0800
Integer overflows in stringSectionSize() cause buffer overflow in ReadColornameDB() [CVE-2013-1981 6/13]
LoadColornameDB() calls stringSectionSize() to do a first pass over the
file (which may be provided by the user via XCMSDB environment variable)
to determine how much memory needs to be allocated to read in the file,
then allocates the returned sizes and calls ReadColornameDB() to load the
data from the file into that newly allocated memory.
If stringSectionSize() overflows the signed ints used to calculate the
file size (say if you have an xcmsdb with ~4 billion lines in or a
combined string length of ~4 gig - which while it may have been
inconceivable when Xlib was written, is quite possible today), then
LoadColornameDB() may allocate a memory buffer much smaller than the
amount of data ReadColornameDB() will write to it.
The total size is left limited to an int, because if your xcmsdb file
is larger than 2gb, you're doing it wrong.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit b9ba832401734e1cbd30a930c0d11d850293f3f9
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 11:25:25 2013 -0800
unvalidated length in _XimXGetReadData() [CVE-2013-1997 12/15]
Check the provided buffer size against the amount of data we're going to
write into it, not against the reported length from the ClientMessage.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit de2e6c322c4aca22856b380f67f8e488e7510015
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 11:11:08 2013 -0800
unvalidated index/length in _XkbReadGetNamesReply() [CVE-2013-1997 11/15]
If the X server returns key name indexes outside the range of the number
of keys it told us to allocate, out of bounds memory writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 2df882eeb3a70256170127a746a9ba26376599a1
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 11:01:04 2013 -0800
unvalidated index in _XkbReadVirtualModMap() [CVE-2013-1997 10/15]
If the X server returns modifier map indexes outside the range of the number
of keys it told us to allocate, out of bounds memory writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 4d7c422a37eb9617fb22f8e37527c2b34b105665
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 11:04:44 2013 -0800
unvalidated index in _XkbReadExplicitComponents() [CVE-2013-1997 9/15]
If the X server returns key indexes outside the range of the number of
keys it told us to allocate, out of bounds memory writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit e56a2ada719c5cfac5ed61a52a80ade86c0f5957
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 10:51:51 2013 -0800
unvalidated index in _XkbReadModifierMap() [CVE-2013-1997 8/15]
If the X server returns modifier map indexes outside the range of the number
of keys it told us to allocate, out of bounds memory writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 06c086e8a1d8374ea9a95ff989f053c96bb1bdca
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 10:39:21 2013 -0800
unvalidated index in _XkbReadKeyBehaviors() [CVE-2013-1997 7/15]
If the X server returns key behavior indexes outside the range of the number
of keys it told us to allocate, out of bounds memory writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 00626c3830b869259098985afa38933d77ccec72
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 09:40:22 2013 -0800
unvalidated index in _XkbReadKeyActions() [CVE-2013-1997 6/15]
If the X server returns key action indexes outside the range of the number
of keys it told us to allocate, out of bounds memory access could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit fd7d4956bc7a1c4b5c38661b12777ebee4d685d9
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 09:28:33 2013 -0800
unvalidated index in _XkbReadKeySyms() [CVE-2013-1997 5/15]
If the X server returns keymap indexes outside the range of the number of
keys it told us to allocate, out of bounds memory access could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 59ae16a00d18588e98af57d26e442af8ea42b7aa
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 09:18:26 2013 -0800
unvalidated indexes in _XkbReadGetGeometryReply() [CVE-2013-1997 4/15]
If the X server returns color indexes outside the range of the number of
colors it told us to allocate, out of bounds memory access could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit bff938b9fe1629cbacb726509edfa2a3840b7207
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 09:12:47 2013 -0800
unvalidated indexes in _XkbReadGeomShapes() [CVE-2013-1997 3/15]
If the X server returns shape indexes outside the range of the number
of shapes it told us to allocate, out of bounds memory access could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit f293659d5a4024bda386305bb7ebeb4647c40934
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 22:49:01 2013 -0800
unvalidated index in _XkbReadGetDeviceInfoReply() [CVE-2013-1997 2/15]
If the X server returns more buttons than are allocated in the XKB
device info structures, out of bounds writes could occur.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit cddc4e7e3cb4b9b7ad25f8591971a86901c249f2
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 19:30:09 2013 -0800
unvalidated lengths in XAllocColorCells() [CVE-2013-1997 1/15]
If a broken server returned larger than requested values for nPixels or
nMasks, XAllocColorCells would happily overflow the buffers provided by
the caller to write the results into.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 2cd62b5eb99ffbb2fce99f3c459455e630b35bf7
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 22:49:01 2013 -0800
integer overflow in XListHosts() [CVE-2013-1981 5/13]
If the reported number of host entries is too large, the calculations
to allocate memory for them may overflow, leaving us writing beyond the
bounds of the allocation.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit 1f6a3dbf699b85c0ea715ef21de7e7095a714e12
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 22:49:01 2013 -0800
integer overflow in XGetMotionEvents() [CVE-2013-1981 4/13]
If the reported number of motion events is too large, the calculations
to allocate memory for them may overflow, leaving us writing beyond the
bounds of the allocation.
v2: Ensure nEvents is set to 0 when returning NULL events pointer
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 39515b7c3ba8cae9021bf6695e378ae19487082f
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 22:49:01 2013 -0800
integer overflow in XListFontsWithInfo() [CVE-2013-1981 3/13]
If the reported number of remaining fonts is too large, the calculations
to allocate memory for them may overflow, leaving us writing beyond the
bounds of the allocation.
v2: Fix reply_left calculations, check calculated sizes fit in reply_left
v3: On error cases, also set values to be returned in pointer args to 0/NULL
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 5669a220816b7d58fcaf0c302ead16fbe5c87817
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 21:05:27 2013 -0800
integer overflow in _XF86BigfontQueryFont() [CVE-2013-1981 2/13]
Similar to _XQueryFont, but with more ways to go wrong and overflow.
Only compiled if libX11 is built with XF86BigFont support.
v2: Fix reply_left calculations, check calculated sizes fit in reply_left
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 6df8a63d34b7514077188e2062a13774f920c085
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 21:05:27 2013 -0800
integer overflow in _XQueryFont() on 32-bit platforms [CVE-2013-1981 1/13]
If the CARD32 reply.nCharInfos * sizeof(XCharStruct) overflows an
unsigned long, then too small of a buffer will be allocated for the
data copied in from the reply.
v2: Fix reply_left calculations, check calculated sizes fit in reply_left
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 9f5d83706543696fc944c1835a403938c06f2cc5
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 1 20:54:24 2013 -0800
Add _XEatDataWords to discard a given number of 32-bit words of reply data
Matches the units of the length field in X protocol replies, and provides
a single implementation of overflow checking to avoid having to replicate
those checks in every caller.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit d7f04c340ade3834e603c23d543132e1ee4e0c63
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 2 13:03:55 2013 -0800
Move repeated #ifdef magic to find PATH_MAX into a common header
Lets stop duplicating the mess all over
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
commit f3a553a4e4a55d9d19deda1ea01883e1d5d682b1
Author: Pander <pander@users.sourceforge.net>
Date: Tue May 7 18:38:14 2013 -0400
Add compose sequences for J́ and j́.
The resulting sequences are:
U+004A LATIN CAPITAL LETTER J U+0301 COMBINING ACUTE ACCENT
U+006A LATIN SMALL LETTER J U+0301 COMBINING ACUTE ACCENT
Used in Dutch, per:
http://lists.x.org/archives/xorg-devel/2013-February/035514.html
https://nl.wikipedia.org/wiki/Accenttekens_in_de_Nederlandse_spelling
Signed-off-by: Pander <pander@users.sourceforge.net>
Signed-off-by: James Cloos <cloos@jhcloos.com>
commit f49bb2dd6d4ea45c55bd21acc0efe2b764441020
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 16 18:30:56 2013 -0700
Move big request comment in XOpenDisplay to the right place
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
commit 3996543c1b2919e97d61a5d70fe1ebd7cd76fc83
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat Mar 9 19:16:03 2013 -0800

