Xdmx: integer overflow in GetGLXVisualConfigs()

numVisuals & numProps are both CARD32 and need to be bounds checked before
multiplying by structure sizes to come up with the total size to allocate,
to avoid integer overflow leading to underallocation and writing data from
the network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xdmx: integer overflow in GetGLXFBConfigs()

numFBConfigs & numAttribs are CARD32s and need to be bounds checked before
multiplying by structure sizes to come up with the total size to allocate,
to avoid integer overflow leading to underallocation and writing data from
the network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xephyr: integer overflow in ephyrHostGLXGetStringFromServer()

reply.length & reply.size are CARD32s and need to be bounds checked before
multiplying or adding to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xephyr: integer overflow in XF86DRIOpenConnection()

busIdStringLength is a CARD32 and needs to be bounds checked before adding
one to it to come up with the total size to allocate, to avoid integer
overflow leading to underallocation and writing data from the network past
the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Xephyr: integer overflow in XF86DRIGetClientDriverName()

clientDriverNameLength is a CARD32 and needs to be bounds checked before
adding one to it to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
glxproxy: Use _XReadPad instead of _XEatData to clean up the slop

Xlib already provides a function to eat padding bytes after the
data read, so use it instead of calculating it ourselves.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
glxproxy: Use _XEatDataWords (from Xlib 1.6) instead of _XEatData

Reduces risk of overflow from converting length field in X replies
from words to bytes.   (Also seems to be what several calls were
already incorrectly passing to _XEatData.)

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xephyr: Use _XEatDataWords (from Xlib 1.6) instead of _XEatData

Simplifies code and reduces risk of overflow from converting length
field in X replies from words to bytes.

One call to _XEatData is left in ephyrHostGLXGetStringFromServer where
it's already been checked for overflow, and other values have been
subtracted from it to reduce the size of data remaining to be eaten.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Fix typo in header guard.

Signed-off-by: Thomas Klausner <wiz@NetBSD.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Merge remote-tracking branch 'alanc/master'