Xdmx: integer overflow in GetGLXVisualConfigs()

numVisuals & numProps are both CARD32 and need to be bounds checked before
multiplying by structure sizes to come up with the total size to allocate,
to avoid integer overflow leading to underallocation and writing data from
the network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xdmx: integer overflow in GetGLXFBConfigs()

numFBConfigs & numAttribs are CARD32s and need to be bounds checked before
multiplying by structure sizes to come up with the total size to allocate,
to avoid integer overflow leading to underallocation and writing data from
the network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xephyr: integer overflow in ephyrHostGLXGetStringFromServer()

reply.length & reply.size are CARD32s and need to be bounds checked before
multiplying or adding to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xephyr: integer overflow in XF86DRIOpenConnection()

busIdStringLength is a CARD32 and needs to be bounds checked before adding
one to it to come up with the total size to allocate, to avoid integer
overflow leading to underallocation and writing data from the network past
the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Xephyr: integer overflow in XF86DRIGetClientDriverName()

clientDriverNameLength is a CARD32 and needs to be bounds checked before
adding one to it to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
glxproxy: Use _XReadPad instead of _XEatData to clean up the slop

Xlib already provides a function to eat padding bytes after the
data read, so use it instead of calculating it ourselves.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
glxproxy: Use _XEatDataWords (from Xlib 1.6) instead of _XEatData

Reduces risk of overflow from converting length field in X replies
from words to bytes.   (Also seems to be what several calls were
already incorrectly passing to _XEatData.)

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Xephyr: Use _XEatDataWords (from Xlib 1.6) instead of _XEatData

Simplifies code and reduces risk of overflow from converting length
field in X replies from words to bytes.

One call to _XEatData is left in ephyrHostGLXGetStringFromServer where
it's already been checked for overflow, and other values have been
subtracted from it to reduce the size of data remaining to be eaten.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Fix typo in header guard.

Signed-off-by: Thomas Klausner <wiz@NetBSD.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
dix: scale y back instead of x up when pre-scaling coordinates

The peculiar way we handle coordinates results in relative coordinates on
absolute devices being added to the last value, then that value is mapped to
the screen (taking the device dimensions into account). From that mapped
value we get the final coordinates, both screen and device coordinates.

To avoid uneven scaling on relative coordinates, they are pre-scaled by
screen ratio:resolution:device ratio factor before being mapped. This
ensures that a circle drawn on the device is a circle on the screen.

Previously, we used the ratio to scale x up. Synaptics already does its own
scaling based on the resolution and that is done by scaling y down by the
ratio. So we can remove the code from the driver and get approximately the
same behaviour here.

Minor ABI bump, so we can remove this from synaptics.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Emmanuel Benisty <benisty.e@gmail.com>
Merge remote-tracking branch 'alanc/master'
Allow DDX to provide a main()

XQuartz already conditionally renames main() as dix_main() so it can provide
it's own main().  This isn't the ideal way of doing this, as it prevents libdix
built this way from being useful with any other DDX.

So instead, always name that function dix_main(), and also provide a stub main()
which just calls dix_main(), which can be overriden in the DDX.

Add a main() to XWin (XQuartz already has one, of course).

It's no longer neccessary to link XWin and XQuartz with libmain.

v2: Remove unneeded stub main hw/xwin/InitOutput.c

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Improve WM_ENDSESSION handling using separate messaging window thread

Currently, WM_ENDSESSION just calls GiveUp() to set the DE_TERMINATE flag. But
for the X server to exit cleanly, we also need the X server dispatch loop to be
unblocked so it can notice that DE_TERMINATE has been set and exit, removing
it's lock file and any unix domain socket.

It appears that the system will terminate the process when the last UI thread in
that process returns from processing WM_ENDSESSION for the last top-level
window.

Since WM_ENDSESSION appears to sent by the system via SendMessage()
(synchronously) and the wndproc is called to process it in the message thread
for that window (the X server thread), we can't easily terminate the X server
dispatch loop from inside the WM_ENDSESSION message processing.

So, create a messaging window, a hidden, top-level window, with a separate
thread to catch this message, and process it by calling GiveUp() and then
blocking on a mutex until the X server dispatch loop exits.

Also, notice when this is a shutdown cancel WM_ENDSESSION message and take no
action.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: _NET_WM_STATE is ATOM[] not ATOM

_NET_WM_STATE is ATOM[] not ATOM, a list of window state hints, so check all of
the atoms, not just the first one

See EWMH specifcation, section "Application Window Properties"

v2: Actually use [] on the returned atom data

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Remove an extra '\n' from some log messages

Remove an extra '\n' from internal client IOError log messages

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Consider left and right modifier keys independently on gaining focus

Handle left and right ctrl and shift keys independently

Assume that all modifiers are cleared when all keys are released on focus lost,
as internalKeyState doesn't record which modifier key was pressed.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Change winTranslateKey() to return it's result as it's return value

Change winTranslateKey() to return it's result as it's return value, and change
it's uses as well.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Remove unneeded WM_XBUTTON message defines

Remove unneeded WM_XBUTTON message defines, they have been provided by w32api
for a long time now.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Map extra mouse buttons 1 and 2 to X buttons 8 and 9

Map extra mouse buttons 1 and 2 to X buttons 8 and 9, as conventional, leaving X
buttons 6 and 7 for tilt wheel.

Also add button labels for buttons 6, 7, 8 and 9 and change btn_labels in from a
dynamic allocation to a fixed one of the required size for all the labels we
use.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Handle WM_MOUSEHWHEEL

Handle WM_MOUSEHWHEEL tilt wheel messages, similarly to WM_MOUSEWHEEL scroll
wheel messages, to generate X button 6 and 7 presses and releases.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>