20
lib/libX11/configure vendored
View File

@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for libX11 1.5.99.901.
# Generated by GNU Autoconf 2.69 for libX11 1.5.99.902.
#
# Report bugs to <https://bugs.freedesktop.org/enter_bug.cgi?product=xorg>.
#
@ -651,8 +651,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='libX11'
PACKAGE_TARNAME='libX11'
PACKAGE_VERSION='1.5.99.901'
PACKAGE_STRING='libX11 1.5.99.901'
PACKAGE_VERSION='1.5.99.902'
PACKAGE_STRING='libX11 1.5.99.902'
PACKAGE_BUGREPORT='https://bugs.freedesktop.org/enter_bug.cgi?product=xorg'
PACKAGE_URL=''
@ -1505,7 +1505,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures libX11 1.5.99.901 to adapt to many kinds of systems.
\`configure' configures libX11 1.5.99.902 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@ -1575,7 +1575,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of libX11 1.5.99.901:";;
short | recursive ) echo "Configuration of libX11 1.5.99.902:";;
esac
cat <<\_ACEOF
@ -1738,7 +1738,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
libX11 configure 1.5.99.901
libX11 configure 1.5.99.902
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
@ -2264,7 +2264,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by libX11 $as_me 1.5.99.901, which was
It was created by libX11 $as_me 1.5.99.902, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
@ -4482,7 +4482,7 @@ fi
# Define the identity of the package.
PACKAGE='libX11'
VERSION='1.5.99.901'
VERSION='1.5.99.902'
cat >>confdefs.h <<_ACEOF
@ -21429,7 +21429,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by libX11 $as_me 1.5.99.901, which was
This file was extended by libX11 $as_me 1.5.99.902, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@ -21495,7 +21495,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
libX11 config.status 1.5.99.901
libX11 config.status 1.5.99.902
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"

2
lib/libX11/configure.ac
View File

@ -1,7 +1,7 @@
# Initialize Autoconf
AC_PREREQ([2.60])
AC_INIT([libX11], [1.5.99.901],
AC_INIT([libX11], [1.5.99.902],
[https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libX11])
AC_CONFIG_SRCDIR([Makefile.am])
AC_CONFIG_HEADERS([src/config.h include/X11/XlibConf.h])

16
lib/libX11/include/X11/Xlibint.h
View File

@ -832,6 +832,15 @@ typedef struct _XExten { /* private to extension mechanism */
struct _XExten *next_flush; /* next in list of those with flushes */
} _XExtension;
/* Temporary definition until we can depend on an xproto release with it */
#ifdef _X_COLD
# define _XLIB_COLD _X_COLD
#elif defined(__GNUC__) && ((__GNUC__ * 100 + __GNUC_MINOR__) >= 403) /* 4.3+ */
# define _XLIB_COLD __attribute__((__cold__))
#else
# define _XLIB_COLD /* nothing */
#endif
/* extension hooks */
#ifdef DataRoutineIsProcedure
@ -854,11 +863,14 @@ extern int (*_XErrorFunction)(
extern void _XEatData(
Display* /* dpy */,
unsigned long /* n */
);
) _XLIB_COLD;
extern void _XEatDataWords(
Display* /* dpy */,
unsigned long /* n */
);
) _XLIB_COLD;
#if defined(__SUNPRO_C) /* Studio compiler alternative to "cold" attribute */
# pragma rarely_called(_XEatData, _XEatDataWords)
#endif
extern char *_XAllocScratch(
Display* /* dpy */,
unsigned long /* nbytes */

2
lib/libX11/nls/en_US.UTF-8/Compose.pre
View File

@ -618,6 +618,7 @@ XCOMM Part 3
<Multi_key> <I> <quotedbl> : "Ï" Idiaeresis # LATIN CAPITAL LETTER I WITH DIAERESIS
<Multi_key> <diaeresis> <I> : "Ï" Idiaeresis # LATIN CAPITAL LETTER I WITH DIAERESIS
<Multi_key> <I> <diaeresis> : "Ï" Idiaeresis # LATIN CAPITAL LETTER I WITH DIAERESIS
<Multi_key> <J> <acute> : "J́" # LATIN CAPITAL LETTER J U004A with COMBINING ACUTE ACCENT U0301
<Multi_key> <D> <H> : "Ð" ETH # LATIN CAPITAL LETTER ETH
<dead_tilde> <N> : "Ñ" Ntilde # LATIN CAPITAL LETTER N WITH TILDE
<Multi_key> <asciitilde> <N> : "Ñ" Ntilde # LATIN CAPITAL LETTER N WITH TILDE
@ -738,6 +739,7 @@ XCOMM Part 3
<Multi_key> <i> <quotedbl> : "ï" idiaeresis # LATIN SMALL LETTER I WITH DIAERESIS
<Multi_key> <diaeresis> <i> : "ï" idiaeresis # LATIN SMALL LETTER I WITH DIAERESIS
<Multi_key> <i> <diaeresis> : "ï" idiaeresis # LATIN SMALL LETTER I WITH DIAERESIS
<Multi_key> <j> <acute> : "j́" # LATIN SMALL LETTER J U006A with COMBINING ACUTE ACCENT U0301
<Multi_key> <d> <h> : "ð" eth # LATIN SMALL LETTER ETH
<dead_tilde> <n> : "ñ" ntilde # LATIN SMALL LETTER N WITH TILDE
<Multi_key> <asciitilde> <n> : "ñ" ntilde # LATIN SMALL LETTER N WITH TILDE

2
lib/libX11/src/Cmap.h
View File

@ -2,6 +2,8 @@
#ifndef _CMAP_H_
#define _CMAP_H_
#include <X11/Xlib.h>
extern void
_XcmsDeleteCmapRec(
Display *dpy,

8
lib/libX11/src/Context.c
View File

@ -111,7 +111,7 @@ static void ResizeTable(DB db)
otable = db->table;
for (i = INITHASHMASK+1; (i + i) < db->numentries; )
i += i;
db->table = (TableEntry *) Xcalloc((unsigned)i, sizeof(TableEntry));
db->table = Xcalloc(i, sizeof(TableEntry));
if (!db->table) {
db->table = otable;
return;
@ -180,11 +180,11 @@ int XSaveContext(
UnlockDisplay(display);
}
if (!db) {
db = (DB) Xmalloc(sizeof(DBRec));
db = Xmalloc(sizeof(DBRec));
if (!db)
return XCNOMEM;
db->mask = INITHASHMASK;
db->table = (TableEntry *)Xcalloc(db->mask + 1, sizeof(TableEntry));
db->table = Xcalloc(db->mask + 1, sizeof(TableEntry));
if (!db->table) {
Xfree((char *)db);
return XCNOMEM;
@ -210,7 +210,7 @@ int XSaveContext(
return 0;
}
}
entry = (TableEntry) Xmalloc(sizeof(TableEntryRec));
entry = Xmalloc(sizeof(TableEntryRec));
if (!entry)
return XCNOMEM;
entry->rid = rid;

2
lib/libX11/src/Cr.h
View File

@ -2,6 +2,8 @@
#ifndef _CR_H_
#define _CR_H_
#include <X11/Xlib.h>
extern int _XUpdateGCCache(
register GC gc,
register unsigned long mask,

2
lib/libX11/src/CrGC.c
View File

@ -72,7 +72,7 @@ GC XCreateGC (
register _XExtension *ext;
LockDisplay(dpy);
if ((gc = (GC)Xmalloc (sizeof(struct _XGC))) == NULL) {
if ((gc = Xmalloc (sizeof(struct _XGC))) == NULL) {
UnlockDisplay(dpy);
SyncHandle();
return (NULL);

2
lib/libX11/src/Depths.c
View File

@ -49,7 +49,7 @@ int *XListDepths (
register Depth *dp;
register int i;
depths = (int *) Xmalloc (count * sizeof(int));
depths = Xmalloc (count * sizeof(int));
if (!depths) return NULL;
for (i = 0, dp = scr->depths; i < count; i++, dp++)
depths[i] = dp->depth;

