Add some patches for vulnerabilities in different X.Org server extensions

(composite, render, record, etc).

6 files changed, 190 insertions, 3 deletions

diff --git a/x11/modular-xorg-server/Makefile b/x11/modular-xorg-server/Makefile
index defa97a58d9..b95a381cc08 100644
--- a/x11/modular-xorg-server/Makefile
+++ b/x11/modular-xorg-server/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.30 2008/06/20 13:34:40 joerg Exp $
+# $NetBSD: Makefile,v 1.31 2008/07/13 12:37:29 tonnerre Exp $
 
 DISTNAME=	xorg-server-1.3.0.0
 PKGNAME=	modular-${DISTNAME}
-PKGREVISION=	9
+PKGREVISION=	10
 CATEGORIES=	x11
 MASTER_SITES=	${MASTER_SITE_XORG:=xserver/}
 EXTRACT_SUFX=	.tar.bz2
diff --git a/x11/modular-xorg-server/distinfo b/x11/modular-xorg-server/distinfo
index 6390c5cf9b1..f59ac143172 100644
--- a/x11/modular-xorg-server/distinfo
+++ b/x11/modular-xorg-server/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.21 2008/06/20 13:34:40 joerg Exp $
+$NetBSD: distinfo,v 1.22 2008/07/13 12:37:29 tonnerre Exp $
 
