Commit message: None
CVE: CVE-2016-7944
CWE: CWE-190
Vulnerability description: Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.

Project: libXfixes

XFixesCopyRegion (Display *dpy, XserverRegion dst, XserverRegion src)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesCopyRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesCopyRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesCopyRegion;
    req->source = src;
    req->destination = dst;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesCreateRegionFromGC (Display *dpy, GC gc)
{
    XFixesExtDisplayInfo		*info = XFixesFindDisplay (dpy);
    xXFixesCreateRegionFromGCReq	*req;
    XserverRegion			region;

    XFixesCheckExtension (dpy, info, 0);
    LockDisplay (dpy);
    GetReq (XFixesCreateRegionFromGC, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesCreateRegionFromGC;
    region = req->region = XAllocID (dpy);
    req->gc = gc->gid;
    UnlockDisplay (dpy);
    SyncHandle();
    return region;
}

Project: libXfixes

XFixesCreateRegionFromWindow (Display *dpy, Window window, int kind)
{
    XFixesExtDisplayInfo		*info = XFixesFindDisplay (dpy);
    xXFixesCreateRegionFromWindowReq	*req;
    XserverRegion			region;

    XFixesCheckExtension (dpy, info, 0);
    LockDisplay (dpy);
    GetReq (XFixesCreateRegionFromWindow, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesCreateRegionFromWindow;
    region = req->region = XAllocID (dpy);
    req->window = window;
    req->kind = kind;
    UnlockDisplay (dpy);
    SyncHandle();
    return region;
}

Project: libXfixes

XFixesDestroyRegion (Display *dpy, XserverRegion region)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesDestroyRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesDestroyRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesDestroyRegion;
    req->region = region;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesExpandRegion (Display *dpy, XserverRegion dst, XserverRegion src,
		    unsigned left, unsigned right,
		    unsigned top, unsigned bottom)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesExpandRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesExpandRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesExpandRegion;
    req->source = src;
    req->destination = dst;
    req->left = left;
    req->right = right;
    req->top = top;
    req->bottom = bottom;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesFetchRegion (Display *dpy, XserverRegion region, int *nrectanglesRet)
{
    XRectangle	bounds;

    return XFixesFetchRegionAndBounds (dpy, region, nrectanglesRet, &bounds);
}

Project: libXfixes

XFixesIntersectRegion (Display *dpy, XserverRegion dst,
		       XserverRegion src1, XserverRegion src2)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesIntersectRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesIntersectRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesIntersectRegion;
    req->source1 = src1;
    req->source2 = src2;
    req->destination = dst;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesInvertRegion (Display *dpy, XserverRegion dst,
		    XRectangle *rect, XserverRegion src)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesInvertRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesInvertRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesInvertRegion;
    req->x = rect->x;
    req->y = rect->y;
    req->width = rect->width;
    req->height = rect->height;
    req->source = src;
    req->destination = dst;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesRegionExtents (Display *dpy, XserverRegion dst, XserverRegion src)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesRegionExtentsReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesRegionExtents, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesRegionExtents;
    req->source = src;
    req->destination = dst;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesSetGCClipRegion (Display *dpy, GC gc,
		       int clip_x_origin, int clip_y_origin,
		       XserverRegion region)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesSetGCClipRegionReq	    *req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesSetGCClipRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesSetGCClipRegion;
    req->gc = gc->gid;
    req->region = region;
    req->xOrigin = clip_x_origin;
    req->yOrigin = clip_y_origin;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesSetPictureClipRegion (Display *dpy, XID picture,
			    int clip_x_origin, int clip_y_origin,
			    XserverRegion region)
{
    XFixesExtDisplayInfo	    *info = XFixesFindDisplay (dpy);
    xXFixesSetPictureClipRegionReq  *req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesSetPictureClipRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesSetPictureClipRegion;
    req->picture = picture;
    req->region = region;
    req->xOrigin = clip_x_origin;
    req->yOrigin = clip_y_origin;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesSetRegion (Display *dpy, XserverRegion region,
		 XRectangle *rectangles, int nrectangles)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesSetRegionReq		*req;
    long    			len;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesSetRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesSetRegion;
    req->region = region;
    len = ((long) nrectangles) << 1;
    SetReqLen (req, len, len);
    len <<= 2;
    Data16 (dpy, (short *) rectangles, len);
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesSetWindowShapeRegion (Display *dpy, Window win, int shape_kind,
			    int x_off, int y_off, XserverRegion region)
{
    XFixesExtDisplayInfo	    *info = XFixesFindDisplay (dpy);
    xXFixesSetWindowShapeRegionReq  *req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesSetWindowShapeRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesSetWindowShapeRegion;
    req->dest = win;
    req->destKind = shape_kind;
    req->xOff = x_off;
    req->yOff = y_off;
    req->region = region;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesSubtractRegion (Display *dpy, XserverRegion dst,
		      XserverRegion src1, XserverRegion src2)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesSubtractRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesSubtractRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesSubtractRegion;
    req->source1 = src1;
    req->source2 = src2;
    req->destination = dst;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesTranslateRegion (Display *dpy, XserverRegion region, int dx, int dy)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesTranslateRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesTranslateRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesTranslateRegion;
    req->region = region;
    req->dx = dx;
    req->dy = dy;
    UnlockDisplay (dpy);
    SyncHandle();
}

Project: libXfixes

XFixesUnionRegion (Display *dpy, XserverRegion dst,
		   XserverRegion src1, XserverRegion src2)
{
    XFixesExtDisplayInfo	*info = XFixesFindDisplay (dpy);
    xXFixesUnionRegionReq	*req;

    XFixesSimpleCheckExtension (dpy, info);
    LockDisplay (dpy);
    GetReq (XFixesUnionRegion, req);
    req->reqType = info->codes->major_opcode;
    req->xfixesReqType = X_XFixesUnionRegion;
    req->source1 = src1;
    req->source2 = src2;
    req->destination = dst;
    UnlockDisplay (dpy);
    SyncHandle();
}