6
lib/libX11/src/FSWrap.c
View File

@ -112,7 +112,7 @@ _XParseBaseFontNameList(
if (!*ptr)
break;
}
if (!(list = (char **) Xmalloc((unsigned)sizeof(char *) * (*num + 1)))) {
if (!(list = Xmalloc(sizeof(char *) * (*num + 1)))) {
Xfree(psave);
return (char **)NULL;
}
@ -133,7 +133,7 @@ copy_string_list(
if (string_list == NULL || list_count <= 0)
return (char **) NULL;
string_list_ret = (char **) Xmalloc(sizeof(char *) * list_count);
string_list_ret = Xmalloc(sizeof(char *) * list_count);
if (string_list_ret == NULL)
return (char **) NULL;
@ -142,7 +142,7 @@ copy_string_list(
for (length = 0; count-- > 0; list_src++)
length += strlen(*list_src) + 1;
dst = (char *) Xmalloc(length);
dst = Xmalloc(length);
if (dst == NULL) {
Xfree(string_list_ret);
return (char **) NULL;

12
lib/libX11/src/Font.c
View File

@ -215,7 +215,7 @@ _XQueryFont (
DeqAsyncHandler(dpy, &async);
reply_left = reply.length -
((SIZEOF(xQueryFontReply) - SIZEOF(xReply)) >> 2);
if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) {
if (! (fs = Xmalloc (sizeof (XFontStruct)))) {
_XEatDataWords(dpy, reply_left);
return (XFontStruct *)NULL;
}
@ -323,7 +323,7 @@ _XF86BigfontCodes (
if (pData)
return (XF86BigfontCodes *) pData->private_data;
pData = (XExtData *) Xmalloc(sizeof(XExtData) + sizeof(XF86BigfontCodes));
pData = Xmalloc(sizeof(XExtData) + sizeof(XF86BigfontCodes));
if (!pData) {
/* Out of luck. */
return (XF86BigfontCodes *) NULL;
@ -459,7 +459,7 @@ _XF86BigfontQueryFont (
DeqAsyncHandler(dpy, &async1);
reply_left = reply.length -
((SIZEOF(xXF86BigfontQueryFontReply) - SIZEOF(xReply)) >> 2);
if (! (fs = (XFontStruct *) Xmalloc (sizeof (XFontStruct)))) {
if (! (fs = Xmalloc (sizeof (XFontStruct)))) {
_XEatDataWords(dpy, reply_left);
return (XFontStruct *)NULL;
}
@ -521,14 +521,14 @@ _XF86BigfontQueryFont (
nbytes = reply.nUniqCharInfos * SIZEOF(xCharInfo)
+ (reply.nCharInfos+1)/2 * 2 * sizeof(CARD16);
pUniqCI = (xCharInfo *) Xmalloc (nbytes);
pUniqCI = Xmalloc (nbytes);
if (!pUniqCI) {
if (fs->properties) Xfree((char *) fs->properties);
Xfree((char *) fs);
_XEatDataWords(dpy, reply_left);
return (XFontStruct *)NULL;
}
if (! (fs->per_char = (XCharStruct *) Xmalloc (reply.nCharInfos * sizeof(XCharStruct)))) {
if (! (fs->per_char = Xmalloc (reply.nCharInfos * sizeof(XCharStruct)))) {
Xfree((char *) pUniqCI);
if (fs->properties) Xfree((char *) fs->properties);
Xfree((char *) fs);
@ -555,7 +555,7 @@ _XF86BigfontQueryFont (
XEDataObject fs_union;
char *addr;
pData = (XExtData *) Xmalloc(sizeof(XExtData));
pData = Xmalloc(sizeof(XExtData));
if (!pData) {
if (fs->properties) Xfree((char *) fs->properties);
Xfree((char *) fs);

12
lib/libX11/src/GetAtomNm.c
View File

@ -46,7 +46,7 @@ char *_XGetAtomName(
for (idx = TABLESIZE; --idx >= 0; ) {
if ((e = *table++) && (e->atom == atom)) {
idx = strlen(EntryName(e)) + 1;
if ((name = (char *)Xmalloc(idx)))
if ((name = Xmalloc(idx)))
strcpy(name, EntryName(e));
return name;
}
@ -73,12 +73,12 @@ char *XGetAtomName(
SyncHandle();
return(NULL);
}
if ((name = (char *) Xmalloc(rep.nameLength+1))) {
if ((name = Xmalloc(rep.nameLength + 1))) {
_XReadPad(dpy, name, (long)rep.nameLength);
name[rep.nameLength] = '\0';
_XUpdateAtomCache(dpy, name, atom, 0, -1, 0);
} else {
_XEatData(dpy, (unsigned long) (rep.nameLength + 3) & ~3);
_XEatDataWords(dpy, rep.length);
name = (char *) NULL;
}
UnlockDisplay(dpy);
@ -124,7 +124,7 @@ Bool _XGetAtomNameHandler(
_XGetAsyncReply(dpy, (char *)&replbuf, rep, buf, len,
(SIZEOF(xGetAtomNameReply) - SIZEOF(xReply)) >> 2,
False);
state->names[state->idx] = (char *) Xmalloc(repl->nameLength+1);
state->names[state->idx] = Xmalloc(repl->nameLength + 1);
_XGetAsyncData(dpy, state->names[state->idx], buf, len,
SIZEOF(xGetAtomNameReply), repl->nameLength,
repl->length << 2);
@ -170,13 +170,13 @@ XGetAtomNames (
}
if (missed >= 0) {
if (_XReply(dpy, (xReply *)&rep, 0, xFalse)) {
if ((names_return[missed] = (char *) Xmalloc(rep.nameLength+1))) {
if ((names_return[missed] = Xmalloc(rep.nameLength + 1))) {
_XReadPad(dpy, names_return[missed], (long)rep.nameLength);
names_return[missed][rep.nameLength] = '\0';
_XUpdateAtomCache(dpy, names_return[missed], atoms[missed],
0, -1, 0);
} else {
_XEatData(dpy, (unsigned long) (rep.nameLength + 3) & ~3);
_XEatDataWords(dpy, rep.length);
async_state.status = 0;
}
}

9
lib/libX11/src/GetHints.c
View File

@ -128,7 +128,7 @@ XWMHints *XGetWMHints (
return(NULL);
}
/* static copies not allowed in library, due to reentrancy constraint*/
if ((hints = (XWMHints *) Xcalloc (1, (unsigned) sizeof(XWMHints)))) {
if ((hints = Xcalloc (1, sizeof(XWMHints)))) {
hints->flags = prop->flags;
hints->input = (prop->input ? True : False);
hints->initial_state = cvtINT32toInt (prop->initialState);
@ -203,8 +203,7 @@ Status XGetIconSizes (
/* static copies not allowed in library, due to reentrancy constraint*/
nitems /= NumPropIconSizeElements;
if (! (hp = hints = (XIconSize *)
Xcalloc ((unsigned) nitems, (unsigned) sizeof(XIconSize)))) {
if (! (hp = hints = Xcalloc (nitems, sizeof(XIconSize)))) {
if (prop) Xfree ((char *) prop);
return 0;
}
@ -317,14 +316,14 @@ XGetClassHint(
if ( (actual_type == XA_STRING) && (actual_format == 8) ) {
len_name = strlen((char *) data);
if (! (classhint->res_name = Xmalloc((unsigned) (len_name+1)))) {
if (! (classhint->res_name = Xmalloc(len_name + 1))) {
Xfree((char *) data);
return (0);
}
strcpy(classhint->res_name, (char *) data);
if (len_name == nitems) len_name--;
len_class = strlen((char *) (data+len_name+1));
if (! (classhint->res_class = Xmalloc((unsigned) (len_class+1)))) {
if (! (classhint->res_class = Xmalloc(len_class + 1))) {
Xfree(classhint->res_name);
classhint->res_name = (char *) NULL;
Xfree((char *) data);

8
lib/libX11/src/GetProp.c
View File

@ -49,6 +49,13 @@ XGetWindowProperty(
register xGetPropertyReq *req;
xError error = {0};
/* Always initialize return values, in case callers fail to initialize
them and fail to check the return code for an error. */
*actual_type = None;
*actual_format = 0;
*nitems = *bytesafter = 0L;
*prop = (unsigned char *) NULL;
LockDisplay(dpy);
GetReq (GetProperty, req);
req->window = w;
@ -65,7 +72,6 @@ XGetWindowProperty(
return (1); /* not Success */
}
*prop = (unsigned char *) NULL;
if (reply.propertyType != None) {
unsigned long nbytes, netbytes;
int format = reply.format;