 SHA1 (MesaLib-6.5.2.tar.bz2) = ba860bb6ee57c02202342dfd5927464a068ea18f
 RMD160 (MesaLib-6.5.2.tar.bz2) = 9a92d69110c066ae6734bcaafb78f222ac2df6d3
@@ -15,6 +15,10 @@ SHA1 (patch-af) = 6c58872798a30b31154dd7b167c84bf20ac417be
 SHA1 (patch-ag) = 222427db3e1bdbf977e992aa91aae5f16992345a
 SHA1 (patch-ah) = 23767542ea672d590050e258317c0352bb321810
 SHA1 (patch-aj) = 7a538538a04ff466595527b7a65a196fc06a625e
+SHA1 (patch-ak) = 82331e3ee5e6e70275e688b215519f76340523d9
+SHA1 (patch-al) = 004ba3b2524e151c8d6bc42f943088a587634c2a
+SHA1 (patch-am) = 9f76dd58bc87e1c4163dc2788cc4d37c1bb7b3b0
+SHA1 (patch-an) = 0482a106f8053a3ccb27ef01d1bb0c9499ff66e5
 SHA1 (patch-db) = 28913a094c8499536a71c8d4d7ca57a5efb25b39
 SHA1 (patch-dc) = 75df6f37b1cbc9574adb5ee66cb84d0f5ebac853
 SHA1 (patch-dd) = cfb7c9d470098b0fcfcddbe9a1363a14f762fe19
diff --git a/x11/modular-xorg-server/patches/patch-ak b/x11/modular-xorg-server/patches/patch-ak
new file mode 100644
index 00000000000..75e28869c03
--- /dev/null
+++ b/x11/modular-xorg-server/patches/patch-ak
@@ -0,0 +1,93 @@
+$NetBSD: patch-ak,v 1.1 2008/07/13 12:37:29 tonnerre Exp $
+
+--- composite/compalloc.c.orig	2007-03-18 01:29:16.000000000 +0100
++++ composite/compalloc.c
+@@ -462,7 +462,6 @@ compNewPixmap (WindowPtr pWin, int x, in
+     ScreenPtr	    pScreen = pWin->drawable.pScreen;
+     WindowPtr	    pParent = pWin->parent;
+     PixmapPtr	    pPixmap;
+-    GCPtr	    pGC;
+ 
+     pPixmap = (*pScreen->CreatePixmap) (pScreen, w, h, pWin->drawable.depth);
+ 
+@@ -472,25 +471,63 @@ compNewPixmap (WindowPtr pWin, int x, in
+     pPixmap->screen_x = x;
+     pPixmap->screen_y = y;
+     
+-    pGC = GetScratchGC (pWin->drawable.depth, pScreen);
+-    
+-    /*
+-     * Copy bits from the parent into the new pixmap so that it will
+-     * have "reasonable" contents in case for background None areas.
+-     */
+-    if (pGC)
++    if (pParent->drawable.depth == pWin->drawable.depth)
+     {
+-	XID val = IncludeInferiors;
++	GCPtr	pGC = GetScratchGC (pWin->drawable.depth, pScreen);
+ 	
+-	ValidateGC(&pPixmap->drawable, pGC);
+-	dixChangeGC (serverClient, pGC, GCSubwindowMode, &val, NULL);
+-	(*pGC->ops->CopyArea) (&pParent->drawable,
+-			       &pPixmap->drawable,
+-			       pGC,
+-			       x - pParent->drawable.x,
+-			       y - pParent->drawable.y,
+-			       w, h, 0, 0);
+-	FreeScratchGC (pGC);
++	/*
++	 * Copy bits from the parent into the new pixmap so that it will
++	 * have "reasonable" contents in case for background None areas.
++	 */
++	if (pGC)
++	{
++	    XID val = IncludeInferiors;
++	    
++	    ValidateGC(&pPixmap->drawable, pGC);
++	    dixChangeGC (serverClient, pGC, GCSubwindowMode, &val, NULL);
++	    (*pGC->ops->CopyArea) (&pParent->drawable,
++				   &pPixmap->drawable,
++				   pGC,
++				   x - pParent->drawable.x,
++				   y - pParent->drawable.y,
++				   w, h, 0, 0);
++	    FreeScratchGC (pGC);
++	}
++    }
++    else
++    {
++	PictFormatPtr	pSrcFormat = compWindowFormat (pParent);
++	PictFormatPtr	pDstFormat = compWindowFormat (pWin);
++	XID		inferiors = IncludeInferiors;
++	int		error;
++
++	PicturePtr	pSrcPicture = CreatePicture (None,
++						     &pParent->drawable,
++						     pSrcFormat,
++						     CPSubwindowMode,
++						     &inferiors,
++						     serverClient, &error);
++						    
++	PicturePtr	pDstPicture = CreatePicture (None,
++						     &pPixmap->drawable,
++						     pDstFormat,
++						     0, 0,
++						     serverClient, &error);
++
++	if (pSrcPicture && pDstPicture)
++	{
++	    CompositePicture (PictOpSrc,
++			      pSrcPicture,
++			      NULL,
++			      pDstPicture,
++			      x - pParent->drawable.x,
++			      y - pParent->drawable.y,
++			      0, 0, 0, 0, w, h);
++	}
++	if (pSrcPicture)
++	    FreePicture (pSrcPicture, 0);
++	if (pDstPicture)
++	    FreePicture (pDstPicture, 0);
+     }
+     return pPixmap;
+ }
diff --git a/x11/modular-xorg-server/patches/patch-al b/x11/modular-xorg-server/patches/patch-al
new file mode 100644
index 00000000000..27a6d89fa2a
--- /dev/null
+++ b/x11/modular-xorg-server/patches/patch-al
@@ -0,0 +1,14 @@
+$NetBSD: patch-al,v 1.1 2008/07/13 12:37:29 tonnerre Exp $
+
+--- composite/compint.h.orig	2007-03-16 19:13:57.000000000 +0100
++++ composite/compint.h
+@@ -237,6 +237,9 @@ compCheckTree (ScreenPtr pScreen);
+ #define compCheckTree(s)
+ #endif
+ 
++PictFormatPtr
++compWindowFormat (WindowPtr pWin);
++
+ void
+ compSetPixmap (WindowPtr pWin, PixmapPtr pPixmap);
+ 
diff --git a/x11/modular-xorg-server/patches/patch-am b/x11/modular-xorg-server/patches/patch-am
new file mode 100644
index 00000000000..12906cd4e1e
--- /dev/null
+++ b/x11/modular-xorg-server/patches/patch-am
@@ -0,0 +1,13 @@
+$NetBSD: patch-am,v 1.1 2008/07/13 12:37:29 tonnerre Exp $
+
+--- composite/compwindow.c.orig	2007-03-18 01:29:16.000000000 +0100
++++ composite/compwindow.c
+@@ -686,7 +686,7 @@ compGetWindowVisual (WindowPtr pWin)
+     return 0;
+ }
+ 
+-static PictFormatPtr
++PictFormatPtr
+ compWindowFormat (WindowPtr pWin)
+ {
+     ScreenPtr	pScreen = pWin->drawable.pScreen;
diff --git a/x11/modular-xorg-server/patches/patch-an b/x11/modular-xorg-server/patches/patch-an
new file mode 100644
index 00000000000..3ed3b6bc418
--- /dev/null
+++ b/x11/modular-xorg-server/patches/patch-an
@@ -0,0 +1,63 @@
+$NetBSD: patch-an,v 1.1 2008/07/13 12:37:29 tonnerre Exp $
+
+--- work/xorg-server-1.3.0.0/render/render.c.orig	2008-07-13 14:29:02.000000000 +0200
++++ work/xorg-server-1.3.0.0/render/render.c
+@@ -1917,6 +1917,8 @@ static int ProcRenderCreateLinearGradien
+     LEGAL_NEW_RESOURCE(stuff->pid, client);
+ 
+     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
++    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
++	return BadLength;
+     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
+         return BadLength;
+ 
+@@ -2488,18 +2490,18 @@ SProcRenderCreateSolidFill(ClientPtr cli
+     return (*ProcRenderVector[stuff->renderReqType]) (client);
+ }
+ 
+-static void swapStops(void *stuff, int n)
++static void swapStops(void *stuff, int num)
+ {
+-    int i;
++    int i, n;
+     CARD32 *stops;
+     CARD16 *colors;
+     stops = (CARD32 *)(stuff);
+-    for (i = 0; i < n; ++i) {
++    for (i = 0; i < num; ++i) {
+         swapl(stops, n);
+         ++stops;
+     }
+     colors = (CARD16 *)(stops);
+-    for (i = 0; i < 4*n; ++i) {
++    for (i = 0; i < 4*num; ++i) {
+         swaps(stops, n);
+         ++stops;
+     }
+@@ -2522,6 +2524,8 @@ SProcRenderCreateLinearGradient (ClientP
+     swapl(&stuff->nStops, n);
+ 
+     len = (client->req_len << 2) - sizeof(xRenderCreateLinearGradientReq);
++    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
++	return BadLength;
+     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
+         return BadLength;
+ 
+@@ -2549,6 +2553,8 @@ SProcRenderCreateRadialGradient (ClientP
+     swapl(&stuff->nStops, n);
+ 
+     len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
++    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
++	return BadLength;
+     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
+         return BadLength;
+ 
+@@ -2573,6 +2579,8 @@ SProcRenderCreateConicalGradient (Client
+     swapl(&stuff->nStops, n);
+ 
+     len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
++    if (stuff->nStops > UINT32_MAX/(sizeof(xFixed) + sizeof(xRenderColor)))
++	return BadLength;
+     if (len != stuff->nStops*(sizeof(xFixed) + sizeof(xRenderColor)))
+         return BadLength;
+