Bug 1168707 (CVE-2014-8098)

Various GLX extension calls do not check that the lengths and/or indexes sent by the
client are within the bounds specified by the caller or the bounds of
the memory allocated to hold the request read from the client, so could
read or write past the bounds of allocated memory while processing the
request. These calls all occur only after a client has successfully
authenticated itself.

Affected functions: __glXDisp_Render(), __glXDisp_RenderLarge(),
__glXDispSwap_VendorPrivate(), __glXDispSwap_VendorPrivateWithReply(),
set_client_info(), __glXDispSwap_SetClientInfoARB(), DoSwapInterval(),
DoGetProgramString(), DoGetString(), __glXDispSwap_RenderMode(),
__glXDisp_GetCompressedTexImage(), __glXDispSwap_GetCompressedTexImage(),
__glXDisp_FeedbackBuffer(), __glXDispSwap_FeedbackBuffer(), 
__glXDisp_SelectBuffer(), __glXDispSwap_SelectBuffer(),
__glXDisp_Flush(), __glXDispSwap_Flush(),
__glXDisp_Finish(), __glXDispSwap_Finish(),
__glXDisp_ReadPixels(), __glXDispSwap_ReadPixels(), 
__glXDisp_GetTexImage(), __glXDispSwap_GetTexImage(),
__glXDisp_GetPolygonStipple(), __glXDispSwap_GetPolygonStipple(),
__glXDisp_GetSeparableFilter(), __glXDisp_GetSeparableFilterEXT(),
__glXDisp_GetConvolutionFilter(), __glXDisp_GetConvolutionFilterEXT(),
__glXDisp_GetHistogram(), __glXDisp_GetHistogramEXT(),
__glXDisp_GetMinmax(), __glXDisp_GetMinmaxEXT(),
__glXDisp_GetColorTable(), __glXDisp_GetColorTableSGI(),
GetSeparableFilter(), GetConvolutionFilter(), GetHistogram(),
GetMinmax(), GetColorTable(),       

Originally developed by SGI and licensed to multiple vendors
prior to SGI open sourcing the code in 1999.
Included in XFree86 releases starting in XFree86 4.0 (2000).
Included in X.Org releases starting in X11R6.7 (2004).