3
lib/libX11/src/GetRGBCMap.c
View File

@ -99,8 +99,7 @@ Status XGetRGBColormaps (
/*
* allocate array
*/
cmaps = (XStandardColormap *) Xmalloc (ncmaps *
sizeof (XStandardColormap));
cmaps = Xmalloc (ncmaps * sizeof (XStandardColormap));
if (!cmaps) {
if (data) Xfree ((char *) data);
return False;

6
lib/libX11/src/ImUtil.c
View File

@ -332,7 +332,7 @@ XImage *XCreateImage (
(xpad != 8 && xpad != 16 && xpad != 32) ||
offset < 0)
return (XImage *) NULL;
if ((image = (XImage *) Xcalloc(1, (unsigned) sizeof(XImage))) == NULL)
if ((image = Xcalloc(1, sizeof(XImage))) == NULL)
return (XImage *) NULL;
image->width = width;
@ -842,7 +842,7 @@ static XImage *_XSubImage (
register unsigned long pixel;
char *data;
if ((subimage = (XImage *) Xcalloc (1, sizeof (XImage))) == NULL)
if ((subimage = Xcalloc (1, sizeof (XImage))) == NULL)
return (XImage *) NULL;
subimage->width = width;
subimage->height = height;
@ -868,7 +868,7 @@ static XImage *_XSubImage (
_XInitImageFuncPtrs (subimage);
dsize = subimage->bytes_per_line * height;
if (subimage->format == XYPixmap) dsize = dsize * subimage->depth;
if (((data = Xcalloc (1, (unsigned) dsize)) == NULL) && (dsize > 0)) {
if (((data = Xcalloc (1, dsize)) == NULL) && (dsize > 0)) {
Xfree((char *) subimage);
return (XImage *) NULL;
}

4
lib/libX11/src/InitExt.c
View File

@ -49,7 +49,7 @@ XExtCodes *XInitExtension (
&codes.first_error)) return (NULL);
LockDisplay (dpy);
if (! (ext = (_XExtension *) Xcalloc (1, sizeof (_XExtension))) ||
if (! (ext = Xcalloc (1, sizeof (_XExtension))) ||
! (ext->name = strdup(name))) {
if (ext) Xfree((char *) ext);
UnlockDisplay(dpy);
@ -71,7 +71,7 @@ XExtCodes *XAddExtension (Display *dpy)
register _XExtension *ext;
LockDisplay (dpy);
if (! (ext = (_XExtension *) Xcalloc (1, sizeof (_XExtension)))) {
if (! (ext = Xcalloc (1, sizeof (_XExtension)))) {
UnlockDisplay(dpy);
return (XExtCodes *) NULL;
}

6
lib/libX11/src/IntAtom.c
View File

@ -72,7 +72,7 @@ Atom _XInternAtom(
/* look in the cache first */
if (!(atoms = dpy->atoms)) {
dpy->atoms = atoms = (AtomTable *)Xcalloc(1, sizeof(AtomTable));
dpy->atoms = atoms = Xcalloc(1, sizeof(AtomTable));
dpy->free_funcs->atoms = _XFreeAtomTable;
}
sig = 0;
@ -127,7 +127,7 @@ _XUpdateAtomCache(
if (!dpy->atoms) {
if (idx < 0) {
dpy->atoms = (AtomTable *)Xcalloc(1, sizeof(AtomTable));
dpy->atoms = Xcalloc(1, sizeof(AtomTable));
dpy->free_funcs->atoms = _XFreeAtomTable;
}
if (!dpy->atoms)
@ -147,7 +147,7 @@ _XUpdateAtomCache(
}
}
}
e = (Entry)Xmalloc(sizeof(EntryRec) + n + 1);
e = Xmalloc(sizeof(EntryRec) + n + 1);
if (e) {
e->sig = sig;
e->atom = atom;

3
lib/libX11/src/Key.h
View File

@ -2,6 +2,9 @@
#ifndef _KEY_H_
#define _KEY_H_
#include <X11/Xlib.h>
#include <X11/Xresource.h>
#ifndef NEEDKTABLE
extern const unsigned char _XkeyTable[];
#endif

8
lib/libX11/src/KeyBind.c
View File

@ -997,11 +997,9 @@ XRebindKeysym (
tmp = dpy->key_bindings;
nb = sizeof(KeySym) * nm;
if ((! (p = (struct _XKeytrans *) Xcalloc( 1, sizeof(struct _XKeytrans)))) ||
((! (p->string = (char *) Xmalloc( (unsigned) nbytes))) &&
(nbytes > 0)) ||
((! (p->modifiers = (KeySym *) Xmalloc( (unsigned) nb))) &&
(nb > 0))) {
if ((! (p = Xcalloc( 1, sizeof(struct _XKeytrans)))) ||
((! (p->string = Xmalloc(nbytes))) && (nbytes > 0)) ||
((! (p->modifiers = Xmalloc(nb))) && (nb > 0))) {
if (p) {
if (p->string) Xfree(p->string);
if (p->modifiers) Xfree((char *) p->modifiers);

8
lib/libX11/src/LiICmaps.c
View File

@ -34,7 +34,7 @@ Colormap *XListInstalledColormaps(
Window win,
int *n) /* RETURN */
{
long nbytes;
unsigned long nbytes;
Colormap *cmaps;
xListInstalledColormapsReply rep;
register xResourceReq *req;
@ -51,14 +51,14 @@ Colormap *XListInstalledColormaps(
if (rep.nColormaps) {
nbytes = rep.nColormaps * sizeof(Colormap);
cmaps = (Colormap *) Xmalloc((unsigned) nbytes);
nbytes = rep.nColormaps << 2;
cmaps = Xmalloc(nbytes);
if (! cmaps) {
_XEatData(dpy, (unsigned long) nbytes);
_XEatDataWords(dpy, rep.length);
UnlockDisplay(dpy);
SyncHandle();
return((Colormap *) NULL);
}
nbytes = rep.nColormaps << 2;
_XRead32 (dpy, (long *) cmaps, nbytes);
}
else cmaps = (Colormap *) NULL;

8
lib/libX11/src/LiProps.c
View File

@ -34,7 +34,7 @@ Atom *XListProperties(
Window window,
int *n_props) /* RETURN */
{
long nbytes;
unsigned long nbytes;
xListPropertiesReply rep;
Atom *properties;
register xResourceReq *req;
@ -50,14 +50,14 @@ Atom *XListProperties(
if (rep.nProperties) {
nbytes = rep.nProperties * sizeof(Atom);
properties = (Atom *) Xmalloc ((unsigned) nbytes);
nbytes = rep.nProperties << 2;
properties = Xmalloc (nbytes);
if (! properties) {
_XEatData(dpy, (unsigned long) nbytes);
_XEatDataWords(dpy, rep.length);
UnlockDisplay(dpy);
SyncHandle();
return (Atom *) NULL;
}
nbytes = rep.nProperties << 2;
_XRead32 (dpy, (long *) properties, nbytes);
}
else properties = (Atom *) NULL;

4
lib/libX11/src/ModMap.c
View File

@ -97,11 +97,11 @@ XSetModifierMapping(
XModifierKeymap *
XNewModifiermap(int keyspermodifier)
{
XModifierKeymap *res = (XModifierKeymap *) Xmalloc((sizeof (XModifierKeymap)));
XModifierKeymap *res = Xmalloc((sizeof (XModifierKeymap)));
if (res) {
res->max_keypermod = keyspermodifier;
res->modifiermap = (keyspermodifier > 0 ?
(KeyCode *) Xmalloc((unsigned) (8 * keyspermodifier))
Xmalloc(8 * keyspermodifier)
: (KeyCode *) NULL);
if (keyspermodifier && (res->modifiermap == NULL)) {
Xfree((char *) res);

