Blame SOURCES/0033-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch

0fd959
From 58b89d38df58b11d8492af605b571b4232761220 Mon Sep 17 00:00:00 2001
0fd959
From: Adam Jackson <ajax@redhat.com>
0fd959
Date: Mon, 10 Nov 2014 12:13:48 -0500
0fd959
Subject: [PATCH 33/33] glx: Pass remaining request length into ->varsize (v2)
0fd959
 [CVE-2014-8098 8/8]
0fd959
0fd959
v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau)
0fd959
0fd959
Reviewed-by: Julien Cristau <jcristau@debian.org>
0fd959
Reviewed-by: Michal Srb <msrb@suse.com>
0fd959
Reviewed-by: Andy Ritger <aritger@nvidia.com>
0fd959
Signed-off-by: Adam Jackson <ajax@redhat.com>
0fd959
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
0fd959
Signed-off-by: Fedora X Ninjas <x@fedoraproject.org>
0fd959
---
0fd959
 glx/glxcmds.c          |   7 +-
0fd959
 glx/glxserver.h        |   2 +-
0fd959
 glx/indirect_reqsize.c | 142 +++++++++++++++++++-------------------
0fd959
 glx/indirect_reqsize.h | 181 ++++++++++++++++++++++++++++++-------------------
0fd959
 glx/rensize.c          |  27 +++++---
0fd959
 5 files changed, 205 insertions(+), 154 deletions(-)
0fd959
0fd959
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
0fd959
index 317e113..e3bff67 100644
0fd959
--- a/glx/glxcmds.c
0fd959
+++ b/glx/glxcmds.c
0fd959
@@ -2057,7 +2057,8 @@ __glXDisp_Render(__GLXclientState * cl, GLbyte * pc)
0fd959
         if (entry.varsize) {
0fd959
             /* variable size command */
0fd959
             extra = (*entry.varsize) (pc + __GLX_RENDER_HDR_SIZE,
0fd959
-                                      client->swapped);
0fd959
+                                      client->swapped,
0fd959
+                                      left - __GLX_RENDER_HDR_SIZE);
0fd959
             if (extra < 0) {
0fd959
                 return BadLength;
0fd959
             }
0fd959
@@ -2134,6 +2135,7 @@ __glXDisp_RenderLarge(__GLXclientState * cl, GLbyte * pc)
0fd959
     if (cl->largeCmdRequestsSoFar == 0) {
0fd959
         __GLXrenderSizeData entry;
0fd959
         int extra = 0;
0fd959
+        int left = (req->length << 2) - sz_xGLXRenderLargeReq;
0fd959
         size_t cmdlen;
0fd959
         int err;
0fd959
 
0fd959
@@ -2174,7 +2176,8 @@ __glXDisp_RenderLarge(__GLXclientState * cl, GLbyte * pc)
0fd959
              ** will be in the 1st request, so it's okay to do this.
0fd959
              */
0fd959
             extra = (*entry.varsize) (pc + __GLX_RENDER_LARGE_HDR_SIZE,
0fd959
-                                      client->swapped);
0fd959
+                                      client->swapped,
0fd959
+                                      left - __GLX_RENDER_LARGE_HDR_SIZE);
0fd959
             if (extra < 0) {
0fd959
                 return BadLength;
0fd959
             }
0fd959
diff --git a/glx/glxserver.h b/glx/glxserver.h
0fd959
index 14c5dda..0083721 100644
0fd959
--- a/glx/glxserver.h
0fd959
+++ b/glx/glxserver.h
0fd959
@@ -179,7 +179,7 @@ typedef int (*__GLXprocPtr) (__GLXclientState *, char *pc);
0fd959
 /*
0fd959
  * Tables for computing the size of each rendering command.
0fd959
  */
0fd959
-typedef int (*gl_proto_size_func) (const GLbyte *, Bool);
0fd959
+typedef int (*gl_proto_size_func) (const GLbyte *, Bool, int);
0fd959
 
0fd959
 typedef struct {
0fd959
     int bytes;
0fd959
diff --git a/glx/indirect_reqsize.c b/glx/indirect_reqsize.c
0fd959
index 026afb6..092a421 100644
0fd959
--- a/glx/indirect_reqsize.c
0fd959
+++ b/glx/indirect_reqsize.c
0fd959
@@ -31,24 +31,22 @@
0fd959
 #include "indirect_size.h"
0fd959
 #include "indirect_reqsize.h"
0fd959
 
