present: Support PresentOptionCopy

We added this option to the present protocol before 1.0 but somehow
never implemented it in the server. It's pretty simple; just don't
ever do flips if the application specifies Copy.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 2051514652481a83bd7cf22e57cb0fcd40333f33)
Signed-off-by: Julien Cristau <jcristau@debian.org>
present: Avoid crashes in DebugPresent(), a bit more info.

DebugPresent() crashed the server when a dri3 drawable
was closed while a pageflipped present was still pending,
due to vblank->window-> Null-Ptr deref, so debug builds
caused new problems to debug.

E.g.,

glXSwapBuffers(...);
glXDestroyWindow(...);
-> Pageflip for non-existent window completes -> boom.

Also often happens when switching desktop compositor on/off
due to Present unflips, or when logging out of session.

Also add info if a Present is queued for copyswap or pageflip,
if the present is vsynced, and the serial no of the Present
request, to aid debugging of pageflip and vsync issues. The
serial number is useful as Mesa's dri3/present backend encodes
its sendSBC in the serial number, so one can easily correlate
server debug output with Mesa and with the SBC values returned
to actual OpenGL client applications via OML_sync_control and
INTEL_swap_events extension, makes debugging quite a bit more
easy.

Please also cherry-pick this for a 1.16.x stable update.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 32d3100bd78efe41d468f7d66861296aee468b6f)
Signed-off-by: Julien Cristau <jcristau@debian.org>
present: Fix use of vsynced pageflips and honor PresentOptionAsync. (v4)

Pageflips for Pixmap presents were not synchronized to vblank on
drivers with support for PresentCapabilityAsync, due to some
missing init for vblank->sync_flips. The PresentOptionAsync
flag was completely ignored for pageflipped presents.

Vsynced flips only worked by accident on the intel-ddx, as that
driver doesn't have PresentCapabilityAsync support.

On nouveau-ddx, which supports PresentCapabilityAsync, this
always caused non-vsynced pageflips with pretty ugly tearing.

This patch fixes the problem, as tested on top of XOrg 1.16.2
on nouveau and intel.

v4: Add additional PresentCapabilityAsync caps check, as
suggested by Eric Anholt.

Please also apply to XOrg 1.17 and XOrg 1.16.2 stable.

Applying on top of XOrg 1.16.2 requires cherry-picking
commit 2051514652481a83bd7cf22e57cb0fcd40333f33
which trivially fixes lack of support for protocol option
PresentOptionCopy - get two bug fixes for the price of one!

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit aae6460694ac3667abb8c34fdf3a7dae524827a4)
Signed-off-by: Julien Cristau <jcristau@debian.org>
glx: check return from __glXGetAnswerBuffer

This function can return NULL; make sure every caller tests for that.

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit 61a292adf45405641de1c522a04c148e0a152acd)
Signed-off-by: Julien Cristau <jcristau@debian.org>
unchecked malloc may allow unauthed client to crash Xserver [CVE-2014-8091]

authdes_ezdecode() calls malloc() using a length provided by the
connection handshake sent by a newly connected client in order
to authenticate to the server, so should be treated as untrusted.

It didn't check if malloc() failed before writing to the newly
allocated buffer, so could lead to a server crash if the server
fails to allocate memory (up to UINT16_MAX bytes, since the len
field is a CARD16 in the X protocol).

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 90cc925c5991fcb203f72d00b04419cd754a9b2c)
Signed-off-by: Julien Cristau <jcristau@debian.org>
dix: integer overflow in ProcPutImage() [CVE-2014-8092 1/4]

ProcPutImage() calculates a length field from a width, left pad and depth
specified by the client (if the specified format is XYPixmap).

The calculations for the total amount of memory the server needs for the
pixmap can overflow a 32-bit number, causing out-of-bounds memory writes
on 32-bit systems (since the length is stored in a long int variable).

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit eeae42d60bf3d5663ea088581f6c28a82cd17829)
Signed-off-by: Julien Cristau <jcristau@debian.org>
dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]

GetHosts() iterates over all the hosts it has in memory, and copies
them to a buffer. The buffer length is calculated by iterating over
all the hosts and adding up all of their combined length. There is a
potential integer overflow, if there are lots and lots of hosts (with
a combined length of > ~4 gig). This should be possible by repeatedly
calling ProcChangeHosts() on 64bit machines with enough memory.