27
lib/libX11/src/OpenDis.c
View File

@ -112,7 +112,7 @@ XOpenDisplay (
/*
* Attempt to allocate a display structure. Return NULL if allocation fails.
*/
if ((dpy = (Display *)Xcalloc(1, sizeof(Display))) == NULL) {
if ((dpy = Xcalloc(1, sizeof(Display))) == NULL) {
return(NULL);
}
@ -246,9 +246,7 @@ XOpenDisplay (
dpy->qlen = 0;
/* Set up free-function record */
if ((dpy->free_funcs = (_XFreeFuncRec *)Xcalloc(1,
sizeof(_XFreeFuncRec)))
== NULL) {
if ((dpy->free_funcs = Xcalloc(1, sizeof(_XFreeFuncRec))) == NULL) {
OutOfMemory (dpy);
return(NULL);
}
@ -316,7 +314,7 @@ XOpenDisplay (
return (NULL);
}
dpy->vendor = (char *) Xmalloc((unsigned) (u.setup->nbytesVendor + 1));
dpy->vendor = Xmalloc(u.setup->nbytesVendor + 1);
if (dpy->vendor == NULL) {
OutOfMemory(dpy);
return (NULL);
@ -342,9 +340,7 @@ XOpenDisplay (
/*
* Now iterate down setup information.....
*/
dpy->pixmap_format =
(ScreenFormat *)Xmalloc(
(unsigned) (dpy->nformats *sizeof(ScreenFormat)));
dpy->pixmap_format = Xcalloc(dpy->nformats, sizeof(ScreenFormat));
if (dpy->pixmap_format == NULL) {
OutOfMemory (dpy);
return(NULL);
@ -372,8 +368,7 @@ XOpenDisplay (
/*
* next the Screen structures.
*/
dpy->screens =
(Screen *)Xmalloc((unsigned) dpy->nscreens*sizeof(Screen));
dpy->screens = Xcalloc(dpy->nscreens, sizeof(Screen));
if (dpy->screens == NULL) {
OutOfMemory (dpy);
return(NULL);
@ -415,8 +410,7 @@ XOpenDisplay (
/*
* lets set up the depth structures.
*/
sp->depths = (Depth *)Xmalloc(
(unsigned)sp->ndepths*sizeof(Depth));
sp->depths = Xcalloc(sp->ndepths, sizeof(Depth));
if (sp->depths == NULL) {
OutOfMemory (dpy);
return(NULL);
@ -438,8 +432,7 @@ XOpenDisplay (
dp->nvisuals = u.dp->nVisuals;
u.dp = (xDepth *) (((char *) u.dp) + sz_xDepth);
if (dp->nvisuals > 0) {
dp->visuals =
(Visual *)Xmalloc((unsigned)dp->nvisuals*sizeof(Visual));
dp->visuals = Xcalloc(dp->nvisuals, sizeof(Visual));
if (dp->visuals == NULL) {
OutOfMemory (dpy);
return(NULL);
@ -499,6 +492,9 @@ XOpenDisplay (
return(NULL);
}
/*
* get availability of large requests
*/
dpy->bigreq_size = xcb_get_maximum_request_length(dpy->xcb->connection);
if(dpy->bigreq_size <= dpy->max_request_size)
dpy->bigreq_size = 0;
@ -525,7 +521,6 @@ XOpenDisplay (
(void) XSynchronize(dpy, _Xdebug);
/*
* get availability of large requests, and
* get the resource manager database off the root window.
*/
LockDisplay(dpy);
@ -550,7 +545,7 @@ XOpenDisplay (
dpy->xdefaults[reply.nItems] = '\0';
}
else if (reply.propertyType != None)
_XEatData(dpy, reply.nItems * (reply.format >> 3));
_XEatDataWords(dpy, reply.length);
}
}
UnlockDisplay(dpy);

4
lib/libX11/src/PixFormats.c
View File

@ -38,8 +38,8 @@ XPixmapFormatValues *XListPixmapFormats (
Display *dpy,
int *count) /* RETURN */
{
XPixmapFormatValues *formats = (XPixmapFormatValues *)
Xmalloc((unsigned) (dpy->nformats * sizeof (XPixmapFormatValues)));
XPixmapFormatValues *formats =
Xmalloc(dpy->nformats * sizeof (XPixmapFormatValues));
if (formats) {
register int i;

13
lib/libX11/src/PolyReg.c
View File

@ -95,8 +95,7 @@ InsertEdgeInET(
{
if (*iSLLBlock > SLLSPERBLOCK-1)
{
tmpSLLBlock =
(ScanLineListBlock *)Xmalloc(sizeof(ScanLineListBlock));
tmpSLLBlock = Xmalloc(sizeof(ScanLineListBlock));
(*SLLBlock)->next = tmpSLLBlock;
tmpSLLBlock->next = (ScanLineListBlock *)NULL;
*SLLBlock = tmpSLLBlock;
@ -410,8 +409,7 @@ static int PtsToRegion(
numRects = ((numFullPtBlocks * NUMPTSTOBUFFER) + iCurPtBlock) >> 1;
if (!(reg->rects = (BOX *)Xrealloc((char *)reg->rects,
(unsigned) (sizeof(BOX) * numRects)))) {
if (!(reg->rects = Xrealloc(reg->rects, sizeof(BOX) * numRects))) {
Xfree(prevRects);
return(0);
}
@ -521,8 +519,7 @@ XPolygonRegion(
if (Count < 2) return region;
if (! (pETEs = (EdgeTableEntry *)
Xmalloc((unsigned) (sizeof(EdgeTableEntry) * Count)))) {
if (! (pETEs = Xmalloc(sizeof(EdgeTableEntry) * Count))) {
XDestroyRegion(region);
return (Region) NULL;
}
@ -559,7 +556,7 @@ XPolygonRegion(
* send out the buffer
*/
if (iPts == NUMPTSTOBUFFER) {
tmpPtBlock = (POINTBLOCK *)Xmalloc(sizeof(POINTBLOCK));
tmpPtBlock = Xmalloc(sizeof(POINTBLOCK));
curPtBlock->next = tmpPtBlock;
curPtBlock = tmpPtBlock;
pts = curPtBlock->pts;
@ -605,7 +602,7 @@ XPolygonRegion(
* send out the buffer
*/
if (iPts == NUMPTSTOBUFFER) {
tmpPtBlock = (POINTBLOCK *)Xmalloc(sizeof(POINTBLOCK));
tmpPtBlock = Xmalloc(sizeof(POINTBLOCK));
curPtBlock->next = tmpPtBlock;
curPtBlock = tmpPtBlock;
pts = curPtBlock->pts;

9
lib/libX11/src/PropAlloc.c
View File

@ -39,20 +39,19 @@ in this Software without prior written authorization from The Open Group.
XSizeHints *XAllocSizeHints (void)
{
return ((XSizeHints *) Xcalloc (1, (unsigned) sizeof (XSizeHints)));
return Xcalloc (1, sizeof (XSizeHints));
}
XStandardColormap *XAllocStandardColormap (void)
{
return ((XStandardColormap *)
Xcalloc (1, (unsigned) sizeof (XStandardColormap)));
return Xcalloc (1, sizeof (XStandardColormap));
}
XWMHints *XAllocWMHints (void)
{
return ((XWMHints *) Xcalloc (1, (unsigned) sizeof (XWMHints)));
return Xcalloc (1, sizeof (XWMHints));
}
@ -64,7 +63,7 @@ XClassHint *XAllocClassHint (void)
XIconSize *XAllocIconSize (void)
{
return ((XIconSize *) Xcalloc (1, (unsigned) sizeof (XIconSize)));
return Xcalloc (1, sizeof (XIconSize));
}

2
lib/libX11/src/PutBEvent.c
View File

@ -41,7 +41,7 @@ _XPutBackEvent (
XEvent store = *event;
if (!dpy->qfree) {
if ((dpy->qfree = (_XQEvent *) Xmalloc (sizeof (_XQEvent))) == NULL) {
if ((dpy->qfree = Xmalloc (sizeof (_XQEvent))) == NULL) {
return 0;
}
dpy->qfree->next = NULL;