0fd959
-#define __GLX_PAD(x)  (((x) + 3) & ~3)
0fd959
-
0fd959
 #if defined(__CYGWIN__) || defined(__MINGW32__)
0fd959
 #undef HAVE_ALIAS
0fd959
 #endif
0fd959
 #ifdef HAVE_ALIAS
0fd959
 #define ALIAS2(from,to) \
0fd959
-    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
0fd959
+    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
0fd959
         __attribute__ ((alias( # to )));
0fd959
 #define ALIAS(from,to) ALIAS2( from, __glX ## to ## ReqSize )
0fd959
 #else
0fd959
 #define ALIAS(from,to) \
0fd959
-    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap ) \
0fd959
-    { return __glX ## to ## ReqSize( pc, swap ); }
0fd959
+    GLint __glX ## from ## ReqSize( const GLbyte * pc, Bool swap, int reqlen ) \
0fd959
+    { return __glX ## to ## ReqSize( pc, swap, reqlen ); }
0fd959
 #endif
0fd959
 
0fd959
 int
0fd959
-__glXCallListsReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXCallListsReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 0);
0fd959
     GLenum type = *(GLenum *) (pc + 4);
0fd959
@@ -60,11 +58,11 @@ __glXCallListsReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glCallLists_size(type);
0fd959
-    return __GLX_PAD((compsize * n));
0fd959
+    return safe_pad(safe_mul(compsize, n));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXBitmapReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXBitmapReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -88,7 +86,7 @@ __glXBitmapReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXFogfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXFogfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 0);
0fd959
     GLsizei compsize;
0fd959
@@ -98,11 +96,11 @@ __glXFogfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glFogfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXLightfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXLightfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -112,11 +110,11 @@ __glXLightfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glLightfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXLightModelfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXLightModelfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 0);
0fd959
     GLsizei compsize;
0fd959
@@ -126,11 +124,11 @@ __glXLightModelfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glLightModelfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXMaterialfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXMaterialfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -140,11 +138,11 @@ __glXMaterialfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glMaterialfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXPolygonStippleReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -164,7 +162,7 @@ __glXPolygonStippleReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -174,11 +172,11 @@ __glXTexParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glTexParameterfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexImage1DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -206,7 +204,7 @@ __glXTexImage1DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexImage2DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -236,7 +234,7 @@ __glXTexImage2DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexEnvfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -246,11 +244,11 @@ __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glTexEnvfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexGendvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexGendvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -260,11 +258,11 @@ __glXTexGendvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glTexGendv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 8));
0fd959
+    return safe_pad(safe_mul(compsize, 8));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexGenfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexGenfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -274,11 +272,11 @@ __glXTexGenfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glTexGenfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXPixelMapfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei mapsize = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -286,11 +284,11 @@ __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap)
0fd959
         mapsize = bswap_32(mapsize);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((mapsize * 4));
0fd959
+    return safe_pad(safe_mul(mapsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXPixelMapusvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei mapsize = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -298,11 +296,11 @@ __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap)
0fd959
         mapsize = bswap_32(mapsize);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((mapsize * 2));
0fd959
+    return safe_pad(safe_mul(mapsize, 2));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXDrawPixelsReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -330,7 +328,7 @@ __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 0);
0fd959
 
0fd959
@@ -338,11 +336,11 @@ __glXPrioritizeTexturesReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 4) + (n * 4));
0fd959
+    return safe_pad(safe_add(safe_mul(n, 4), safe_mul(n, 4)));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -370,7 +368,7 @@ __glXTexSubImage1DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -400,7 +398,7 @@ __glXTexSubImage2DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXColorTableReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXColorTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -428,7 +426,7 @@ __glXColorTableReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -438,11 +436,11 @@ __glXColorTableParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glColorTableParameterfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXColorSubTableReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXColorSubTableReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -470,7 +468,7 @@ __glXColorSubTableReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -498,7 +496,7 @@ __glXConvolutionFilter1DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = 0;
0fd959
@@ -528,7 +526,7 @@ __glXConvolutionFilter2DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 4);
0fd959
     GLsizei compsize;
0fd959
@@ -538,11 +536,11 @@ __glXConvolutionParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glConvolutionParameterfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = *(GLint *) (pc + 8);
0fd959
@@ -579,7 +577,7 @@ __glXTexImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLint row_length = *(GLint *) (pc + 4);
0fd959
     GLint image_height = *(GLint *) (pc + 8);
0fd959
@@ -613,7 +611,7 @@ __glXTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXCompressedTexImage1DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXCompressedTexImage1DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei imageSize = *(GLsizei *) (pc + 20);
0fd959
 
