xorg-server/patches/xorg-server-1.2.0-xcmisc.patch

diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c
index f26218e..8c7a86e 100644
--- a/Xext/xcmisc.c
+++ b/Xext/xcmisc.c
@@ -42,6 +42,12 @@ #include "swaprep.h"
 #include <X11/extensions/xcmiscstr.h>
 #include "modinit.h"
 
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
 #if 0
 static unsigned char XCMiscCode;
 #endif
@@ -143,7 +149,10 @@ ProcXCMiscGetXIDList(client)
 
     REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
 
-    pids = (XID *)ALLOCATE_LOCAL(stuff->count * sizeof(XID));
+    if (stuff->count > UINT32_MAX / sizeof(XID))
+	    return BadAlloc;
+
+    pids = (XID *)Xalloc(stuff->count * sizeof(XID));
     if (!pids)
     {
 	return BadAlloc;
@@ -164,7 +173,7 @@ ProcXCMiscGetXIDList(client)
     	client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
 	WriteSwappedDataToClient(client, count * sizeof(XID), pids);
     }
-    DEALLOCATE_LOCAL(pids);
+    Xfree(pids);
     return(client->noClientException);
 }
 
1	diff --git a/Xext/xcmisc.c b/Xext/xcmisc.c
2	index f26218e..8c7a86e 100644
3	--- a/Xext/xcmisc.c
4	+++ b/Xext/xcmisc.c
5	@@ -42,6 +42,12 @@ #include "swaprep.h"
6	#include <X11/extensions/xcmiscstr.h>
7	#include "modinit.h"
8
9	+#if HAVE_STDINT_H
10	+#include <stdint.h>
11	+#elif !defined(UINT32_MAX)
12	+#define UINT32_MAX 0xffffffffU
13	+#endif
14	+
15	#if 0
16	static unsigned char XCMiscCode;
17	#endif
18	@@ -143,7 +149,10 @@ ProcXCMiscGetXIDList(client)
19
20	REQUEST_SIZE_MATCH(xXCMiscGetXIDListReq);
21
22	- pids = (XID )ALLOCATE_LOCAL(stuff->count sizeof(XID));
23	+ if (stuff->count > UINT32_MAX / sizeof(XID))
24	+ return BadAlloc;
25	+
26	+ pids = (XID )Xalloc(stuff->count sizeof(XID));
27	if (!pids)
28	{
29	return BadAlloc;
30	@@ -164,7 +173,7 @@ ProcXCMiscGetXIDList(client)
31	client->pSwapReplyFunc = (ReplySwapPtr) Swap32Write;
32	WriteSwappedDataToClient(client, count * sizeof(XID), pids);
33	}
34	- DEALLOCATE_LOCAL(pids);
35	+ Xfree(pids);
36	return(client->noClientException);
37	}
38