13
lib/libX11/src/PutImage.c
View File

@ -680,7 +680,7 @@ SendXYImage(
length = ROUNDUP(length, 4);
if ((dpy->bufptr + length) > dpy->bufmax) {
if ((buf = _XAllocScratch(dpy, (unsigned long) (length))) == NULL) {
if ((buf = _XAllocScratch(dpy, length)) == NULL) {
UnGetReq(PutImage);
return;
}
@ -703,13 +703,13 @@ SendXYImage(
bytes_per_temp_plane = bytes_per_line * req->height;
temp_length = ROUNDUP(bytes_per_temp_plane * image->depth, 4);
if (buf == dpy->bufptr) {
if (! (temp = _XAllocScratch(dpy, (unsigned long) temp_length))) {
if (! (temp = _XAllocScratch(dpy, temp_length))) {
UnGetReq(PutImage);
return;
}
}
else
if ((extra = temp = Xmalloc((unsigned) temp_length)) == NULL) {
if ((extra = temp = Xmalloc(temp_length)) == NULL) {
UnGetReq(PutImage);
return;
}
@ -778,8 +778,7 @@ SendZImage(
(req_yoffset * image->bytes_per_line) +
((req_xoffset * image->bits_per_pixel) >> 3);
if ((image->bits_per_pixel == 4) && ((unsigned int) req_xoffset & 0x01)) {
if (! (shifted_src = (unsigned char *)
Xmalloc((unsigned) (req->height * image->bytes_per_line)))) {
if (! (shifted_src = Xmalloc(req->height * image->bytes_per_line))) {
UnGetReq(PutImage);
return;
}
@ -810,7 +809,7 @@ SendZImage(
dest = (unsigned char *)dpy->bufptr;
else
if ((dest = (unsigned char *)
_XAllocScratch(dpy, (unsigned long)(length))) == NULL) {
_XAllocScratch(dpy, length)) == NULL) {
if (shifted_src) Xfree((char *) shifted_src);
UnGetReq(PutImage);
return;
@ -1001,7 +1000,7 @@ XPutImage (
img.bits_per_pixel = dest_bits_per_pixel;
img.bytes_per_line = ROUNDUP((dest_bits_per_pixel * width),
dest_scanline_pad) >> 3;
img.data = Xmalloc((unsigned) (img.bytes_per_line * height));
img.data = Xmalloc(img.bytes_per_line * height);
if (img.data == NULL)
return 0;
_XInitImageFuncPtrs(&img);

10
lib/libX11/src/QuColors.c
View File

@ -37,9 +37,7 @@ _XQueryColors(
int ncolors)
{
register int i;
xrgb *color;
xQueryColorsReply rep;
long nbytes;
register xQueryColorsReq *req;
GetReq(QueryColors, req);
@ -52,8 +50,9 @@ _XQueryColors(
/* XXX this isn't very efficient */
if (_XReply(dpy, (xReply *) &rep, 0, xFalse) != 0) {
if ((color = (xrgb *)
Xmalloc((unsigned) (nbytes = (long) ncolors * SIZEOF(xrgb))))) {
unsigned long nbytes = (long) ncolors * SIZEOF(xrgb);
xrgb *color = Xmalloc(nbytes);
if (color != NULL) {
_XRead(dpy, (char *) color, nbytes);
@ -67,7 +66,8 @@ _XQueryColors(
}
Xfree((char *)color);
}
else _XEatData(dpy, (unsigned long) nbytes);
else
_XEatDataWords(dpy, rep.length);
}
}

8
lib/libX11/src/QuTree.c
View File

@ -37,7 +37,7 @@ Status XQueryTree (
Window **children, /* RETURN */
unsigned int *nchildren) /* RETURN */
{
long nbytes;
unsigned long nbytes;
xQueryTreeReply rep;
register xResourceReq *req;
@ -52,14 +52,14 @@ Status XQueryTree (
*children = (Window *) NULL;
if (rep.nChildren != 0) {
nbytes = rep.nChildren * sizeof(Window);
*children = (Window *) Xmalloc((unsigned) nbytes);
nbytes = rep.nChildren << 2;
*children = Xmalloc(nbytes);
if (! *children) {
_XEatData(dpy, (unsigned long) nbytes);
_XEatDataWords(dpy, rep.length);
UnlockDisplay(dpy);
SyncHandle();
return (0);
}
nbytes = rep.nChildren << 2;
_XRead32 (dpy, (long *) *children, nbytes);
}
*parent = rep.parent;

9
lib/libX11/src/Quarks.c
View File

@ -186,15 +186,14 @@ ExpandQuarkTable(void)
newmask = (oldmask << 1) + 1;
else {
if (!stringTable) {
stringTable = (XrmString **)Xmalloc(sizeof(XrmString *) *
CHUNKPER);
stringTable = Xmalloc(sizeof(XrmString *) * CHUNKPER);
if (!stringTable)
return False;
stringTable[0] = (XrmString *)NULL;
}
#ifdef PERMQ
if (!permTable)
permTable = (Bits **)Xmalloc(sizeof(Bits *) * CHUNKPER);
permTable = Xmalloc(sizeof(Bits *) * CHUNKPER);
if (!permTable)
return False;
#endif
@ -289,13 +288,13 @@ nomatch: if (!rehash)
q = nextQuark;
if (!(q & QUANTUMMASK)) {
if (!(q & CHUNKMASK)) {
if (!(new = Xrealloc((char *)stringTable,
if (!(new = Xrealloc(stringTable,
sizeof(XrmString *) *
((q >> QUANTUMSHIFT) + CHUNKPER))))
goto fail;
stringTable = (XrmString **)new;
#ifdef PERMQ
if (!(new = Xrealloc((char *)permTable,
if (!(new = Xrealloc(permTable,
sizeof(Bits *) *
((q >> QUANTUMSHIFT) + CHUNKPER))))
goto fail;

2
lib/libX11/src/RdBitF.c
View File

@ -191,7 +191,7 @@ XReadBitmapFileData (
bytes_per_line = (ww+7)/8 + padding;
size = bytes_per_line * hh;
bits = (unsigned char *) Xmalloc ((unsigned int) size);
bits = Xmalloc (size);
if (!bits)
RETURN (BitmapNoMemory);

19
lib/libX11/src/Region.c
View File

@ -139,9 +139,9 @@ XCreateRegion(void)
{
Region temp;
if (! (temp = ( Region )Xmalloc( (unsigned) sizeof( REGION ))))
if (! (temp = Xmalloc(sizeof( REGION ))))
return (Region) NULL;
if (! (temp->rects = ( BOX * )Xmalloc( (unsigned) sizeof( BOX )))) {
if (! (temp->rects = Xmalloc(sizeof( BOX )))) {
Xfree((char *) temp);
return (Region) NULL;
}
@ -521,9 +521,9 @@ miRegionCopy(
{
BOX *prevRects = dstrgn->rects;
if (! (dstrgn->rects = (BOX *)
Xrealloc((char *) dstrgn->rects,
(unsigned) rgn->numRects * (sizeof(BOX))))) {
dstrgn->rects = Xrealloc(dstrgn->rects,
rgn->numRects * (sizeof(BOX)));
if (! dstrgn->rects) {
Xfree(prevRects);
return;
}
@ -788,8 +788,7 @@ miRegionOp(
*/
newReg->size = max(reg1->numRects,reg2->numRects) * 2;
if (! (newReg->rects = (BoxPtr)
Xmalloc ((unsigned) (sizeof(BoxRec) * newReg->size)))) {
if (! (newReg->rects = Xmalloc (sizeof(BoxRec) * newReg->size))) {
newReg->size = 0;
return;
}
@ -980,8 +979,8 @@ miRegionOp(
{
BoxPtr prev_rects = newReg->rects;
newReg->size = newReg->numRects;
newReg->rects = (BoxPtr) Xrealloc ((char *) newReg->rects,
(unsigned) (sizeof(BoxRec) * newReg->size));
newReg->rects = Xrealloc (newReg->rects,
sizeof(BoxRec) * newReg->size);
if (! newReg->rects)
newReg->rects = prev_rects;
}
@ -993,7 +992,7 @@ miRegionOp(
*/
newReg->size = 1;
Xfree((char *) newReg->rects);
newReg->rects = (BoxPtr) Xmalloc(sizeof(BoxRec));
newReg->rects = Xmalloc(sizeof(BoxRec));
}
}
Xfree ((char *) oldRects);