0fd959
@@ -621,11 +619,11 @@ __glXCompressedTexImage1DReqSize(const GLbyte * pc, Bool swap)
0fd959
         imageSize = bswap_32(imageSize);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD(imageSize);
0fd959
+    return safe_pad(imageSize);
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXCompressedTexImage2DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXCompressedTexImage2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei imageSize = *(GLsizei *) (pc + 24);
0fd959
 
0fd959
@@ -633,11 +631,11 @@ __glXCompressedTexImage2DReqSize(const GLbyte * pc, Bool swap)
0fd959
         imageSize = bswap_32(imageSize);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD(imageSize);
0fd959
+    return safe_pad(imageSize);
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXCompressedTexImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXCompressedTexImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei imageSize = *(GLsizei *) (pc + 28);
0fd959
 
0fd959
@@ -645,11 +643,11 @@ __glXCompressedTexImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
         imageSize = bswap_32(imageSize);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD(imageSize);
0fd959
+    return safe_pad(imageSize);
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXCompressedTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXCompressedTexSubImage3DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei imageSize = *(GLsizei *) (pc + 36);
0fd959
 
0fd959
@@ -657,11 +655,11 @@ __glXCompressedTexSubImage3DReqSize(const GLbyte * pc, Bool swap)
0fd959
         imageSize = bswap_32(imageSize);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD(imageSize);
0fd959
+    return safe_pad(imageSize);
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXPointParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXPointParameterfvReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum pname = *(GLenum *) (pc + 0);
0fd959
     GLsizei compsize;
0fd959
@@ -671,11 +669,11 @@ __glXPointParameterfvReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     compsize = __glPointParameterfv_size(pname);
0fd959
-    return __GLX_PAD((compsize * 4));
0fd959
+    return safe_pad(safe_mul(compsize, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXDrawBuffersReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXDrawBuffersReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 0);
0fd959
 
0fd959
@@ -683,11 +681,11 @@ __glXDrawBuffersReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 4));
0fd959
+    return safe_pad(safe_mul(n, 4));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXProgramStringARBReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei len = *(GLsizei *) (pc + 8);
0fd959
 
0fd959
@@ -695,11 +693,11 @@ __glXProgramStringARBReqSize(const GLbyte * pc, Bool swap)
0fd959
         len = bswap_32(len);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD(len);
0fd959
+    return safe_pad(len);
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -707,11 +705,11 @@ __glXVertexAttribs1dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 8));
0fd959
+    return safe_pad(safe_mul(n, 8));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -719,11 +717,11 @@ __glXVertexAttribs2dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 16));
0fd959
+    return safe_pad(safe_mul(n, 16));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -731,11 +729,11 @@ __glXVertexAttribs3dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 24));
0fd959
+    return safe_pad(safe_mul(n, 24));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -743,11 +741,11 @@ __glXVertexAttribs3fvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 12));
0fd959
+    return safe_pad(safe_mul(n, 12));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -755,11 +753,11 @@ __glXVertexAttribs3svNVReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 6));
0fd959
+    return safe_pad(safe_mul(n, 6));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLsizei n = *(GLsizei *) (pc + 4);
0fd959
 
0fd959
@@ -767,7 +765,7 @@ __glXVertexAttribs4dvNVReqSize(const GLbyte * pc, Bool swap)
0fd959
         n = bswap_32(n);
0fd959
     }
0fd959
 
0fd959
-    return __GLX_PAD((n * 32));
0fd959
+    return safe_pad(safe_mul(n, 32));
0fd959
 }
0fd959
 
0fd959
 ALIAS(Fogiv, Fogfv)
0fd959
diff --git a/glx/indirect_reqsize.h b/glx/indirect_reqsize.h
0fd959
index 43e1e69..f0d8893 100644
0fd959
--- a/glx/indirect_reqsize.h
0fd959
+++ b/glx/indirect_reqsize.h
0fd959
@@ -36,115 +36,156 @@
0fd959
 #define PURE
0fd959
 #endif
0fd959
 
