summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2024-07-21XvQueryAdaptors: avoid NULL deref if length is 0, but num_adaptors is notHEADmasterAlan Coopersmith
Found by gcc 14.1: Xv.c: In function ‘XvQueryAdaptors’: Xv.c:222:31: warning: dereference of NULL ‘<unknown>’ [CWE-476] [-Wanalyzer-null-dereference] 222 | pa->type = (char) u.pa->type; | ~~~~^~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxv/-/merge_requests/7>
2024-07-21XvQueryEncodings: avoid NULL deref if length is 0, but num_encodings is notAlan Coopersmith
Found by gcc 14.1: Xv.c: In function ‘XvQueryEncodings’: Xv.c:387:31: warning: dereference of NULL ‘<unknown>’ [CWE-476] [-Wanalyzer-null-dereference] 387 | pe->encoding_id = u.pe->encoding; | ~~~~^~~~~~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxv/-/merge_requests/7>
2024-07-21Use calloc instead of malloc and manual loops to zero array contentsAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Part-of: <https://gitlab.freedesktop.org/xorg/lib/libxv/-/merge_requests/7>
2023-03-08configure: Use LT_INIT from libtool 2 instead of deprecated AC_PROG_LIBTOOLAlan Coopersmith
AC_PROG_LIBTOOL was replaced by LT_INIT in libtool 2 in 2008, so it's time to rely on it. Clears autoconf warnings: configure.ac:34: warning: The macro `AC_PROG_LIBTOOL' is obsolete. configure.ac:34: You should run autoupdate. aclocal.m4:3465: AC_PROG_LIBTOOL is expanded from... configure.ac:34: the top level libtoolize: Consider adding 'AC_CONFIG_MACRO_DIRS([m4])' to configure.ac, libtoolize: and rerunning libtoolize and aclocal. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2023-02-25Remove "All rights reserved" from Oracle copyright noticesAlan Coopersmith
Oracle no longer includes this term in our copyright & license notices. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-12-04libXv 1.0.12libXv-1.0.12Alan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-11-20Handle implicit conversion warnings from clangAlan Coopersmith
Clears 62 -Wimplicit-int-conversion, 38 -Wshorten-64-to-32, and 11 -Wsign-conversion warnings. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-11-20Variable scope reductionsAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-10-17XvGetReq: remove trailing semicolon that caller is expected to provideAlan Coopersmith
Clears 20 clang warnings of the form: Xv.c:126:34: warning: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Wextra-semi-stmt] XvGetReq(QueryExtension, req); ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-07-17gitlab CI: add a basic build testAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-07-17Fix spelling/wording issuesAlan Coopersmith
Found by using: codespell --builtin clear,rare,usage,informal,code,names Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2022-07-17Build xz tarballs instead of bzip2Alan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2018-12-07Update configure.ac bug URL for gitlab migrationAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2018-11-19Update README for gitlab migrationAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2017-01-26autogen: add default patch prefixMihail Konev
Signed-off-by: Mihail Konev <k.mvc@ya.ru>
2017-01-26autogen.sh: use quoted string variablesEmil Velikov
Place quotes around the $srcdir, $ORIGDIR and $0 variables to prevent fall-outs, when they contain space. Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2017-01-26autogen.sh: use exec instead of waiting for configure to finishPeter Hutterer
Syncs the invocation of configure with the one from the server. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
2016-10-04libXv 1.0.11libXv-1.0.11Matthieu Herrb
Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
2016-09-28Protocol handling issues in libXv - CVE-2016-5407Tobias Stoeckmann