4
lib/libX11/src/RegstFlt.c
View File

@ -85,7 +85,7 @@ _XRegisterFilterByMask(
{
XFilterEventRec *rec;
rec = (XFilterEventList)Xmalloc(sizeof(XFilterEventRec));
rec = Xmalloc(sizeof(XFilterEventRec));
if (!rec)
return;
rec->window = window;
@ -117,7 +117,7 @@ _XRegisterFilterByType(
{
XFilterEventRec *rec;
rec = (XFilterEventList)Xmalloc(sizeof(XFilterEventRec));
rec = Xmalloc(sizeof(XFilterEventRec));
if (!rec)
return;
rec->window = window;

2
lib/libX11/src/SetFPath.c
View File

@ -52,7 +52,7 @@ XSetFontPath (
}
nbytes = (n + 3) & ~3;
req->length += nbytes >> 2;
if ((p = (char *) Xmalloc ((unsigned) nbytes))) {
if ((p = Xmalloc (nbytes))) {
/*
* pack into counted strings.
*/

6
lib/libX11/src/SetHints.c
View File

@ -184,7 +184,7 @@ XSetIconSizes (
#define size_of_the_real_thing sizeof /* avoid grepping screwups */
unsigned nbytes = count * size_of_the_real_thing(xPropIconSize);
#undef size_of_the_real_thing
if ((prop = pp = (xPropIconSize *) Xmalloc (nbytes))) {
if ((prop = pp = Xmalloc (nbytes))) {
for (i = 0; i < count; i++) {
pp->minWidth = list->min_width;
pp->minHeight = list->min_height;
@ -216,7 +216,7 @@ XSetCommand (
for (i = 0, nbytes = 0; i < argc; i++) {
nbytes += safestrlen(argv[i]) + 1;
}
if ((bp = buf = Xmalloc((unsigned) nbytes))) {
if ((bp = buf = Xmalloc(nbytes))) {
/* copy arguments into single buffer */
for (i = 0; i < argc; i++) {
if (argv[i]) {
@ -299,7 +299,7 @@ XSetClassHint(
len_nm = safestrlen(classhint->res_name);
len_cl = safestrlen(classhint->res_class);
if ((class_string = s = Xmalloc((unsigned) (len_nm + len_cl + 2)))) {
if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
if (len_nm) {
strcpy(s, classhint->res_name);
s += len_nm + 1;

2
lib/libX11/src/StrToText.c
View File

@ -78,7 +78,7 @@ Status XStringListToTextProperty (
}
}
} else {
proto.value = (unsigned char *) Xmalloc (1); /* easier for client */
proto.value = Xmalloc (1); /* easier for client */
if (!proto.value) return False;
proto.value[0] = '\0';

4
lib/libX11/src/TextToStr.c
View File

@ -72,10 +72,10 @@ Status XTextPropertyToStringList (
/*
* allocate list and duplicate
*/
list = (char **) Xmalloc (nelements * sizeof (char *));
list = Xmalloc (nelements * sizeof (char *));
if (!list) return False;
start = (char *) Xmalloc ((datalen + 1) * sizeof (char)); /* for <NUL> */
start = Xmalloc ((datalen + 1) * sizeof (char)); /* for <NUL> */
if (!start) {
Xfree ((char *) list);
return False;

8
lib/libX11/src/VisUtil.c
View File

@ -75,8 +75,7 @@ XVisualInfo *XGetVisualInfo(
count = 0;
total = 10;
if (! (vip_base = vip = (XVisualInfo *)
Xmalloc((unsigned) (sizeof(XVisualInfo) * total)))) {
if (! (vip_base = vip = Xmalloc(sizeof(XVisualInfo) * total))) {
UnlockDisplay(dpy);
return (XVisualInfo *) NULL;
}
@ -132,9 +131,8 @@ XVisualInfo *XGetVisualInfo(
{
XVisualInfo *old_vip_base = vip_base;
total += 10;
if (! (vip_base = (XVisualInfo *)
Xrealloc((char *) vip_base,
(unsigned) (sizeof(XVisualInfo) * total)))) {
if (! (vip_base = Xrealloc(vip_base,
sizeof(XVisualInfo) * total))) {
Xfree((char *) old_vip_base);
UnlockDisplay(dpy);
return (XVisualInfo *) NULL;

2
lib/libX11/src/WrBitF.c
View File

@ -53,7 +53,7 @@ static char *Format_Image(
bytes_per_line = (width+7)/8;
*resultsize = bytes_per_line * height; /* Calculate size of data */
data = (char *) Xmalloc( *resultsize ); /* Get space for data */
data = Xmalloc( *resultsize ); /* Get space for data */
if (!data)
return(ERR_RETURN);

1
lib/libX11/src/Xintatom.h
View File

@ -2,6 +2,7 @@
#ifndef _XINTATOM_H_
#define _XINTATOM_H_ 1
#include <X11/Xlib.h>
#include <X11/Xfuncproto.h>
/* IntAtom.c */

1
lib/libX11/src/Xintconn.h
View File

@ -3,6 +3,7 @@
#define _XINTCONN_H_ 1
#include <X11/Xfuncproto.h>
#include <X11/Xlib.h>
_XFUNCPROTOBEGIN

20
lib/libX11/src/XlibInt.c
View File

@ -152,7 +152,7 @@ Bool _XPollfdCacheInit(
#ifdef USE_POLL
struct pollfd *pfp;
pfp = (struct pollfd *)Xmalloc(POLLFD_CACHE_SIZE * sizeof(struct pollfd));
pfp = Xmalloc(POLLFD_CACHE_SIZE * sizeof(struct pollfd));
if (!pfp)
return False;
pfp[0].fd = dpy->fd;
@ -374,10 +374,10 @@ _XRegisterInternalConnection(
struct _XConnWatchInfo *watchers;
XPointer *wd;
new_conni = (struct _XConnectionInfo*)Xmalloc(sizeof(struct _XConnectionInfo));
new_conni = Xmalloc(sizeof(struct _XConnectionInfo));
if (!new_conni)
return 0;
new_conni->watch_data = (XPointer *)Xmalloc(dpy->watcher_count * sizeof(XPointer));
new_conni->watch_data = Xmalloc(dpy->watcher_count * sizeof(XPointer));
if (!new_conni->watch_data) {
Xfree(new_conni);
return 0;
@ -464,7 +464,7 @@ XInternalConnectionNumbers(
count = 0;
for (info_list=dpy->im_fd_info; info_list; info_list=info_list->next)
count++;
fd_list = (int*) Xmalloc (count * sizeof(int));
fd_list = Xmalloc (count * sizeof(int));
if (!fd_list) {
UnlockDisplay(dpy);
return 0;
@ -537,9 +537,8 @@ XAddConnectionWatch(
/* allocate new watch data */
for (info_list=dpy->im_fd_info; info_list; info_list=info_list->next) {
wd_array = (XPointer *)Xrealloc((char *)info_list->watch_data,
(dpy->watcher_count + 1) *
sizeof(XPointer));
wd_array = Xrealloc(info_list->watch_data,
(dpy->watcher_count + 1) * sizeof(XPointer));
if (!wd_array) {
UnlockDisplay(dpy);
return 0;
@ -548,7 +547,7 @@ XAddConnectionWatch(
wd_array[dpy->watcher_count] = NULL; /* for cleanliness */
}
new_watcher = (struct _XConnWatchInfo*)Xmalloc(sizeof(struct _XConnWatchInfo));
new_watcher = Xmalloc(sizeof(struct _XConnWatchInfo));
if (!new_watcher) {
UnlockDisplay(dpy);
return 0;
@ -756,8 +755,7 @@ void _XEnq(
/* If dpy->qfree is non-NULL do this, else malloc a new one. */
dpy->qfree = qelt->next;
}
else if ((qelt =
(_XQEvent *) Xmalloc((unsigned)sizeof(_XQEvent))) == NULL) {
else if ((qelt = Xmalloc(sizeof(_XQEvent))) == NULL) {
/* Malloc call failed! */
ESET(ENOMEM);
_XIOError(dpy);
@ -1518,7 +1516,7 @@ char *_XAllocScratch(
{
if (nbytes > dpy->scratch_length) {
if (dpy->scratch_buffer) Xfree (dpy->scratch_buffer);
if ((dpy->scratch_buffer = Xmalloc((unsigned) nbytes)))
if ((dpy->scratch_buffer = Xmalloc(nbytes)))
dpy->scratch_length = nbytes;
else dpy->scratch_length = 0;
}

