static int ProcXvGetStill(ClientPtr client) { DrawablePtr pDraw; XvPortPtr pPort; GCPtr pGC; int status; REQUEST(xvGetStillReq); REQUEST_SIZE_MATCH(xvGetStillReq); VALIDATE_DRAWABLE_AND_GC(stuff->drawable, pDraw, DixReadAccess); if(!(pPort = LOOKUP_PORT(stuff->port, client) )) { client->errorValue = stuff->port; return (_XvBadPort); } if ((status = _AllocatePort(stuff->port, pPort)) != Success) { client->errorValue = stuff->port; return (status); } if (!(pPort->pAdaptor->type & XvOutputMask) || !(pPort->pAdaptor->type & XvStillMask)) { client->errorValue = stuff->port; return (BadMatch); } status = XVCALL(diMatchPort)(pPort, pDraw); if (status != Success) { return status; } return XVCALL(diGetStill)(client, pDraw, pPort, pGC, stuff->vid_x, stuff->vid_y, stuff->vid_w, stuff->vid_h, stuff->drw_x, stuff->drw_y, stuff->drw_w, stuff->drw_h); }
static int ProcXvGetVideo(ClientPtr client) { DrawablePtr pDraw; XvPortPtr pPort; GCPtr pGC; int status; REQUEST(xvGetVideoReq); REQUEST_SIZE_MATCH(xvGetVideoReq); VALIDATE_DRAWABLE_AND_GC(stuff->drawable, pDraw, DixReadAccess); VALIDATE_XV_PORT(stuff->port, pPort, DixReadAccess); if ((status = _AllocatePort(stuff->port, pPort)) != Success) { client->errorValue = stuff->port; return status; } if (!(pPort->pAdaptor->type & XvOutputMask) || !(pPort->pAdaptor->type & XvVideoMask)) { client->errorValue = stuff->port; return BadMatch; } status = XvdiMatchPort(pPort, pDraw); if (status != Success) { return status; } return XvdiGetVideo(client, pDraw, pPort, pGC, stuff->vid_x, stuff->vid_y, stuff->vid_w, stuff->vid_h, stuff->drw_x, stuff->drw_y, stuff->drw_w, stuff->drw_h); }
static int ProcShmPutImage(ClientPtr client) { GCPtr pGC; DrawablePtr pDraw; long length; ShmDescPtr shmdesc; REQUEST(xShmPutImageReq); REQUEST_SIZE_MATCH(xShmPutImageReq); VALIDATE_DRAWABLE_AND_GC(stuff->drawable, pDraw, DixWriteAccess); VERIFY_SHMPTR(stuff->shmseg, stuff->offset, FALSE, shmdesc, client); if ((stuff->sendEvent != xTrue) && (stuff->sendEvent != xFalse)) return BadValue; if (stuff->format == XYBitmap) { if (stuff->depth != 1) return BadMatch; length = PixmapBytePad(stuff->totalWidth, 1); } else if (stuff->format == XYPixmap) { if (pDraw->depth != stuff->depth) return BadMatch; length = PixmapBytePad(stuff->totalWidth, 1); length *= stuff->depth; } else if (stuff->format == ZPixmap) { if (pDraw->depth != stuff->depth) return BadMatch; length = PixmapBytePad(stuff->totalWidth, stuff->depth); } else { client->errorValue = stuff->format; return BadValue; } /* * There's a potential integer overflow in this check: * VERIFY_SHMSIZE(shmdesc, stuff->offset, length * stuff->totalHeight, * client); * the version below ought to avoid it */ if (stuff->totalHeight != 0 && length > (shmdesc->size - stuff->offset)/stuff->totalHeight) { client->errorValue = stuff->totalWidth; return BadValue; } if (stuff->srcX > stuff->totalWidth) { client->errorValue = stuff->srcX; return BadValue; } if (stuff->srcY > stuff->totalHeight) { client->errorValue = stuff->srcY; return BadValue; } if ((stuff->srcX + stuff->srcWidth) > stuff->totalWidth) { client->errorValue = stuff->srcWidth; return BadValue; } if ((stuff->srcY + stuff->srcHeight) > stuff->totalHeight) { client->errorValue = stuff->srcHeight; return BadValue; } if ((((stuff->format == ZPixmap) && (stuff->srcX == 0)) || ((stuff->format != ZPixmap) && (stuff->srcX < screenInfo.bitmapScanlinePad) && ((stuff->format == XYBitmap) || ((stuff->srcY == 0) && (stuff->srcHeight == stuff->totalHeight))))) && ((stuff->srcX + stuff->srcWidth) == stuff->totalWidth)) (*pGC->ops->PutImage) (pDraw, pGC, stuff->depth, stuff->dstX, stuff->dstY, stuff->totalWidth, stuff->srcHeight, stuff->srcX, stuff->format, shmdesc->addr + stuff->offset + (stuff->srcY * length)); else doShmPutImage(pDraw, pGC, stuff->depth, stuff->format, stuff->totalWidth, stuff->totalHeight, stuff->srcX, stuff->srcY, stuff->srcWidth, stuff->srcHeight, stuff->dstX, stuff->dstY, shmdesc->addr + stuff->offset); if (stuff->sendEvent) { xShmCompletionEvent ev; ev.type = ShmCompletionCode; ev.drawable = stuff->drawable; ev.minorEvent = X_ShmPutImage; ev.majorEvent = ShmReqCode; ev.shmseg = stuff->shmseg; ev.offset = stuff->offset; WriteEventsToClient(client, 1, (xEvent *) &ev); } return Success; }