The Xv query functions for adaptors and encodings suffer from out of boundary accesses if a hostile X server sends a maliciously crafted response. A previous fix already checks the received length against fixed values but ignores additional length specifications which are stored inside the received data. These lengths are accessed in a for-loop. The easiest way to guarantee a correct processing is by validating all lengths against the remaining size left before accessing referenced memory. This makes the previously applied check obsolete, therefore I removed it. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
2014-07-28Fix typo in dependencies for lint libraryAlan Coopersmith
Breaks out of tree lintlib builds by causing VPATH lookup to fail. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-09-07libXv 1.0.10libXv-1.0.10Alan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-07-05Remove fallback for _XEatDataWords, require libX11 1.6 for itAlan Coopersmith
_XEatDataWords was orignally introduced with the May 2013 security patches, and in order to ease the process of delivering those, fallback versions of _XEatDataWords were included in the X extension library patches so they could be applied to older versions that didn't have libX11 1.6 yet. Now that we're past that hurdle, we can drop the fallbacks and just require libX11 1.6 for building new versions of the extension libraries. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-07-05Refactor error handlingAlan Coopersmith
Reduce code duplication, make error checking & cleanup more consistent Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-07-05Add missing calls to _XEatDataWords when we are skipping _XReadAlan Coopersmith
If we failed to allocate the buffer to _XRead into, discard the rest of the reply, instead of leaving it to confuse the reading of the next reply. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-07-05Replace custom copy of GetReq macro with call to Xlib 1.5's _XGetRequestAlan Coopersmith
xvproto.h names don't match those required by the Xlibint.h GetReq* macros, but at least we can rely on the _XGetRequest function for the bulk of the work now, instead of duplicating it. Also clears clang warnings repeated for every request function: Xv.c:137:5: warning: cast from 'char *' to 'xvQueryExtensionReq *' increases re quired alignment from 1 to 2 [-Wcast-align] XvGetReq(QueryExtension, req); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./Xvlibint.h:52:8: note: expanded from macro 'XvGetReq' req = (xv##name##Req *)(dpy->last_req = dpy->bufptr);\ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Xv.c:137:5: warning: implicit conversion loses integer precision: 'int' to 'CAR D8' (aka 'unsigned char') [-Wconversion] XvGetReq(QueryExtension, req); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./Xvlibint.h:53:30: note: expanded from macro 'XvGetReq' req->reqType = info->codes->major_opcode;\ ~ ~~~~~~~~~~~~~^~~~~~~~~~~~ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-07-05Require ANSI C89 pre-processor, drop pre-C89 token pasting supportAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
2013-07-05Use pad_to_int32 macro instead of repeated (x + 3) & ~3 patternAlan Coopersmith
Makes code clearer, and using ~3U instead of ~3 clears some signed int warnings. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-07-05Fix sign conversion & comparison warnings from clangAlan Coopersmith
Clears up: Xv.c:196:21: warning: implicit conversion changes signedness: 'CARD32' (aka 'unsigned int') to 'int' [-Wsign-conversion] size = rep.length << 2; ~ ~~~~~~~~~~~^~~~ Xv.c:212:41: warning: implicit conversion changes signedness: 'int' to 'size_t' (aka 'unsigned long') [-Wsign-conversion] if ((pas=(XvAdaptorInfo *)Xmalloc(size))==NULL) { ~~~~~~~~^~~~~ Xv.c:236:43: warning: implicit conversion changes signedness: 'int' to 'unsigned long' [-Wsign-conversion] pa->num_adaptors = rep.num_adaptors - ii; ~ ~~~~~~~~~~~~~~~~~^~~~ Xv.c:243:40: warning: implicit conversion changes signedness: 'int' to 'size_t' (aka 'unsigned long') [-Wsign-conversion] if ( (name = (char *)Xmalloc(size+1)) == NULL) ~~~~~~~~~~~~^~~ Xv.c:251:37: warning: implicit conversion changes signedness: 'int' to 'size_t' (aka 'unsigned long') [-Wsign-conversion] (void)strncpy(name, u.string, size); ~~~~~~~ ^~~~ Xv.c:260:36: warning: implicit conversion changes signedness: 'int' to 'size_t' (aka 'unsigned long') [-Wsign-conversion] if ((pfs=(XvFormat *)Xmalloc(size))==NULL) { ~~~~~~~~^~~~~ Xv.c:269:20: warning: comparison of integers of different signs: 'int' and 'unsigned long' [-Wsign-compare] for (jj=0; jj<pa->num_formats; jj++) { ~~^~~~~~~~~~~~~~~~ Xv.c:259:29: warning: implicit conversion loses integer precision: 'unsigned long' to 'int' [-Wshorten-64-to-32] size = pa->num_formats*sizeof(XvFormat); ~ ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~ Xv.c:305:16: warning: comparison of integers of different signs: 'int' and 'unsigned long' [-Wsign-compare] for (ii=0; ii<pAdaptors->num_adaptors; ii++, pa++) ~~^~~~~~~~~~~~~~~~~~~~~~~~ Xv.c:356:21: warning: implicit conversion changes signedness: 'CARD32' (aka 'unsigned int') to 'int' [-Wsign-conversion] size = rep.length << 2; ~ ~~~~~~~~~~~^~~~ Xv.c:369:41: warning: implicit conversion changes signedness: 'int' to 'size_t' (aka 'unsigned long') [-Wsign-conversion] if ( (pes = (XvEncodingInfo *)Xmalloc(size)) == NULL) { ~~~~~~~~^~~~~ Xv.c:392:45: warning: implicit conversion changes signedness: 'int' to 'unsigned long' [-Wsign-conversion] pe->num_encodings = rep.num_encodings - jj; ~ ~~~~~~~~~~~~~~~~~~^~~~ Xv.c:397:40: warning: implicit conversion changes signedness: 'int' to 'size_t' (aka 'unsigned long') [-Wsign-conversion] if ( (name = (char *)Xmalloc(size+1)) == NULL) { ~~~~~~~~~~~~^~~ Xv.c:404:31: warning: implicit conversion changes signedness: 'int' to 'size_t' (aka 'unsigned long') [-Wsign-conversion] strncpy(name, u.string, size); ~~~~~~~ ^~~~ Xv.c:433:16: warning: comparison of integers of different signs: 'int' and 'unsigned long' [-Wsign-compare] for (ii=0; ii<pEncodings->num_encodings; ii++, pe++) { ~~^~~~~~~~~~~~~~~~~~~~~~~~~~ Xv.c:886:27: warning: comparison of integers of different signs: 'int' and 'CAR D32' (aka 'unsigned int') [-Wsign-compare] for (i = 0; i < rep.num_attributes; i++) { ~ ^ ~~~~~~~~~~~~~~~~~~ Xv.c:946:27: warning: comparison of integers of different signs: 'int' and 'CAR D32' (aka 'unsigned int') [-Wsign-compare] for (i = 0; i < rep.num_formats; i++) { ~ ^ ~~~~~~~~~~~~~~~ Xv.c:1100:5: warning: comparison of integers of different signs: 'int' and 'unsigned int' [-Wsign-compare] SetReqLen(req, len, len); ^~~~~~~~~~~~~~~~~~~~~~~~ X11/Xlibint.h:530:27: note: expanded from macro 'SetReqLen' if ((req->length + n) > (unsigned)65535) { \ ^ ~~~~~~~~~~~~~~~ Xv.c:1100:20: warning: implicit conversion changes signedness: 'int' to 'unsigned int' [-Wsign-conversion] SetReqLen(req, len, len); ~~~~~~~~~~~~~~~^~~~~~~~~ X11/Xlibint.h:532:21: note: expanded from macro 'SetReqLen' MakeBigReq(req,n) \ ^ X11/Xlibint.h:505:35: note: expanded from macro 'MakeBigReq' ((CARD32 *)req)[1] = _BRlen + n + 2; \ ~ ^ Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-07-05Remove unnecessary casts from Xmalloc callsAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
2013-06-22Adopt X.Org standard code style, with consistent indentationAlan Coopersmith
Having differing indent levels of 2, 3, & 4 spaces hurts my eyes. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-06-22libXv 1.0.9libXv-1.0.9Alan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-06-01Bug 65252: Ensure final name is nil-terminated & none point to uninitialized ↵Daphne Pfister
memory. This patch attempts to fix this bug by ensuring that there is at least one nil byte at the end of all the name strings. This should prevent reading past the end of the allocation as well as exposing uninitialized memory. Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-06-01XvQueryPortAttributes: add a comment explaining memory strategyAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-05-31libXv 1.0.8libXv-1.0.8Alan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-05-07integer overflow in XvCreateImage() [CVE-2013-1989 3/3]Alan Coopersmith
