hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-14 05:14:45 +00:00
Code Issues Projects Releases Wiki Activity

xfree86: vidmode: zero gamma ramp reply padding

Browse source 
ProcVidModeGetGammaRamp reserves length = (size + 1) & ~1 entries per channel
but GetGammaRamp() only fills stuff->size entries. When size is odd, the last
CARD16 of each of the three channels was left uninitialized and sent to the
client. The buffer used the non-zeroing x_rpcbuf_reserve().

Use x_rpcbuf_reserve0() for the ramp buffer.

Fixes: 0bf7d613d5 ("xf86vidmode: ProcVidModeSetGammaRamp(): use x_rpcbuf_t")
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult 2026-06-12 09:51:07 +02:00 • committed by Enrico Weigelt
commit d5fe1ff412
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hw/xfree86/xext/vidmode.c
View file

@ -1679,7 +1679,7 @@ ProcVidModeGetGammaRamp(ClientPtr client)
if (stuff->size) {
size_t ramplen = length * 3 * sizeof(CARD16);
CARD16 *ramp = x_rpcbuf_reserve(&rpcbuf, ramplen);
CARD16 *ramp = x_rpcbuf_reserve0(&rpcbuf, ramplen);
if (!ramp)
return BadAlloc;