This patch caps the list at 1mb, because multi-megabyte hostname
lists for X access control are insane.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit bc8e20430b6f6378daf6ce4329029248a88af08b)
Signed-off-by: Julien Cristau <jcristau@debian.org>
dix: integer overflow in RegionSizeof() [CVE-2014-8092 3/4]

RegionSizeof contains several integer overflows if a large length
value is passed in.  Once we fix it to return 0 on overflow, we
also have to fix the callers to handle this error condition

v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
(cherry picked from commit 97015a07b9e15d8ec5608b95d95ec0eb51202acb)
Signed-off-by: Julien Cristau <jcristau@debian.org>
dix: integer overflow in REQUEST_FIXED_SIZE() [CVE-2014-8092 4/4]

Force use of 64-bit integers when evaluating data provided by clients
in 32-bit fields which can overflow when added or multiplied during
checks.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit e0e11644622a589129a01e11e5d105dc74a098de)
Signed-off-by: Julien Cristau <jcristau@debian.org>
dri2: integer overflow in ProcDRI2GetBuffers() [CVE-2014-8094]

ProcDRI2GetBuffers() tries to validate a length field (count).
There is an integer overflow in the validation. This can cause
out of bound reads and memory corruption later on.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
(cherry picked from commit 6692670fde081bbfe9313f17d84037ae9116702a)
Signed-off-by: Julien Cristau <jcristau@debian.org>
dbe: unvalidated lengths in DbeSwapBuffers calls [CVE-2014-8097]

ProcDbeSwapBuffers() has a 32bit (n) length value that it uses to read
from a buffer. The length is never validated, which can lead to out of
bound reads, and possibly returning the data read from out of bounds to
the misbehaving client via an X Error packet.

SProcDbeSwapBuffers() swaps data (for correct endianness) before
handing it off to the real proc.  While doing the swapping, the
length field is not validated, which can cause memory corruption.

v2: reorder checks to avoid compilers optimizing out checks for overflow
that happen after we'd already have done the overflowing multiplications.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 2ef42519c41e793579c9cea699c866fee3d9321f)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Xi: unvalidated lengths in Xinput extension [CVE-2014-8095]

Multiple functions in the Xinput extension handling of requests from
clients failed to check that the length of the request sent by the
client was large enough to perform all the required operations and
thus could read or write to memory outside the bounds of the request
buffer.

This commit includes the creation of a new REQUEST_AT_LEAST_EXTRA_SIZE
macro in include/dix.h for the common case of needing to ensure a
request is large enough to include both the request itself and a
minimum amount of extra data following the request header.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 73c63afb93c0af1bfd1969bf6e71c9edca586c77)
Signed-off-by: Julien Cristau <jcristau@debian.org>
xcmisc: unvalidated length in SProcXCMiscGetXIDList() [CVE-2014-8096]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 7553082b9b883b5f130044f3d53bce2f0b660e52)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Xv: unvalidated lengths in XVideo extension swapped procs [CVE-2014-8099]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 32a95fb7c7dbe22c9441c62762dfa4a8ec54d6c3)
Signed-off-by: Julien Cristau <jcristau@debian.org>
dri3: unvalidated lengths in DRI3 extension swapped procs [CVE-2014-8103 1/2]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 0a6085aaf3581cca558d960ea176ddf3a41a2213)
Signed-off-by: Julien Cristau <jcristau@debian.org>
present: unvalidated lengths in Present extension procs [CVE-2014-8103 2/2]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>
(cherry picked from commit d155b7a8e38e74aee96bf52c20c8b6a330d7d462)
Signed-off-by: Julien Cristau <jcristau@debian.org>
randr: unvalidated lengths in RandR extension swapped procs [CVE-2014-8101]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 3df2fcf12499ebdb26b9b67419ea485a42041f33)
Signed-off-by: Julien Cristau <jcristau@debian.org>
render: check request size before reading it [CVE-2014-8100 1/2]

Otherwise we may be reading outside of the client request.

Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit b5f9ef03df6a650571b29d3d1c1d2b67c6e84336)
Signed-off-by: Julien Cristau <jcristau@debian.org>
render: unvalidated lengths in Render extn. swapped procs [CVE-2014-8100 2/2]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 5d3a788aeb2fbd3ca2812747dc18c94a8b981c63)
Signed-off-by: Julien Cristau <jcristau@debian.org>
xfixes: unvalidated length in SProcXFixesSelectSelectionInput [CVE-2014-8102]

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit a0ece23a8bd300c8be10812d368dc8058c97c63e)
Signed-off-by: Julien Cristau <jcristau@debian.org>