2
lib/libX11/src/Xprivate.h
View File

@ -8,6 +8,8 @@
#ifndef XPRIVATE_H
#define XPRIVATE_H
#include <X11/Xlib.h>
extern _X_HIDDEN void _XIDHandler(Display *dpy);
extern _X_HIDDEN void _XSeqSyncFunction(Display *dpy);
extern _X_HIDDEN void _XSetPrivSyncFunction(Display *dpy);

2
lib/libX11/src/Xresinternal.h
View File

@ -2,6 +2,8 @@
#ifndef _XRESINTERNAL_H_
#define _XRESINTERNAL_H_
#include <X11/Xlib.h>
#include <X11/Xresource.h>
#include <inttypes.h>
/* type defines */

20
lib/libX11/src/Xrm.c
View File

@ -495,7 +495,7 @@ static XrmDatabase NewDatabase(void)
{
register XrmDatabase db;
db = (XrmDatabase) Xmalloc(sizeof(XrmHashBucketRec));
db = Xmalloc(sizeof(XrmHashBucketRec));
if (db) {
_XCreateMutex(&db->linfo);
db->table = (NTable)NULL;
@ -828,7 +828,7 @@ static void PutEntry(
NTable *nprev, *firstpprev;
#define NEWTABLE(q,i) \
table = (NTable)Xmalloc(sizeof(LTableRec)); \
table = Xmalloc(sizeof(LTableRec)); \
if (!table) \
return; \
table->name = q; \
@ -841,7 +841,7 @@ static void PutEntry(
nprev = NodeBuckets(table); \
} else { \
table->leaf = 1; \
if (!(nprev = (NTable *)Xmalloc(sizeof(VEntry *)))) {\
if (!(nprev = Xmalloc(sizeof(VEntry *)))) {\
Xfree(table); \
return; \
} \
@ -955,9 +955,8 @@ static void PutEntry(
prev = nprev;
}
/* now allocate the value entry */
entry = (VEntry)Xmalloc(((type == XrmQString) ?
sizeof(VEntryRec) : sizeof(DEntryRec)) +
value->size);
entry = Xmalloc(((type == XrmQString) ?
sizeof(VEntryRec) : sizeof(DEntryRec)) + value->size);
if (!entry)
return;
entry->name = q = *quarks;
@ -987,13 +986,12 @@ static void PutEntry(
if (resourceQuarks) {
unsigned char *prevQuarks = resourceQuarks;
resourceQuarks = (unsigned char *)Xrealloc((char *)resourceQuarks,
size);
resourceQuarks = Xrealloc(resourceQuarks, size);
if (!resourceQuarks) {
Xfree(prevQuarks);
}
} else
resourceQuarks = (unsigned char *)Xmalloc(size);
resourceQuarks = Xmalloc(size);
if (resourceQuarks) {
bzero((char *)&resourceQuarks[oldsize], size - oldsize);
maxResourceQuark = (size << 3) - 1;
@ -1138,11 +1136,11 @@ static void GetDatabase(
str_len = strlen (str);
if (DEF_BUFF_SIZE > str_len) lhs = lhs_s;
else if ((lhs = (char*) Xmalloc (str_len)) == NULL)
else if ((lhs = Xmalloc (str_len)) == NULL)
return;
alloc_chars = DEF_BUFF_SIZE < str_len ? str_len : DEF_BUFF_SIZE;
if ((rhs = (char*) Xmalloc (alloc_chars)) == NULL) {
if ((rhs = Xmalloc (alloc_chars)) == NULL) {
if (lhs != lhs_s) Xfree (lhs);
return;
}

8
lib/libX11/src/locking.c
View File

@ -82,7 +82,7 @@ _Xthread_waiter(void)
struct _xthread_waiter *me;
if (!(me = TlsGetValue(_X_TlsIndex))) {
me = (struct _xthread_waiter *)xmalloc(sizeof(struct _xthread_waiter));
me = xmalloc(sizeof(struct _xthread_waiter));
me->sem = CreateSemaphore(NULL, 0, 1, NULL);
me->next = NULL;
TlsSetValue(_X_TlsIndex, me);
@ -249,7 +249,7 @@ static struct _XCVList *_XCreateCVL(
dpy->lock->free_cvls = cvl->next;
dpy->lock->num_free_cvls--;
} else {
cvl = (struct _XCVList *)Xmalloc(sizeof(struct _XCVList));
cvl = Xmalloc(sizeof(struct _XCVList));
if (!cvl)
return NULL;
cvl->cv = xcondition_malloc();
@ -512,10 +512,10 @@ void _XUserUnlockDisplay(
static int _XInitDisplayLock(
Display *dpy)
{
dpy->lock_fns = (struct _XLockPtrs*)Xmalloc(sizeof(struct _XLockPtrs));
dpy->lock_fns = Xmalloc(sizeof(struct _XLockPtrs));
if (dpy->lock_fns == NULL)
return -1;
dpy->lock = (struct _XLockInfo *)Xmalloc(sizeof(struct _XLockInfo));
dpy->lock = Xmalloc(sizeof(struct _XLockInfo));
if (dpy->lock == NULL) {
_XFreeDisplayLock(dpy);
return -1;

2
lib/libX11/src/locking.h
View File

@ -36,6 +36,8 @@ in this Software without prior written authorization from The Open Group.
#define xmalloc(s) Xmalloc(s)
#define xfree(s) Xfree(s)
#include <X11/Xlib.h>
#include <X11/Xlibint.h>
#include <X11/Xthreads.h>
struct _XCVList {

9
lib/libX11/src/udcInf.c
View File

@ -145,12 +145,11 @@ int *num_codeset;
if(!_XlcCompareISOLatin1(charset_str,buf)){
num_ret += 1;
if(num_ret == 1){
ret = (int *)Xmalloc(sizeof(int));
ret = Xmalloc(sizeof(int));
} else {
int *prev_ret = ret;
ret =
(int *)Xrealloc(ret,num_ret*sizeof(int));
ret = Xrealloc(ret, num_ret * sizeof(int));
if (ret == NULL){
Xfree(prev_ret);
}
@ -272,7 +271,7 @@ int *num_gr;
sprintf(buf, "fs%d.charset.udc_area", codeset-1);
_XlcGetLocaleDataBase(lcd, "XLC_FONTSET", buf, &value, &count);
if(count > 0){
udc = (_XUDCGlyphRegion *)Xmalloc(count * sizeof(_XUDCGlyphRegion));
udc = Xmalloc(count * sizeof(_XUDCGlyphRegion));
if(udc == NULL){
_xudc_utyerrno = 0x03 ;
_xudc_utyerrno |= (0x0b<<8) ;
@ -524,7 +523,7 @@ int *num_cr;
return(ret);
}
crr = (_XUDCCodeRegion *)Xmalloc(num_gr*sizeof(_XUDCCodeRegion));
crr = Xmalloc(num_gr * sizeof(_XUDCCodeRegion));
if(crr == NULL){
Xfree(gr);
_xudc_utyerrno = 0x03 ;

2
lib/libX11/src/xkb/XKBGetMap.c
View File

@ -484,6 +484,8 @@ unsigned mask;
if ( xkb->device_spec == XkbUseCoreKbd )
xkb->device_spec= rep->deviceID;
if ( rep->maxKeyCode < rep->minKeyCode )
return BadImplementation;
xkb->min_key_code = rep->minKeyCode;
xkb->max_key_code = rep->maxKeyCode;