Commit message: None
CVE: CVE-2016-7953
CWE: CWE-119
Vulnerability description: Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.

Project: libXvMC

XvImageFormatValues * XvMCListSubpictureTypes (
  Display * dpy,
  XvPortID port,
  int surface_type_id,
  int *count_return
)
{
    XExtDisplayInfo *info = xvmc_find_display(dpy);
    xvmcListSubpictureTypesReply rep;
    xvmcListSubpictureTypesReq  *req;
    XvImageFormatValues *ret = NULL;


    *count_return = 0;

    XvMCCheckExtension (dpy, info, NULL);


    LockDisplay (dpy);
    XvMCGetReq (ListSubpictureTypes, req);
    req->port = port;
    req->surface_type_id = surface_type_id;
    if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
        UnlockDisplay (dpy);
        SyncHandle ();
        return NULL;
    }

    if(rep.num > 0) {
        if (rep.num < (INT_MAX / sizeof(XvImageFormatValues)))
            ret = Xmalloc(rep.num * sizeof(XvImageFormatValues));

        if(ret) {
            xvImageFormatInfo Info;
            int i;

            *count_return = rep.num;

            for(i = 0; i < rep.num; i++) {
              _XRead(dpy, (char*)(&Info), sz_xvImageFormatInfo);
              ret[i].id = Info.id;
              ret[i].type = Info.type;
              ret[i].byte_order = Info.byte_order;
              memcpy(&(ret[i].guid[0]), &(Info.guid[0]), 16);
              ret[i].bits_per_pixel = Info.bpp;
              ret[i].format = Info.format;
              ret[i].num_planes = Info.num_planes;
              ret[i].depth = Info.depth;
              ret[i].red_mask = Info.red_mask;
              ret[i].green_mask = Info.green_mask;
              ret[i].blue_mask = Info.blue_mask;
              ret[i].y_sample_bits = Info.y_sample_bits;
              ret[i].u_sample_bits = Info.u_sample_bits;
              ret[i].v_sample_bits = Info.v_sample_bits;
              ret[i].horz_y_period = Info.horz_y_period;
              ret[i].horz_u_period = Info.horz_u_period;
              ret[i].horz_v_period = Info.horz_v_period;
              ret[i].vert_y_period = Info.vert_y_period;
              ret[i].vert_u_period = Info.vert_u_period;
              ret[i].vert_v_period = Info.vert_v_period;
              memcpy(&(ret[i].component_order[0]), &(Info.comp_order[0]), 32);
              ret[i].scanline_order = Info.scanline_order;
            }
        } else
	   _XEatDataWords(dpy, rep.length);
    }

    UnlockDisplay (dpy);
    SyncHandle ();
    return ret;
}

Project: libXvMC

Bool XvMCQueryExtension (Display *dpy, int *event_basep, int *error_basep)
{
    XExtDisplayInfo *info = xvmc_find_display(dpy);

    if (XextHasExtension(info)) {
        *event_basep = info->codes->first_event;
        *error_basep = info->codes->first_error;
        return True;
    } else {
        return False;
    }
}

Project: libXvMC

Status XvMCQueryVersion (Display *dpy, int *major, int *minor)
{
    XExtDisplayInfo *info = xvmc_find_display(dpy);
    xvmcQueryVersionReply rep;
    xvmcQueryVersionReq  *req;

    XvMCCheckExtension (dpy, info, BadImplementation);

    LockDisplay (dpy);
    XvMCGetReq (QueryVersion, req);
    if (!_XReply (dpy, (xReply *) &rep, 0, xTrue)) {
        UnlockDisplay (dpy);
        SyncHandle ();
        return BadImplementation;
    }
    *major = rep.major;
    *minor = rep.minor;
    UnlockDisplay (dpy);
    SyncHandle ();
    return Success;
}

Project: libXvMC

Status _xvmc_create_surface (
    Display *dpy,
    XvMCContext *context,
    XvMCSurface *surface,
    int *priv_count,
    CARD32 **priv_data
)
{
    XExtDisplayInfo *info = xvmc_find_display(dpy);
    xvmcCreateSurfaceReply rep;
    xvmcCreateSurfaceReq  *req;

    *priv_count = 0;
    *priv_data = NULL;

    XvMCCheckExtension (dpy, info, BadImplementation);

    LockDisplay (dpy);
    XvMCGetReq (CreateSurface, req);

    surface->surface_id = XAllocID(dpy);
    surface->context_id = context->context_id;
    surface->surface_type_id = context->surface_type_id;
    surface->width = context->width;
    surface->height = context->height;

    req->surface_id = surface->surface_id;
    req->context_id = surface->context_id;
    if (!_XReply (dpy, (xReply *) &rep, 0, xFalse)) {
        UnlockDisplay (dpy);
        SyncHandle ();
        return BadImplementation;
    }

    if(rep.length) {
        if (rep.length < (INT_MAX >> 2))
            *priv_data = Xmalloc(rep.length << 2);
        if(*priv_data) {
            _XRead(dpy, (char*)(*priv_data), rep.length << 2);
            *priv_count = rep.length;
        } else
            _XEatDataWords(dpy, rep.length);
    }

    UnlockDisplay (dpy);
    SyncHandle ();
    return Success;
}

Project: libXvMC

Status _xvmc_destroy_context (
    Display *dpy,
    XvMCContext *context
)
{
    XExtDisplayInfo *info = xvmc_find_display(dpy);
    xvmcDestroyContextReq  *req;

    XvMCCheckExtension (dpy, info, BadImplementation);

    LockDisplay (dpy);
    XvMCGetReq (DestroyContext, req);
    req->context_id = context->context_id;
    UnlockDisplay (dpy);
    SyncHandle ();
    return Success;
}

Project: libXvMC

Status _xvmc_destroy_subpicture(
    Display *dpy,
    XvMCSubpicture *subpicture
)
{
    XExtDisplayInfo *info = xvmc_find_display(dpy);
    xvmcDestroySubpictureReq  *req;

    XvMCCheckExtension (dpy, info, BadImplementation);

    LockDisplay (dpy);
    XvMCGetReq (DestroySubpicture, req);
    req->subpicture_id = subpicture->subpicture_id;
    UnlockDisplay (dpy);
    SyncHandle ();
    return Success;
}

Project: libXvMC

Status _xvmc_destroy_surface (
    Display *dpy,
    XvMCSurface *surface
)
{
    XExtDisplayInfo *info = xvmc_find_display(dpy);
    xvmcDestroySurfaceReq  *req;

    XvMCCheckExtension (dpy, info, BadImplementation);

    LockDisplay (dpy);
    XvMCGetReq (DestroySurface, req);
    req->surface_id = surface->surface_id;
    UnlockDisplay (dpy);
    SyncHandle ();
    return Success;
}