static int ProcXvPutImage(ClientPtr client) { DrawablePtr pDraw; XvPortPtr pPort; XvImagePtr pImage = NULL; GCPtr pGC; int status, i, size; CARD16 width, height; REQUEST(xvPutImageReq); REQUEST_AT_LEAST_SIZE(xvPutImageReq); VALIDATE_DRAWABLE_AND_GC(stuff->drawable, pDraw, DixWriteAccess); VALIDATE_XV_PORT(stuff->port, pPort, DixReadAccess); if ((status = _AllocatePort(stuff->port, pPort)) != Success) { client->errorValue = stuff->port; return status; } if (!(pPort->pAdaptor->type & XvImageMask) || !(pPort->pAdaptor->type & XvInputMask)) { client->errorValue = stuff->port; return BadMatch; } status = XvdiMatchPort(pPort, pDraw); if (status != Success) { return status; } for(i = 0; i < pPort->pAdaptor->nImages; i++) { if(pPort->pAdaptor->pImages[i].id == stuff->id) { pImage = &(pPort->pAdaptor->pImages[i]); break; } } if(!pImage) return BadMatch; width = stuff->width; height = stuff->height; size = (*pPort->pAdaptor->ddQueryImageAttributes)(client, pPort, pImage, &width, &height, NULL, NULL); size += sizeof(xvPutImageReq); size = bytes_to_int32(size); if((width < stuff->width) || (height < stuff->height)) return BadValue; if(client->req_len < size) return BadLength; return XvdiPutImage(client, pDraw, pPort, pGC, stuff->src_x, stuff->src_y, stuff->src_w, stuff->src_h, stuff->drw_x, stuff->drw_y, stuff->drw_w, stuff->drw_h, pImage, (unsigned char*)(&stuff[1]), FALSE, stuff->width, stuff->height); }
static int ProcXvShmPutImage(ClientPtr client) { ShmDescPtr shmdesc; DrawablePtr pDraw; XvPortPtr pPort; XvImagePtr pImage = NULL; GCPtr pGC; int status, size_needed, i; CARD16 width, height; REQUEST(xvShmPutImageReq); REQUEST_SIZE_MATCH(xvShmPutImageReq); VALIDATE_DRAWABLE_AND_GC(stuff->drawable, pDraw, DixWriteAccess); VALIDATE_XV_PORT(stuff->port, pPort, DixReadAccess); if ((status = _AllocatePort(stuff->port, pPort)) != Success) { client->errorValue = stuff->port; return status; } if (!(pPort->pAdaptor->type & XvImageMask) || !(pPort->pAdaptor->type & XvInputMask)) { client->errorValue = stuff->port; return BadMatch; } status = XvdiMatchPort(pPort, pDraw); if (status != Success) { return status; } for(i = 0; i < pPort->pAdaptor->nImages; i++) { if(pPort->pAdaptor->pImages[i].id == stuff->id) { pImage = &(pPort->pAdaptor->pImages[i]); break; } } if(!pImage) return BadMatch; status = dixLookupResourceByType((pointer *)&shmdesc, stuff->shmseg, ShmSegType, serverClient, DixReadAccess); if (status != Success) return status; width = stuff->width; height = stuff->height; size_needed = (*pPort->pAdaptor->ddQueryImageAttributes)(client, pPort, pImage, &width, &height, NULL, NULL); if((size_needed + stuff->offset) > shmdesc->size) return BadAccess; if((width < stuff->width) || (height < stuff->height)) return BadValue; status = XvdiPutImage(client, pDraw, pPort, pGC, stuff->src_x, stuff->src_y, stuff->src_w, stuff->src_h, stuff->drw_x, stuff->drw_y, stuff->drw_w, stuff->drw_h, pImage, (unsigned char *)shmdesc->addr + stuff->offset, stuff->send_event, stuff->width, stuff->height); if((status == Success) && stuff->send_event) { xShmCompletionEvent ev; ev.type = ShmCompletionCode; ev.drawable = stuff->drawable; ev.minorEvent = xv_ShmPutImage; ev.majorEvent = XvReqCode; ev.shmseg = stuff->shmseg; ev.offset = stuff->offset; WriteEventsToClient(client, 1, (xEvent *) &ev); } return status; }