0fd959
-extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc,
0fd959
-                                                   Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc,
0fd959
-                                                   Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap);
0fd959
+extern PURE _X_HIDDEN int __glXCallListsReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXBitmapReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                             int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXFogfvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                            int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXFogivReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                            int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXLightfvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                              int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXLightivReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                              int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXLightModelfvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                   int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXLightModelivReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                   int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXMaterialfvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXMaterialivReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXPolygonStippleReqSize(const GLbyte * pc,
0fd959
-                                                     Bool swap);
0fd959
+                                                     Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXTexParameterfvReqSize(const GLbyte * pc,
0fd959
-                                                     Bool swap);
0fd959
+                                                     Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXTexParameterivReqSize(const GLbyte * pc,
0fd959
-                                                     Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap);
0fd959
+                                                     Bool swap, int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexImage1DReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexImage2DReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexEnvfvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                               int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexEnvivReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                               int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexGendvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                               int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexGenfvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                               int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexGenivReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                               int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXMap1dReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                            int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXMap1fReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                            int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXMap2dReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                            int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXMap2fReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                            int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXPixelMapfvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXPixelMapuivReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                  int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXPixelMapusvReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                  int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXDrawPixelsReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXDrawArraysReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXPrioritizeTexturesReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXTexSubImage1DReqSize(const GLbyte * pc,
0fd959
-                                                    Bool swap);
0fd959
+                                                    Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXTexSubImage2DReqSize(const GLbyte * pc,
0fd959
-                                                    Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap);
0fd959
+                                                    Bool swap, int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXColorTableReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXColorTableParameterfvReqSize(const GLbyte * pc,
0fd959
-                                                            Bool swap);
0fd959
+                                                            Bool swap,
0fd959
+                                                            int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXColorTableParameterivReqSize(const GLbyte * pc,
0fd959
-                                                            Bool swap);
0fd959
+                                                            Bool swap,
0fd959
+                                                            int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXColorSubTableReqSize(const GLbyte * pc,
0fd959
-                                                    Bool swap);
0fd959
+                                                    Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXConvolutionFilter1DReqSize(const GLbyte * pc,
0fd959
-                                                          Bool swap);
0fd959
+                                                          Bool swap,
0fd959
+                                                          int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXConvolutionFilter2DReqSize(const GLbyte * pc,
0fd959
-                                                          Bool swap);
0fd959
+                                                          Bool swap,
0fd959
+                                                          int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXConvolutionParameterfvReqSize(const GLbyte * pc,
0fd959
-                                                             Bool swap);
0fd959
+                                                             Bool swap,
0fd959
+                                                             int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXConvolutionParameterivReqSize(const GLbyte * pc,
0fd959
-                                                             Bool swap);
0fd959
+                                                             Bool swap,
0fd959
+                                                             int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXSeparableFilter2DReqSize(const GLbyte * pc,
0fd959
-                                                        Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap);
0fd959
+                                                        Bool swap, int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXTexImage3DReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                 int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXTexSubImage3DReqSize(const GLbyte * pc,
0fd959
-                                                    Bool swap);
0fd959
+                                                    Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXCompressedTexImage1DReqSize(const GLbyte * pc,
0fd959
-                                                           Bool swap);
0fd959
+                                                           Bool swap,
0fd959
+                                                           int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXCompressedTexImage2DReqSize(const GLbyte * pc,
0fd959
-                                                           Bool swap);
0fd959
+                                                           Bool swap,
0fd959
+                                                           int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXCompressedTexImage3DReqSize(const GLbyte * pc,
0fd959
-                                                           Bool swap);
0fd959
+                                                           Bool swap,
0fd959
+                                                           int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXCompressedTexSubImage1DReqSize(const GLbyte * pc,
0fd959
-                                                              Bool swap);
0fd959
+                                                              Bool swap,
0fd959
+                                                              int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXCompressedTexSubImage2DReqSize(const GLbyte * pc,
0fd959
-                                                              Bool swap);
0fd959
+                                                              Bool swap,
0fd959
+                                                              int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXCompressedTexSubImage3DReqSize(const GLbyte * pc,
0fd959
-                                                              Bool swap);
0fd959
+                                                              Bool swap,
0fd959
+                                                              int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXPointParameterfvReqSize(const GLbyte * pc,
0fd959
-                                                       Bool swap);
0fd959
+                                                       Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXPointParameterivReqSize(const GLbyte * pc,
0fd959
-                                                       Bool swap);
0fd959
-extern PURE _X_HIDDEN int __glXDrawBuffersReqSize(const GLbyte * pc, Bool swap);
0fd959
+                                                       Bool swap, int reqlen);
0fd959
+extern PURE _X_HIDDEN int __glXDrawBuffersReqSize(const GLbyte * pc, Bool swap,
0fd959
+                                                  int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXProgramStringARBReqSize(const GLbyte * pc,
0fd959
-                                                       Bool swap);
0fd959
+                                                       Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXDeleteFramebuffersReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXDeleteRenderbuffersReqSize(const GLbyte * pc,
0fd959
-                                                          Bool swap);
0fd959
+                                                          Bool swap,
0fd959
+                                                          int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs1dvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs1fvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs1svNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs2dvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs2fvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs2svNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs3dvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs3fvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs3svNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs4dvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs4fvNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs4svNVReqSize(const GLbyte * pc,
0fd959
-                                                         Bool swap);
0fd959
+                                                         Bool swap, int reqlen);
0fd959
 extern PURE _X_HIDDEN int __glXVertexAttribs4ubvNVReqSize(const GLbyte * pc,
0fd959
-                                                          Bool swap);
0fd959
+                                                          Bool swap,
0fd959
+                                                          int reqlen);
0fd959
 
