--- xorg-server-1.1.1/Xext/sampleEVI.c.cve-2007-6429	2006-07-05 14:31:36.000000000 -0400

+++ xorg-server-1.1.1/Xext/sampleEVI.c	2008-01-18 14:15:44.000000000 -0500

@@ -36,6 +36,13 @@

 #include <X11/extensions/XEVIstr.h>

 #include "EVIstruct.h"

 #include "scrnintstr.h"

+

+#if HAVE_STDINT_H

+#include <stdint.h>

+#elif !defined(INT_MAX)

+#define INT_MAX 0x7fffffff

+#endif

+

 static int sampleGetVisualInfo(

     VisualID32 *visual,

     int n_visual,

@@ -44,24 +51,36 @@

     VisualID32 **conflict_rn,

     int *n_conflict_rn)

 {

-    int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;

+    unsigned int max_sz_evi;

     VisualID32 *temp_conflict;

     xExtendedVisualInfo *evi;

-    int max_visuals = 0, max_sz_conflict, sz_conflict = 0;

+    unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;

     register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;

-    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);

-    if (!*evi_rn)

-         return BadAlloc;

+

+    if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))

+	return BadAlloc;

+    max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;

+    

     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

         if (screenInfo.screens[scrI]->numVisuals > max_visuals)

             max_visuals = screenInfo.screens[scrI]->numVisuals;

     }

+

+    if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens 

+			       * max_visuals)) 

+	return BadAlloc;

     max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;

+

+    *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);

+    if (!*evi_rn)

+         return BadAlloc;

+

     temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);

     if (!temp_conflict) {

         xfree(*evi_rn);

         return BadAlloc;

     }

+

     for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {

         for (visualI = 0; visualI < n_visual; visualI++) {

 	    evi[sz_evi].core_visual_id = visual[visualI];

--- xorg-server-1.1.1/Xext/EVI.c.cve-2007-6429	2006-07-05 14:31:36.000000000 -0400

+++ xorg-server-1.1.1/Xext/EVI.c	2008-01-18 14:15:44.000000000 -0500

@@ -36,6 +36,7 @@

 #include <X11/extensions/XEVIstr.h>

 #include "EVIstruct.h"

 #include "modinit.h"

+#include "scrnintstr.h"

 #if 0

 static unsigned char XEVIReqCode = 0;

@@ -89,10 +90,22 @@

 {

     REQUEST(xEVIGetVisualInfoReq);

     xEVIGetVisualInfoReply rep;

-    int n, n_conflict, n_info, sz_info, sz_conflict;

+    int i, n, n_conflict, n_info, sz_info, sz_conflict;

     VisualID32 *conflict;

+    unsigned int total_visuals = 0;

     xExtendedVisualInfo *eviInfo;

     int status;

+

+    /*

+     * do this first, otherwise REQUEST_FIXED_SIZE can overflow.  we assume

+     * here that you don't have more than 2^32 visuals over all your screens;

+     * this seems like a safe assumption.

+     */

+    for (i = 0; i < screenInfo.numScreens; i++)

+	total_visuals += screenInfo.screens[i]->numVisuals;

+    if (stuff->n_visual > total_visuals)

+	return BadValue;

+

     REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);

     status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,

 		&eviInfo, &n_info, &conflict, &n_conflict);

--- xorg-server-1.1.1/Xext/shm.c.cve-2007-6429	2006-07-05 14:31:36.000000000 -0400

+++ xorg-server-1.1.1/Xext/shm.c	2008-01-18 14:19:28.000000000 -0500

@@ -725,6 +725,8 @@

     int i, j, result;

     ShmDescPtr shmdesc;

     REQUEST(xShmCreatePixmapReq);

+    unsigned int width, height, depth;

+    unsigned long size;

     PanoramiXRes *newPix;

     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

@@ -734,11 +736,18 @@

     LEGAL_NEW_RESOURCE(stuff->pid, client);

     VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);

     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

-    if (!stuff->width || !stuff->height)

+

+    width = stuff->width;

+    height = stuff->height;

+    depth = stuff->depth;

+    if (!width || !height || !depth)

     {

 	client->errorValue = 0;

         return BadValue;

     }

+    if (width > 32767 || height > 32767)

+        return BadAlloc;

+

     if (stuff->depth != 1)

     {

         pDepth = pDraw->pScreen->allowedDepths;

@@ -748,10 +757,19 @@

 	client->errorValue = stuff->depth;

         return BadValue;

     }

+

 CreatePmap:

-    VERIFY_SHMSIZE(shmdesc, stuff->offset,

-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,

-		   client);

+    /* now w/h/d are valid; but will they overflow a 32-bit pointer? */

+    size = PixmapBytePad(width, depth) * height;

+    if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {

+        if (size < width * height)

+            return BadAlloc;

+        /* thankfully, offset is unsigned */

+        if (stuff->offset + size < size)

+            return BadAlloc;

+    }

+

+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);

     if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))

 	return BadAlloc;

@@ -1049,6 +1067,8 @@

     register int i;

     ShmDescPtr shmdesc;

     REQUEST(xShmCreatePixmapReq);

+    unsigned int width, height, depth;

+    unsigned long size;

     REQUEST_SIZE_MATCH(xShmCreatePixmapReq);

     client->errorValue = stuff->pid;

@@ -1057,11 +1077,18 @@

     LEGAL_NEW_RESOURCE(stuff->pid, client);

     VERIFY_GEOMETRABLE(pDraw, stuff->drawable, client);

     VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);

-    if (!stuff->width || !stuff->height)

+    

+    width = stuff->width;

+    height = stuff->height;

+    depth = stuff->depth;

+    if (!width || !height || !depth)

     {

 	client->errorValue = 0;

         return BadValue;

     }

+    if (width > 32767 || height > 32767)

+	return BadAlloc;

+

     if (stuff->depth != 1)

     {

         pDepth = pDraw->pScreen->allowedDepths;

@@ -1071,10 +1098,19 @@

 	client->errorValue = stuff->depth;

         return BadValue;

     }

+

 CreatePmap:

-    VERIFY_SHMSIZE(shmdesc, stuff->offset,

-		   PixmapBytePad(stuff->width, stuff->depth) * stuff->height,

-		   client);

+    /* now w/h/d are valid; but will they overflow a 32-bit pointer? */

+    size = PixmapBytePad(width, depth) * height;

+    if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {

+        if (size < width * height)

+            return BadAlloc;

+        /* thankfully, offset is unsigned */

+        if (stuff->offset + size < size)

+            return BadAlloc;

+    }

+

+    VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);

     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(

 			    pDraw->pScreen, stuff->width,

 			    stuff->height, stuff->depth,