num_planes is a CARD32 and needs to be bounds checked before bit shifting and adding to sizeof(XvImage) to come up with the total size to allocate, to avoid integer overflow leading to underallocation and writing data from the network past the end of the allocated buffer. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-05-07integer overflow in XvListImageFormats() [CVE-2013-1989 2/3]Alan Coopersmith
num_formats is a CARD32 and needs to be bounds checked before multiplying by sizeof(XvImageFormatValues) to come up with the total size to allocate, to avoid integer overflow leading to underallocation and writing data from the network past the end of the allocated buffer. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-05-07buffer overflow in XvQueryPortAttributes() [CVE-2013-2066]Alan Coopersmith
Each attribute returned in the reply includes the number of bytes to read for its marker. We had been always trusting it, and never validating that it wouldn't cause us to write past the end of the buffer we allocated based on the reported text_size. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-04-26integer overflow in XvQueryPortAttributes() [CVE-2013-1989 1/3]Alan Coopersmith
The num_attributes & text_size members of the reply are both CARD32s and need to be bounds checked before multiplying & adding them together to come up with the total size to allocate, to avoid integer overflow leading to underallocation and writing data from the network past the end of the allocated buffer. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-04-13Use _XEatDataWords to avoid overflow of rep.length shiftingAlan Coopersmith
rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2013-01-15autogen.sh: Implement GNOME Build APIColin Walters
http://people.gnome.org/~walters/docs/build-api.txt Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-01-15configure: Remove AM_MAINTAINER_MODEAdam Jackson
Signed-off-by: Adam Jackson <ajax@redhat.com>
2012-08-24Uppercase SH arguments.Thomas Klausner
Signed-off-by: Thomas Klausner <wiz@NetBSD.org> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2012-03-07libXv 1.0.7libXv-1.0.7Alan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-11-10Fix gcc -Wwrite-strings warningsAlan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-10-05XvQueryExtension doesn't return XvBadAllocJeremy Huddleston
https://bugs.freedesktop.org/show_bug.cgi?id=22829 Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
2011-09-16Strip trailing whitespaceAlan Coopersmith
Performed with: find * -type f | xargs perl -i -p -e 's{[ \t]+$}{}' git diff -w & git diff -b show no diffs from this change Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2011-02-02config: comment, minor upgrade, quote and layout configure.acGaetan Nadon
Group statements per section as per Autoconf standard layout Quote statements where appropriate. Autoconf recommends not using dnl instead of # for comments Use AC_CONFIG_FILES to replace the deprecated AC_OUTPUT with parameters. Add AC_CONFIG_SRCDIR([Makefile.am]) Remove redundant AC_SUBST(*_CFLAGS) and/or *_LIBS No functional configuration changes This helps automated maintenance and release activities. Details can be found in http://wiki.x.org/wiki/NewModuleGuidelines
2011-01-28config: replace deprecated AM_CONFIG_HEADER with AC_CONFIG_HEADERSGaetan Nadon
Signed-off-by: Gaetan Nadon <memsize@videotron.ca>
2011-01-27config: remove AC_PROG_CC as it overrides AC_PROG_C_C99Gaetan Nadon
XORG_STRICT_OPTION from XORG_DEFAULT_OPTIONS calls AC_PROG_C_C99. This sets gcc with -std=gnu99. If AC_PROG_CC macro is called afterwards, it resets CC to gcc. Signed-off-by: Gaetan Nadon <memsize@videotron.ca>
2010-10-29libXv 1.0.6libXv-1.0.6Alan Coopersmith
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-21 15:29:15 +0000