0fd959
 #undef PURE
0fd959
 
0fd959
diff --git a/glx/rensize.c b/glx/rensize.c
0fd959
index 6ee0f9c..a532467 100644
0fd959
--- a/glx/rensize.c
0fd959
+++ b/glx/rensize.c
0fd959
@@ -44,7 +44,7 @@
0fd959
    ((a & 0xff00U)<<8) | ((a & 0xffU)<<24))
0fd959
 
0fd959
 int
0fd959
-__glXMap1dReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXMap1dReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum target;
0fd959
     GLint order;
0fd959
@@ -61,7 +61,7 @@ __glXMap1dReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXMap1fReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXMap1fReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum target;
0fd959
     GLint order;
0fd959
@@ -86,7 +86,7 @@ Map2Size(int k, int majorOrder, int minorOrder)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXMap2dReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXMap2dReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum target;
0fd959
     GLint uorder, vorder;
0fd959
@@ -103,7 +103,7 @@ __glXMap2dReqSize(const GLbyte * pc, Bool swap)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXMap2fReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXMap2fReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     GLenum target;
0fd959
     GLint uorder, vorder;
0fd959
@@ -359,13 +359,14 @@ __glXTypeSize(GLenum enm)
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXDrawArraysReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     __GLXdispatchDrawArraysHeader *hdr = (__GLXdispatchDrawArraysHeader *) pc;
0fd959
     __GLXdispatchDrawArraysComponentHeader *compHeader;
0fd959
     GLint numVertexes = hdr->numVertexes;
0fd959
     GLint numComponents = hdr->numComponents;
0fd959
     GLint arrayElementSize = 0;
0fd959
+    GLint x, size;
0fd959
     int i;
0fd959
 
0fd959
     if (swap) {
0fd959
@@ -374,6 +375,13 @@ __glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
0fd959
     }
0fd959
 
0fd959
     pc += sizeof(__GLXdispatchDrawArraysHeader);
0fd959
+    reqlen -= sizeof(__GLXdispatchDrawArraysHeader);
0fd959
+
0fd959
+    size = safe_mul(sizeof(__GLXdispatchDrawArraysComponentHeader),
0fd959
+                    numComponents);
0fd959
+    if (size < 0 || reqlen < 0 || reqlen < size)
0fd959
+        return -1;
0fd959
+
0fd959
     compHeader = (__GLXdispatchDrawArraysComponentHeader *) pc;
0fd959
 
0fd959
     for (i = 0; i < numComponents; i++) {
0fd959
@@ -417,17 +425,18 @@ __glXDrawArraysReqSize(const GLbyte * pc, Bool swap)
0fd959
             return -1;
0fd959
         }
0fd959
 
0fd959
-        arrayElementSize += __GLX_PAD(numVals * __glXTypeSize(datatype));
0fd959
+        x = safe_pad(safe_mul(numVals, __glXTypeSize(datatype)));
0fd959
+        if ((arrayElementSize = safe_add(arrayElementSize, x)) < 0)
0fd959
+            return -1;
0fd959
 
0fd959
         pc += sizeof(__GLXdispatchDrawArraysComponentHeader);
0fd959
     }
0fd959
 
0fd959
-    return ((numComponents * sizeof(__GLXdispatchDrawArraysComponentHeader)) +
0fd959
-            (numVertexes * arrayElementSize));
0fd959
+    return safe_add(size, safe_mul(numVertexes, arrayElementSize));
0fd959
 }
0fd959
 
0fd959
 int
0fd959
-__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap)
0fd959
+__glXSeparableFilter2DReqSize(const GLbyte * pc, Bool swap, int reqlen)
0fd959
 {
0fd959
     __GLXdispatchConvolutionFilterHeader *hdr =
0fd959
         (__GLXdispatchConvolutionFilterHeader *) pc;
0fd959
-- 
0fd959
1.9.3
0fd959