Index: dbe/dbe.c

===================================================================

RCS file: /cvs/xorg/xc/programs/Xserver/dbe/dbe.c,v

retrieving revision 1.2

diff -u -u -r1.2 dbe.c

--- xc/programs/Xserver/dbe/dbe.c	23 Apr 2004 19:03:43 -0000	1.2

+++ xc/programs/Xserver/dbe/dbe.c	9 Jan 2007 08:52:29 -0000

@@ -51,6 +51,10 @@

 #include "xf86_ansic.h"

 #endif

+#if !defined(UINT32_MAX)

+#define UINT32_MAX 0xffffffffU

+#endif

+

 /* GLOBALS */

 /* Per-screen initialization functions [init'ed by DbeRegisterFunction()] */

@@ -729,11 +733,14 @@

         return(Success);

     }

+    if (nStuff > UINT32_MAX / sizeof(DbeSwapInfoRec))

+	    return BadAlloc;

+

     /* Get to the swap info appended to the end of the request. */

     dbeSwapInfo = (xDbeSwapInfo *)&stuff[1];

     /* Allocate array to record swap information. */ 

-    swapInfo = (DbeSwapInfoPtr)ALLOCATE_LOCAL(nStuff * sizeof(DbeSwapInfoRec));

+    swapInfo = (DbeSwapInfoPtr)Xalloc(nStuff * sizeof(DbeSwapInfoRec));

     if (swapInfo == NULL)

     {

         return(BadAlloc);

@@ -748,14 +755,14 @@

         if (!(pWin = SecurityLookupWindow(dbeSwapInfo[i].window, client,

 					  SecurityWriteAccess)))

         {

-            DEALLOCATE_LOCAL(swapInfo);

+            Xfree(swapInfo);

 	    return(BadWindow);

         }

         /* Each window must be double-buffered - BadMatch. */

         if (DBE_WINDOW_PRIV(pWin) == NULL)

         {

-            DEALLOCATE_LOCAL(swapInfo);

+            Xfree(swapInfo);

             return(BadMatch);

         }

@@ -764,7 +771,7 @@

         {

             if (dbeSwapInfo[i].window == dbeSwapInfo[j].window)

             {

-                DEALLOCATE_LOCAL(swapInfo);

+                Xfree(swapInfo);

                 return(BadMatch);

 	    }

         }

@@ -775,7 +782,7 @@

             (dbeSwapInfo[i].swapAction != XdbeUntouched ) &&

             (dbeSwapInfo[i].swapAction != XdbeCopied    ))

         {

-            DEALLOCATE_LOCAL(swapInfo);

+            Xfree(swapInfo);

             return(BadValue);

         }

@@ -805,12 +812,12 @@

         error = (*pDbeScreenPriv->SwapBuffers)(client, &nStuff, swapInfo);

         if (error != Success)

         {

-            DEALLOCATE_LOCAL(swapInfo);

+            Xfree(swapInfo);

             return(error);

         }

     }

-    DEALLOCATE_LOCAL(swapInfo);

+    Xfree(swapInfo);

     return(Success);

 } /* ProcDbeSwapBuffers() */

@@ -894,10 +901,12 @@

     REQUEST_AT_LEAST_SIZE(xDbeGetVisualInfoReq);

+    if (stuff->n > UINT32_MAX / sizeof(DrawablePtr))

+	    return BadAlloc;

     /* Make sure any specified drawables are valid. */

     if (stuff->n != 0)

     {

-        if (!(pDrawables = (DrawablePtr *)ALLOCATE_LOCAL(stuff->n *

+        if (!(pDrawables = (DrawablePtr *)Xalloc(stuff->n *

                                                  sizeof(DrawablePtr))))

         {

             return(BadAlloc);

@@ -910,7 +919,7 @@

             if (!(pDrawables[i] = (DrawablePtr)SecurityLookupDrawable(

 				drawables[i], client, SecurityReadAccess)))

             {

-                DEALLOCATE_LOCAL(pDrawables);

+                Xfree(pDrawables);

                 return(BadDrawable);

             }

         }

@@ -922,7 +931,7 @@

     {

         if (pDrawables)

         {

-            DEALLOCATE_LOCAL(pDrawables);

+            Xfree(pDrawables);

         }

         return(BadAlloc);

@@ -949,7 +958,7 @@

             /* Free pDrawables if we needed to allocate it above. */

             if (pDrawables)

             {

-                DEALLOCATE_LOCAL(pDrawables);

+                Xfree(pDrawables);

             }

             return(BadAlloc);

@@ -1030,7 +1039,7 @@

     if (pDrawables)

     {

-        DEALLOCATE_LOCAL(pDrawables);

+        Xfree(pDrawables);

     }

     return(client->noClientException);

Index: render/render.c

===================================================================

RCS file: /cvs/xorg/xc/programs/Xserver/render/render.c,v

retrieving revision 1.5

diff -u -u -r1.5 render.c

--- xc/programs/Xserver/render/render.c	6 Aug 2004 23:42:10 -0000	1.5

+++ xc/programs/Xserver/render/render.c	9 Jan 2007 08:52:30 -0000

@@ -48,6 +48,10 @@

 #include "xf86_ansic.h"

 #endif

+#if !defined(UINT32_MAX)

+#define UINT32_MAX 0xffffffffU

+#endif

+

 static int ProcRenderQueryVersion (ClientPtr pClient);

 static int ProcRenderQueryPictFormats (ClientPtr pClient);

 static int ProcRenderQueryPictIndexValues (ClientPtr pClient);

@@ -1074,11 +1078,14 @@

     }

     nglyphs = stuff->nglyphs;

+    if (nglyphs > UINT32_MAX / sizeof(GlyphNewRec))

+	    return BadAlloc;

+

     if (nglyphs <= NLOCALGLYPH)

 	glyphsBase = glyphsLocal;

     else

     {

-	glyphsBase = (GlyphNewPtr) ALLOCATE_LOCAL (nglyphs * sizeof (GlyphNewRec));

+	glyphsBase = (GlyphNewPtr) Xalloc (nglyphs * sizeof (GlyphNewRec));

 	if (!glyphsBase)

 	    return BadAlloc;

     }

@@ -1135,7 +1142,7 @@

     }

     if (glyphsBase != glyphsLocal)

-	DEALLOCATE_LOCAL (glyphsBase);

+	Xfree (glyphsBase);

     return client->noClientException;

 bail:

     while (glyphs != glyphsBase)

@@ -1144,7 +1151,7 @@

 	xfree (glyphs->glyph);

     }

     if (glyphsBase != glyphsLocal)

-	DEALLOCATE_LOCAL (glyphsBase);

+	Xfree (glyphsBase);

     return err;

 }